summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'pull-target-arm-20230824' of ↵Stefan Hajnoczi2023-08-2426-199/+494
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * hw/gpio/nrf51: implement DETECT signal * accel/kvm: Specify default IPA size for arm64 * ptw: refactor, fix some FEAT_RME bugs * target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory types * target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK * Fix SME ST1Q * Fix 64-bit SSRA # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmTnIoUZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3vufEACPJcwyFvSBHDv4VQ6tbgOU # zwjpUMv4RMKhCOjuxBlJ2DICwOcGNuKer0tc6wkH2T5Ebhoego1osYbRZZoawAJf # ntg+Ndrx1QH9ORuGqYccLXtHnP741KiKggDHM05BJqB7rqtuH+N4fEn7Cdsw/DNg # XuCYD5QrxMYvkSOD1l8W0aqp81ucYPgkFqLufypgxrXUiRZ1RBAmPF47BFFdnM8f # NmrmT1LTF5jr70ySRB+ukK6BAGDc0CUfs6R6nYRwUjRPmSG2rrtUDGo+nOQGDqJo # PHWmt7rdZQG2w7HVyE/yc3h/CQ3NciwWKbCkRlaoujxHx/B6DRynSeO3NXsP8ELu # Gizoi3ltwHDQVIGQA19P5phZKHZf7x3MXmK4fDBGB9znvoSFTcjJqkdaN/ARXXO3 # e1vnK1MqnPI8Z1nGdeVIAUIrqhtLHnrrM7jf1tI/e4sjpl3prHq2PvQkakXu8clr # H8bPZ9zZzyrrSbl4NhpaFTsUiYVxeLoJsNKAmG8dHb+9YsFGXTvEBhtR9eUxnbaV # XyZ3jEdeW7/ngQ4C6XMD2ZDiKVdx2xJ2Pp5npvljldjmtGUvwQabKo+fPDt2fKjM # BwjhHA50I633k4fYIwm8YOb70I4oxoL9Lr6PkKriWPMTI5r7+dtwgigREVwnCn+Y # RsiByKMkDO2TcoQjvBZlCA== # =3MJ8 # -----END PGP SIGNATURE----- # gpg: Signature made Thu 24 Aug 2023 05:27:33 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20230824' of https://git.linaro.org/people/pmaydell/qemu-arm: (35 commits) target/arm: Fix 64-bit SSRA target/arm: Fix SME ST1Q target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructions target/arm: Pass security space rather than flag for AT instructions target/arm: Skip granule protection checks for AT instructions target/arm/helper: Fix tlbmask and tlbbits for TLBI VAE2* target/arm/ptw: Load stage-2 tables from realm physical space target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory types target/arm/ptw: Report stage 2 fault level for stage 2 faults on stage 1 ptw target/arm/ptw: Check for block descriptors at invalid levels target/arm/ptw: Set attributes correctly for MMU disabled data accesses target/arm/ptw: Drop S1Translate::out_secure target/arm/ptw: Remove S1Translate::in_secure target/arm/ptw: Remove last uses of ptw->in_secure target/arm/ptw: Only fold in NSTable bit effects in Secure state target/arm: Pass an ARMSecuritySpace to arm_is_el2_enabled_secstate() target/arm/ptw: Pass an ARMSecuritySpace to arm_hcr_el2_eff_secstate() target/arm/ptw: Pass ARMSecurityState to regime_translation_disabled() target/arm/ptw: Pass ptw into get_phys_addr_pmsa*() and get_phys_addr_disabled() ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * target/arm: Fix 64-bit SSRARichard Henderson2023-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Typo applied byte-wise shift instead of double-word shift. Cc: qemu-stable@nongnu.org Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1737 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230821022025.397682-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Fix SME ST1QRichard Henderson2023-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | A typo, noted in the bug report, resulting in an incorrect write offset. Cc: qemu-stable@nongnu.org Fixes: 7390e0e9ab8 ("target/arm: Implement SME LD1, ST1") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1833 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230818214255.146905-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASKJean-Philippe Brucker2023-08-224-14/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When FEAT_RME is implemented, these bits override the value of CNT[VP]_CTL_EL0.IMASK in Realm and Root state. Move the IRQ state update into a new gt_update_irq() function and test those bits every time we recompute the IRQ state. Since we're removing the IRQ state from some trace events, add a new trace event for gt_update_irq(). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230809123706.1842548-7-jean-philippe@linaro.org [PMM: only register change hook if not USER_ONLY and if TCG] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructionsJean-Philippe Brucker2023-08-221-11/+27
| | | | | | | | | | | | | | | | | | | | | | | | The AT instruction is UNDEFINED if the {NSE,NS} configuration is invalid. Add a function to check this on all AT instructions that apply to an EL lower than 3. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230809123706.1842548-6-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Pass security space rather than flag for AT instructionsJean-Philippe Brucker2023-08-223-30/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the moment we only handle Secure and Nonsecure security spaces for the AT instructions. Add support for Realm and Root. For AArch64, arm_security_space() gives the desired space. ARM DDI0487J says (R_NYXTL): If EL3 is implemented, then when an address translation instruction that applies to an Exception level lower than EL3 is executed, the Effective value of SCR_EL3.{NSE, NS} determines the target Security state that the instruction applies to. For AArch32, some instructions can access NonSecure space from Secure, so we still need to pass the state explicitly to do_ats_write(). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-5-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Skip granule protection checks for AT instructionsJean-Philippe Brucker2023-08-223-18/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GPC checks are not performed on the output address for AT instructions, as stated by ARM DDI 0487J in D8.12.2: When populating PAR_EL1 with the result of an address translation instruction, granule protection checks are not performed on the final output address of a successful translation. Rename get_phys_addr_with_secure(), since it's only used to handle AT instructions. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-4-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm/helper: Fix tlbmask and tlbbits for TLBI VAE2*Jean-Philippe Brucker2023-08-221-10/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When HCR_EL2.E2H is enabled, TLB entries are formed using the EL2&0 translation regime, instead of the EL2 translation regime. The TLB VAE2* instructions invalidate the regime that corresponds to the current value of HCR_EL2.E2H. At the moment we only invalidate the EL2 translation regime. This causes problems with RMM, which issues TLBI VAE2IS instructions with HCR_EL2.E2H enabled. Update vae2_tlbmask() to take HCR_EL2.E2H into account. Add vae2_tlbbits() as well, since the top-byte-ignore configuration is different between the EL2&0 and EL2 regime. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-3-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm/ptw: Load stage-2 tables from realm physical spaceJean-Philippe Brucker2023-08-221-8/+18
| | | | | | | | | | | | | | | | | | | | In realm state, stage-2 translation tables are fetched from the realm physical address space (R_PGRQD). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-2-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory typesPeter Maydell2023-08-221-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The PAR_EL1.SH field documents that for the cases of: * Device memory * Normal memory with both Inner and Outer Non-Cacheable the field should be 0b10 rather than whatever was in the translation table descriptor field. (In the pseudocode this is handled by PAREncodeShareability().) Perform this adjustment when assembling a PAR value. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-16-peter.maydell@linaro.org
| * target/arm/ptw: Report stage 2 fault level for stage 2 faults on stage 1 ptwPeter Maydell2023-08-221-3/+7
| | | | | | | | | | | | | | | | | | | | | | When we report faults due to stage 2 faults during a stage 1 page table walk, the 'level' parameter should be the level of the walk in stage 2 that faulted, not the level of the walk in stage 1. Correct the reporting of these faults. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-15-peter.maydell@linaro.org
| * target/arm/ptw: Check for block descriptors at invalid levelsPeter Maydell2023-08-221-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The architecture doesn't permit block descriptors at any arbitrary level of the page table walk; it depends on the granule size which levels are permitted. We implemented only a partial version of this check which assumes that block descriptors are valid at all levels except level 3, which meant that we wouldn't deliver the Translation fault for all cases of this sort of guest page table error. Implement the logic corresponding to the pseudocode AArch64.DecodeDescriptorType() and AArch64.BlockDescSupported(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-14-peter.maydell@linaro.org
| * target/arm/ptw: Set attributes correctly for MMU disabled data accessesPeter Maydell2023-08-221-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | When the MMU is disabled, data accesses should be Device nGnRnE, Outer Shareable, Untagged. We handle the other cases from AArch64.S1DisabledOutput() correctly but missed this one. Device nGnRnE is memattr == 0, so the only part we were missing was that shareability should be set to 2 for both insn fetches and data accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-13-peter.maydell@linaro.org
| * target/arm/ptw: Drop S1Translate::out_securePeter Maydell2023-08-221-5/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | We only use S1Translate::out_secure in two places, where we are setting up MemTxAttrs for a page table load. We can use arm_space_is_secure(ptw->out_space) instead, which guarantees that we're setting the MemTxAttrs secure and space fields consistently, and allows us to drop the out_secure field in S1Translate entirely. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-12-peter.maydell@linaro.org
| * target/arm/ptw: Remove S1Translate::in_securePeter Maydell2023-08-221-13/+0
| | | | | | | | | | | | | | | | | | We no longer look at the in_secure field of the S1Translate struct anyway, so we can remove it and all the code which sets it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-11-peter.maydell@linaro.org
| * target/arm/ptw: Remove last uses of ptw->in_securePeter Maydell2023-08-221-4/+7
| | | | | | | | | | | | | | | | | | Replace the last uses of ptw->in_secure with appropriate checks on ptw->in_space. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-10-peter.maydell@linaro.org
| * target/arm/ptw: Only fold in NSTable bit effects in Secure statePeter Maydell2023-08-221-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we do a translation in Secure state, the NSTable bits in table descriptors may downgrade us to NonSecure; we update ptw->in_secure and ptw->in_space accordingly. We guard that check correctly with a conditional that means it's only applied for Secure stage 1 translations. However, later on in get_phys_addr_lpae() we fold the effects of the NSTable bits into the final descriptor attributes bits, and there we do it unconditionally regardless of the CPU state. That means that in Realm state (where in_secure is false) we will set bit 5 in attrs, and later use it to decide to output to non-secure space. We don't in fact need to do this folding in at all any more (since commit 2f1ff4e7b9f30c): if an NSTable bit was set then we have already set ptw->in_space to ARMSS_NonSecure, and in that situation we don't look at attrs bit 5. The only thing we still need to deal with is the real NS bit in the final descriptor word, so we can just drop the code that ORed in the NSTable bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-9-peter.maydell@linaro.org
| * target/arm: Pass an ARMSecuritySpace to arm_is_el2_enabled_secstate()Peter Maydell2023-08-222-6/+9
| | | | | | | | | | | | | | | | | | Pass an ARMSecuritySpace instead of a bool secure to arm_is_el2_enabled_secstate(). This doesn't change behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-8-peter.maydell@linaro.org
| * target/arm/ptw: Pass an ARMSecuritySpace to arm_hcr_el2_eff_secstate()Peter Maydell2023-08-223-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arm_hcr_el2_eff_secstate() takes a bool secure, which it uses to determine whether EL2 is enabled in the current security state. With the advent of FEAT_RME this is no longer sufficient, because EL2 can be enabled for Secure state but not for Root, and both of those will pass 'secure == true' in the callsites in ptw.c. As it happens in all of our callsites in ptw.c we either avoid making the call or else avoid using the returned value if we're doing a translation for Root, so this is not a behaviour change even if the experimental FEAT_RME is enabled. But it is less confusing in the ptw.c code if we avoid the use of a bool secure that duplicates some of the information in the ArmSecuritySpace argument. Make arm_hcr_el2_eff_secstate() take an ARMSecuritySpace argument instead. Because we always want to know the HCR_EL2 for the security state defined by the current effective value of SCR_EL3.{NSE,NS}, it makes no sense to pass ARMSS_Root here, and we assert that callers don't do that. To avoid the assert(), we thus push the call to arm_hcr_el2_eff_secstate() down into the cases in regime_translation_disabled() that need it, rather than calling the function and ignoring the result for the Root space translations. All other calls to this function in ptw.c are already in places where we have confirmed that the mmu_idx is a stage 2 translation or that the regime EL is not 3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-7-peter.maydell@linaro.org
| * target/arm/ptw: Pass ARMSecurityState to regime_translation_disabled()Peter Maydell2023-08-221-7/+8
| | | | | | | | | | | | | | | | | | Plumb the ARMSecurityState through to regime_translation_disabled() rather than just a bool is_secure. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-6-peter.maydell@linaro.org
| * target/arm/ptw: Pass ptw into get_phys_addr_pmsa*() and get_phys_addr_disabled()Peter Maydell2023-08-221-21/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 6d2654ffacea813916176 we created the S1Translate struct and used it to plumb through various arguments that we were previously passing one-at-a-time to get_phys_addr_v5(), get_phys_addr_v6(), and get_phys_addr_lpae(). Extend that pattern to get_phys_addr_pmsav5(), get_phys_addr_pmsav7(), get_phys_addr_pmsav8() and get_phys_addr_disabled(), so that all the get_phys_addr_* functions we call from get_phys_addr_nogpc() take the S1Translate struct rather than the mmu_idx and is_secure bool. (This refactoring is a prelude to having the called functions look at ptw->is_space rather than using an is_secure boolean.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-5-peter.maydell@linaro.org
| * target/arm/ptw: Set s1ns bit in fault info more consistentlyPeter Maydell2023-08-221-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The s1ns bit in ARMMMUFaultInfo is documented as "true if we faulted on a non-secure IPA while in secure state". Both the places which look at this bit only do so after having confirmed that this is a stage 2 fault and we're dealing with Secure EL2, which leaves the ptw.c code free to set the bit to any random value in the other cases. Instead of taking advantage of that freedom, consistently make the bit be set to false for the "not a stage 2 fault for Secure EL2" cases. This removes some cases where we were using an 'is_secure' boolean and leaving the reader guessing about whether that was the right thing for Realm and Root cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-4-peter.maydell@linaro.org
| * target/arm/ptw: Don't report GPC faults on stage 1 ptw as stage2 faultsPeter Maydell2023-08-221-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In S1_ptw_translate() we set up the ARMMMUFaultInfo if the attempt to translate the page descriptor address into a physical address fails. This used to only be possible if we are doing a stage 2 ptw for that descriptor address, and so the code always sets fi->stage2 and fi->s1ptw to true. However, with FEAT_RME it is also possible for the lookup of the page descriptor address to fail because of a Granule Protection Check fault. These should not be reported as stage 2, otherwise arm_deliver_fault() will incorrectly set HPFAR_EL2. Similarly the s1ptw bit should only be set for stage 2 faults on stage 1 translation table walks, i.e. not for GPC faults. Add a comment to the the other place where we might detect a stage2-fault-on-stage-1-ptw, in arm_casq_ptw(), noting why we know in that case that it must really be a stage 2 fault and not a GPC fault. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-3-peter.maydell@linaro.org
| * target/arm/ptw: Don't set fi->s1ptw for UnsuppAtomicUpdate faultPeter Maydell2023-08-221-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | For an Unsupported Atomic Update fault where the stage 1 translation table descriptor update can't be done because it's to an unsupported memory type, this is a stage 1 abort (per the Arm ARM R_VSXXT). This means we should not set fi->s1ptw, because this will cause the code in the get_phys_addr_lpae() error-exit path to mark it as stage 2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-2-peter.maydell@linaro.org
| * accel/kvm: Make kvm_dirty_ring_reaper_init() voidAkihiko Odaki2023-08-221-7/+2
| | | | | | | | | | | | | | | | | | | | The returned value was always zero and had no meaning. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-7-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * accel/kvm: Free as when an error occurredAkihiko Odaki2023-08-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | An error may occur after s->as is allocated, for example if the KVM_CREATE_VM ioctl call fails. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-6-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * accel/kvm: Use negative KVM type for error propagationAkihiko Odaki2023-08-223-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | On MIPS, kvm_arch_get_default_type() returns a negative value when an error occurred so handle the case. Also, let other machines return negative values when errors occur and declare returning a negative value as the correct way to propagate an error that happened when determining KVM type. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-5-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * mips: Report an error when KVM_VM_MIPS_VZ is unavailableAkihiko Odaki2023-08-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | On MIPS, QEMU requires KVM_VM_MIPS_VZ type for KVM. Report an error in such a case as other architectures do when an error occurred during KVM type decision. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-4-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * accel/kvm: Specify default IPA size for arm64Akihiko Odaki2023-08-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this change, the default KVM type, which is used for non-virt machine models, was 0. The kernel documentation says: > On arm64, the physical address size for a VM (IPA Size limit) is > limited to 40bits by default. The limit can be configured if the host > supports the extension KVM_CAP_ARM_VM_IPA_SIZE. When supported, use > KVM_VM_TYPE_ARM_IPA_SIZE(IPA_Bits) to set the size in the machine type > identifier, where IPA_Bits is the maximum width of any physical > address used by the VM. The IPA_Bits is encoded in bits[7-0] of the > machine type identifier. > > e.g, to configure a guest to use 48bit physical address size:: > > vm_fd = ioctl(dev_fd, KVM_CREATE_VM, KVM_VM_TYPE_ARM_IPA_SIZE(48)); > > The requested size (IPA_Bits) must be: > > == ========================================================= > 0 Implies default size, 40bits (for backward compatibility) > N Implies N bits, where N is a positive integer such that, > 32 <= N <= Host_IPA_Limit > == ========================================================= > Host_IPA_Limit is the maximum possible value for IPA_Bits on the host > and is dependent on the CPU capability and the kernel configuration. > The limit can be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the > KVM_CHECK_EXTENSION ioctl() at run-time. > > Creation of the VM will fail if the requested IPA size (whether it is > implicit or explicit) is unsupported on the host. https://docs.kernel.org/virt/kvm/api.html#kvm-create-vm So if Host_IPA_Limit < 40, specifying 0 as the type will fail. This actually confused libvirt, which uses "none" machine model to probe the KVM availability, on M2 MacBook Air. Fix this by using Host_IPA_Limit as the default type when KVM_CAP_ARM_VM_IPA_SIZE is available. Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-3-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * kvm: Introduce kvm_arch_get_default_type hookAkihiko Odaki2023-08-2210-13/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kvm_arch_get_default_type() returns the default KVM type. This hook is particularly useful to derive a KVM type that is valid for "none" machine model, which is used by libvirt to probe the availability of KVM. For MIPS, the existing mips_kvm_type() is reused. This function ensures the availability of VZ which is mandatory to use KVM on the current QEMU. Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-2-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added doc comment for new function] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
| * qtest: microbit-test: add tests for nRF51 DETECTChris Laplante2023-08-221-0/+44
| | | | | | | | | | | | | | | | | | | | Exercise the DETECT mechanism of the GPIO peripheral. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-7-chris@laplante.io [PMM: fixed coding style nits] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qtest: irq_intercept_[out/in]: return FAIL if no intercepts are installedChris Laplante2023-08-221-2/+10
| | | | | | | | | | | | | | | | | | This is much better than just silently failing with OK. Signed-off-by: Chris Laplante <chris@laplante.io> Message-id: 20230728160324.1159090-6-chris@laplante.io Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qtest: bail from irq_intercept_in if name is specifiedChris Laplante2023-08-221-0/+8
| | | | | | | | | | | | | | | | | | Named interception of in-GPIOs is not supported yet. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-5-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qtest: implement named interception of out-GPIOChris Laplante2023-08-223-8/+27
| | | | | | | | | | | | | | | | | | | | Adds qtest_irq_intercept_out_named method, which utilizes a new optional name parameter to the irq_intercept_out qtest command. Signed-off-by: Chris Laplante <chris@laplante.io> Message-id: 20230728160324.1159090-4-chris@laplante.io Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * qtest: factor out qtest_install_gpio_out_interceptChris Laplante2023-08-221-6/+10
| | | | | | | | | | | | | | Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-3-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * hw/gpio/nrf51: implement DETECT signalChris Laplante2023-08-222-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | Implement nRF51 DETECT signal in the GPIO peripheral. The reference manual makes mention of a per-pin DETECT signal, but these are not exposed to the user. See https://devzone.nordicsemi.com/f/nordic-q-a/39858/gpio-per-pin-detect-signal-available for more information. Currently, I don't see a reason to model these. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-2-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge tag 'pull-loongarch-20230824' of https://gitlab.com/gaosong/qemu into ↵Stefan Hajnoczi2023-08-2428-1093/+1591
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging pull-loongarch-20230824 # -----BEGIN PGP SIGNATURE----- # # iLMEAAEIAB0WIQS4/x2g0v3LLaCcbCxAov/yOSY+3wUCZOcdAwAKCRBAov/yOSY+ # 3w3CA/sH8+Ay+Qnaqa2vEyuhOlFQuxHKeR7mYfsitAdzh8yMK2K8C2iBUzDzL1H3 # kZmZbCcYX7ko9RLhsuXmvfBJ7iwzY55ozSHLIjJ/VS4JVE5B0cUSZ5jjIPDqpzDs # 7TUt9qpTkwg0e+klzVREWLSWP5xopvkRvFHZM3KZZhGMphOTUQ== # =/HHZ # -----END PGP SIGNATURE----- # gpg: Signature made Thu 24 Aug 2023 05:04:03 EDT # gpg: using RSA key B8FF1DA0D2FDCB2DA09C6C2C40A2FFF239263EDF # gpg: Good signature from "Song Gao <m17746591750@163.com>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: B8FF 1DA0 D2FD CB2D A09C 6C2C 40A2 FFF2 3926 3EDF * tag 'pull-loongarch-20230824' of https://gitlab.com/gaosong/qemu: (31 commits) hw/loongarch: Fix ACPI processor id off-by-one error target/loongarch: Split fcc register to fcc0-7 in gdbstub hw/intc/loongarch_pch: fix edge triggered irq handling target/loongarch: cpu: Implement get_arch_id callback target/loongarch: Add avail_IOCSR to check iocsr instructions target/loongarch: Add avail_LSX to check LSX instructions target/loongarch: Add avail_LAM to check atomic instructions target/loongarch: Add avail_LSPW to check LSPW instructions target/loongarch: Add avail_FP/FP_SP/FP_DP to check fpu instructions hw/loongarch: Remove restriction of la464 cores in the virt machine target/loongarch: Add LoongArch32 cpu la132 target/loongarch: Add avail_64 to check la64-only instructions target/loongarch: Add a check parameter to the TRANS macro target/loongarch: Sign extend results in VA32 mode target/loongarch: Truncate high 32 bits of address in VA32 mode target/loongarch: Extract set_pc() helper target/loongarch: Extract make_address_pc() helper target/loongarch: Extract make_address_i() helper target/loongarch: Extract make_address_x() helper target/loongarch: Add LA64 & VA32 to DisasContext ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | hw/loongarch: Fix ACPI processor id off-by-one errorJiajie Chen2023-08-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In hw/acpi/aml-build.c:build_pptt() function, the code assumes that the ACPI processor id equals to the cpu index, for example if we have 8 cpus, then the ACPI processor id should be in range 0-7. However, in hw/loongarch/acpi-build.c:build_madt() function we broke the assumption. If we have 8 cpus again, the ACPI processor id in MADT table would be in range 1-8. It violates the following description taken from ACPI spec 6.4 table 5.138: If the processor structure represents an actual processor, this field must match the value of ACPI processor ID field in the processor’s entry in the MADT. It will break the latest Linux 6.5-rc6 with the following error message: ACPI PPTT: PPTT table found, but unable to locate core 7 (8) Invalid BIOS PPTT Here 7 is the last cpu index, 8 is the ACPI processor id learned from MADT. With this patch, Linux can properly detect SMT threads when "-smp 8,sockets=1,cores=4,threads=2" is passed: Thread(s) per core: 2 Core(s) per socket: 2 Socket(s): 2 The detection of number of sockets is still wrong, but that is out of scope of the commit. Signed-off-by: Jiajie Chen <c@jia.je> Reviewed-by: Bibo Mao <maobibo@loongson.cn> Message-Id: <20230820105658.99123-2-c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn>
| * | target/loongarch: Split fcc register to fcc0-7 in gdbstubJiajie Chen2023-08-242-10/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since GDB 13.1(GDB commit ea3352172), GDB LoongArch changed to use fcc0-7 instead of fcc register. This commit partially reverts commit 2f149c759 (`target/loongarch: Update gdb_set_fpu() and gdb_get_fpu()`) to match the behavior of GDB. Note that it is a breaking change for GDB 13.0 or earlier, but it is also required for GDB 13.1 or later to work. Signed-off-by: Jiajie Chen <c@jia.je> Acked-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230808054315.3391465-1-c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn>
| * | hw/intc/loongarch_pch: fix edge triggered irq handlingBibo Mao2023-08-241-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For edge triggered irq, qemu_irq_pulse is used to inject irq. It will set irq with high level and low level soon to simluate pulse irq. For edge triggered irq, irq is injected and set as pending at rising level, do not clear irq at lowering level. LoongArch pch interrupt will clear irq for lowering level irq, there will be problem. ACPI ged deivce is edge-triggered irq, it is used for cpu/memory hotplug. This patch fixes memory hotplug issue on LoongArch virt machine. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230707091557.1474790-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
| * | target/loongarch: cpu: Implement get_arch_id callbackBibo Mao2023-08-243-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the callback for getting the architecture-dependent CPU ID, the cpu ID is physical id described in ACPI MADT table, this will be used for cpu hotplug. Signed-off-by: Bibo Mao <maobibo@loongson.cn> Reviewed-by: Song Gao <gaosong@loongson.cn> Message-Id: <20230824005007.2000525-1-maobibo@loongson.cn> Signed-off-by: Song Gao <gaosong@loongson.cn>
| * | target/loongarch: Add avail_IOCSR to check iocsr instructionsSong Gao2023-08-242-9/+9
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-16-gaosong@loongson.cn> Message-Id: <20230822072219.35719-1-philmd@linaro.org>
| * | target/loongarch: Add avail_LSX to check LSX instructionsSong Gao2023-08-242-661/+823
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-15-gaosong@loongson.cn> Message-Id: <20230822073026.35776-1-philmd@linaro.org>
| * | target/loongarch: Add avail_LAM to check atomic instructionsSong Gao2023-08-242-36/+37
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-14-gaosong@loongson.cn> Message-Id: <20230822071959.35620-8-philmd@linaro.org>
| * | target/loongarch: Add avail_LSPW to check LSPW instructionsSong Gao2023-08-242-0/+9
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-13-gaosong@loongson.cn> Message-Id: <20230822071959.35620-7-philmd@linaro.org>
| * | target/loongarch: Add avail_FP/FP_SP/FP_DP to check fpu instructionsSong Gao2023-08-247-86/+159
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Song Gao <gaosong@loongson.cn> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-12-gaosong@loongson.cn> Message-Id: <20230822071959.35620-6-philmd@linaro.org>
| * | hw/loongarch: Remove restriction of la464 cores in the virt machineSong Gao2023-08-241-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow virt machine to be used with la132 instead of la464. Co-authored-by: Jiajie Chen <c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230822032724.1353391-11-gaosong@loongson.cn> Message-Id: <20230822071959.35620-5-philmd@linaro.org>
| * | target/loongarch: Add LoongArch32 cpu la132Jiajie Chen2023-08-241-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add LoongArch32 cpu la132. Due to lack of public documentation of la132, it is currently a synthetic LoongArch32 cpu model. Details need to be added in the future. Signed-off-by: Jiajie Chen <c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn> Acked-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230822032724.1353391-10-gaosong@loongson.cn> Message-Id: <20230822071959.35620-4-philmd@linaro.org>
| * | target/loongarch: Add avail_64 to check la64-only instructionsSong Gao2023-08-2410-123/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The la32 instructions listed in Table 2 at https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#overview-of-basic-integer-instructions Co-authored-by: Jiajie Chen <c@jia.je> Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-9-gaosong@loongson.cn> Message-Id: <20230822071959.35620-3-philmd@linaro.org>
| * | target/loongarch: Add a check parameter to the TRANS macroSong Gao2023-08-2414-944/+946
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default check parmeter is ALL. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Song Gao <gaosong@loongson.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20230822032724.1353391-8-gaosong@loongson.cn> Message-Id: <20230822071959.35620-2-philmd@linaro.org>