summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
...
| * accel/tcg: Split out getpc.hRichard Henderson2025-03-082-9/+25
| | | | | | | | | | | | | | | | | | | | Split out GETPC to a target-independent header. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250308072348.65723-3-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Restrict GETPC_ADJ to 'tb-internal.h'Philippe Mathieu-Daudé2025-03-082-9/+11
| | | | | | | | | | | | | | | | | | GETPC_ADJ is only used within accel/tcg/, no need to expose it to all the code base. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250308072348.65723-2-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Build tcg-accel-ops-mttcg.c onceRichard Henderson2025-03-082-2/+1
| | | | | | | | | | | | | | All that is required is to avoid including exec-all.h. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Build tcg-accel-ops-rr.c onceRichard Henderson2025-03-082-2/+2
| | | | | | | | | | | | | | All that is required is to use cpu-common.h instead of exec-all.h. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Build tcg-accel-ops-icount.c onceRichard Henderson2025-03-082-2/+2
| | | | | | | | | | | | | | All that is required is to avoid including exec-all.h. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Build tcg-accel-ops.c onceRichard Henderson2025-03-081-1/+1
| | | | | | | | | | | | | | | | Now that tcg-accel-ops.c uses cputlb.h instead of exec-all.h, it can be built once. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * system: Build watchpoint.c onceRichard Henderson2025-03-081-1/+1
| | | | | | | | | | | | | | | | | | | | Now that watchpoint.c uses cputlb.h instead of exec-all.h, it can be built once. Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * exec: Declare tlb_flush*() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-0834-211/+224
| | | | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20241114011310.3615-19-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * exec: Declare tlb_hit*() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-082-23/+23
| | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241114011310.3615-20-philmd@linaro.org>
| * exec: Declare tlb_set_page() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-0815-15/+24
| | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241114011310.3615-18-philmd@linaro.org>
| * exec: Declare tlb_set_page_with_attrs() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-084-27/+30
| | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241114011310.3615-17-philmd@linaro.org>
| * exec: Declare tlb_set_page_full() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-083-23/+24
| | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20241114011310.3615-16-philmd@linaro.org>
| * exec: Declare tlb_reset_dirty*() in 'exec/cputlb.h'Philippe Mathieu-Daudé2025-03-084-3/+9
| | | | | | | | | | | | | | | | | | Move CPU TLB related methods to "exec/cputlb.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Message-ID: <20241114011310.3615-14-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Compile watchpoint.c onceRichard Henderson2025-03-084-6/+5
| | | | | | | | | | | | | | | | | | | | | | | | Move tb_check_watchpoint declaration from tb-internal.h, which is still target-specific, to internal-common.h, which isn't. Otherwise, all that is required to build watchpoint.c once is to include the new exec/cpu-interrupt.h instead of exec/exec-all.h. Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * include/exec: Split out exec/cpu-interrupt.hRichard Henderson2025-03-083-65/+71
| | | | | | | | | | | | | | | | | | | | | | | | Some of these bits are actually common to all cpus; while the reset have common reservations for target-specific usage. While generic code cannot know what the target-specific usage is, common code can know what to do with the bits, e.g. single-step. Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * include/exec: Move TARGET_PAGE_{SIZE,MASK,BITS} to target_page.hRichard Henderson2025-03-075-48/+51
| | | | | | | | | | | | | | | | | | Re-use the TARGET_PAGE_BITS_VARY mechanism to define TARGET_PAGE_SIZE and friends when not compiling per-target. Inline qemu_target_page_{size,mask,bits} as they are now trivial. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * accel/tcg: Restrict CPU_TLB_DYN_*_BITS definitions to accel/tcg/Philippe Mathieu-Daudé2025-03-072-26/+27
| | | | | | | | | | | | | | | | | | | | CPU_TLB_DYN_*_BITS definitions are only used by accel/tcg/cputlb.c and accel/tcg/translate-all.c. Move them to accel/tcg/tb-internal.h. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20250305191859.71608-1-philmd@linaro.org>
| * linux-user/main: Allow setting tb-sizeIlya Leoshkevich2025-03-071-0/+12
| | | | | | | | | | | | | | | | | | | | | | While qemu-system can set tb-size using -accel tcg,tb-size=n, there is no similar knob for qemu-user. Add one in a way similar to how one-insn-per-tb is already handled. Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240730215532.1442-1-iii@linux.ibm.com>
* | Merge tag 'pull-target-arm-20250307' of ↵Stefan Hajnoczi2025-03-0823-176/+455
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * hw/arm/smmu-common: Remove the repeated ttb field * hw/gpio: npcm7xx: fixup out-of-bounds access * tests/functional/test_arm_sx1: Check whether the serial console is working * target/arm: Fix minor bugs in generic timer register handling * target/arm: Implement SEL2 physical and virtual timers * target/arm: Correct STRD, LDRD atomicity and fault behaviour * target/arm: Make dummy debug registers RAZ, not NOP * util/qemu-timer.c: Don't warp timer from timerlist_rearm() * include/exec/memop.h: Expand comment for MO_ATOM_SUBALIGN * hw/arm/smmu: Introduce smmu_configs_inv_sid_range() helper * target/rx: Set exception vector base to 0xffffff80 * target/rx: Remove TCG_CALL_NO_WG from helpers which write env # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmfLCzgZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3pwVEACgJJm1zdtRd87AnA0eY29a # uG8M35+VS/bNbA6IXzz1hFHUFh1smrda0C7VOefRqThEhkDObh1gfKWK3YeBenDn # FQsI6Hwu23ozTCgOniheU8SGbTtIvVxRRX4S91xNZgJ15riEATDnTisZv8iUChdr # DcZopuH0uRiOq7TWuRjxqvhaqH6WusvHzK0mizTqr9UhbqPHVl7CZfr1/AtJLpZF # 32ix0JMofFWS52LFI19KWPlQG5Z3+lOw2ASyTf4cCaoCG6FTMv22E1x8mbMc2i96 # WrsB+NdhlBVRu7mskOP2Br09AbQZ/Fy7AGlDhgZebipOUVMlpDj1RXj/BDH3H/px # qsjOk3V3gzM2bD+KvJuO4FlGXgEbOzGsGBwwY152C/6DYW5uTha/H1Pp+/iR8kcS # HvAsqNLh/uF7O1Kn8qzCNvglKDC3z0C4X15Sj8SjGz8Xtn1Ign/GVkDv8ZCoR39K # ltnXwvhzlDMkcGFFfEn33MYZZYqB15nX5a78/cStB/aOGPtZwUJ+2udLDzmug5ve # 9oY9WMqqBDVxo4+qcAeZ+aem2VD6w79mhJyy1xmqOkifhFWqQ2VbDrKtqnrqhPK/ # neyWrd2zCF6fY1wvb7vVKMy7aC5jI2K6qVU7ueZGCGKU2MtvbVaFJFByOjnVjv6o # c65VNXkbaCIedrSlalMO4w== # =8typ # -----END PGP SIGNATURE----- # gpg: Signature made Fri 07 Mar 2025 23:05:28 HKT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20250307' of https://git.linaro.org/people/pmaydell/qemu-arm: (21 commits) target/rx: Remove TCG_CALL_NO_WG from helpers which write env target/rx: Set exception vector base to 0xffffff80 hw/arm/smmu: Introduce smmu_configs_inv_sid_range() helper include/exec/memop.h: Expand comment for MO_ATOM_SUBALIGN util/qemu-timer.c: Don't warp timer from timerlist_rearm() target/arm: Make dummy debug registers RAZ, not NOP target/arm: Drop unused address_offset from op_addr_{rr, ri}_post() target/arm: Correct STRD atomicity target/arm: Correct LDRD atomicity and fault behaviour hw/arm: enable secure EL2 timers for sbsa machine hw/arm: enable secure EL2 timers for virt machine target/arm: Document the architectural names of our GTIMERs target/arm: Implement SEL2 physical and virtual timers target/arm: Refactor handling of timer offset for direct register accesses target/arm: Always apply CNTVOFF_EL2 for CNTV_TVAL_EL02 accesses target/arm: Make CNTPS_* UNDEF from Secure EL1 when Secure EL2 is enabled target/arm: Don't apply CNTVOFF_EL2 for EL2_VIRT timer target/arm: Apply correct timer offset when calculating deadlines tests/functional/test_arm_sx1: Check whether the serial console is working hw/gpio: npcm7xx: fixup out-of-bounds access ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | target/rx: Remove TCG_CALL_NO_WG from helpers which write envKeith Packard2025-03-071-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Functions which modify TCG globals must not be marked TCG_CALL_NO_WG, as that tells the optimizer that TCG global values already loaded in machine registers are still valid, and so any changes which these helpers make to the CPU state may be ignored. The target/rx code chooses to put (among other things) all the PSW bits and also ACC into globals, so the NO_WG flag on various functions that touch the PSW or ACC is incorrect and must be removed. This includes all the floating point helper functions, because update_fpsw() will update PSW Z and S. Signed-off-by: Keith Packard <keithp@keithp.com> [PMM: Clarified commit message] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/rx: Set exception vector base to 0xffffff80Keith Packard2025-03-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The documentation says the vector is at 0xffffff80, instead of the previous value of 0xffffffc0. That value must have been a bug because the standard vector values (20, 21, 23, 25, 30) were all past the end of the array. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/smmu: Introduce smmu_configs_inv_sid_range() helperJianChunfu2025-03-075-23/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use a similar terminology smmu_hash_remove_by_sid_range() as the one being used for other hash table matching functions since smmuv3_invalidate_ste() name is not self explanatory, and introduce a helper that invokes the g_hash_table_foreach_remove. No functional change intended. Signed-off-by: JianChunfu <jansef.jian@hj-micro.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250228031438.3916-1-jansef.jian@hj-micro.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | include/exec/memop.h: Expand comment for MO_ATOM_SUBALIGNPeter Maydell2025-03-071-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Expand the example in the comment documenting MO_ATOM_SUBALIGN, to be clearer about the atomicity guarantees it represents. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250228103222.1838913-1-peter.maydell@linaro.org
| * | util/qemu-timer.c: Don't warp timer from timerlist_rearm()Peter Maydell2025-03-071-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we call icount_start_warp_timer() from timerlist_rearm(). This produces incorrect behaviour, because timerlist_rearm() is called, for instance, when a timer callback modifies its timer. We cannot decide here to warp the timer forwards to the next timer deadline merely because all_cpu_threads_idle() is true, because the timer callback we were called from (or some other callback later in the list of callbacks being invoked) may be about to raise a CPU interrupt and move a CPU from idle to ready. The only valid place to choose to warp the timer forward is from the main loop, when we know we have no outstanding IO or timer callbacks that might be about to wake up a CPU. For Arm guests, this bug was mostly latent until the refactoring commit f6fc36deef6abc ("target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASK"), which exposed it because it refactored a timer callback so that it happened to call timer_mod() first and raise the interrupt second, when it had previously raised the interrupt first and called timer_mod() afterwards. This call seems to have originally derived from the pre-record-and-replay icount code, which (as of e.g. commit db1a49726c3c in 2010) in this location did a call to qemu_notify_event(), necessary to get the icount code in the vCPU round-robin thread to stop and recalculate the icount deadline when a timer was reprogrammed from the IO thread. In current QEMU, everything is done on the vCPU thread when we are in icount mode, so there's no need to try to notify another thread here. I suspect that the other reason why this call was doing icount timer warping is that it pre-dates commit efab87cf79077a from 2015, which added a call to icount_start_warp_timer() to main_loop_wait(). Once the call in timerlist_rearm() has been removed, if the timer callbacks don't cause any CPU to be woken up then we will end up calling icount_start_warp_timer() from main_loop_wait() when the rr main loop code calls rr_wait_io_event(). Remove the incorrect call from timerlist_rearm(). Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2703 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Tested-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250210135804.3526943-1-peter.maydell@linaro.org
| * | target/arm: Make dummy debug registers RAZ, not NOPPeter Maydell2025-03-071-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In debug_helper.c we provide a few dummy versions of debug registers: * DBGVCR (AArch32 only): enable bits for vector-catch debug events * MDCCINT_EL1: interrupt enable bits for the DCC debug communications channel * DBGVCR32_EL2: the AArch64 accessor for the state in DBGVCR We implemented these only to stop Linux crashing on startup, but we chose to implement them as ARM_CP_NOP. This worked for Linux where it only cares about trying to write to these registers, but is very confusing behaviour for anything that wants to read the registers (perhaps for context state switches), because the destination register will be left with whatever random value it happened to have before the read. Model these registers instead as RAZ. Fixes: 5e8b12ffbb8c68 ("target-arm: Implement minimal DBGVCR, OSDLR_EL1, MDCCSR_EL0") Fixes: 5dbdc4342f479d ("target-arm: Implement dummy MDCCINT_EL1") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2708 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250228162424.1917269-1-peter.maydell@linaro.org
| * | target/arm: Drop unused address_offset from op_addr_{rr, ri}_post()Peter Maydell2025-03-071-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All the callers of op_addr_rr_post() and op_addr_ri_post() now pass in zero for the address_offset, so we can remove that argument. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250227142746.1698904-4-peter.maydell@linaro.org
| * | target/arm: Correct STRD atomicityPeter Maydell2025-03-071-20/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our STRD implementation doesn't correctly implement the requirement: * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of STRD to use a single tcg_gen_qemu_st_i64() of a value produced by concatenating the two 32 bit source registers. This allows us to get the atomicity right. As with the LDRD change, now that we don't update 'addr' in the course of performing the store we need to adjust the offset we pass to op_addr_ri_post() and op_addr_rr_post(). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250227142746.1698904-3-peter.maydell@linaro.org
| * | target/arm: Correct LDRD atomicity and fault behaviourPeter Maydell2025-03-071-24/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our LDRD implementation is wrong in two respects: * if the address is 4-aligned and the load crosses a page boundary and the second load faults and the first load was to the base register (as in cases like "ldrd r2, r3, [r2]", then we must not update the base register before taking the fault * if the address is 8-aligned the access must be a 64-bit single-copy atomic access, not two 32-bit accesses Rewrite the handling of the loads in LDRD to use a single tcg_gen_qemu_ld_i64() and split the result into the destination registers. This allows us to get the atomicity requirements right, and also implicitly means that we won't update the base register too early for the page-crossing case. Note that because we no longer increment 'addr' by 4 in the course of performing the LDRD we must change the adjustment value we pass to op_addr_ri_post() and op_addr_rr_post(): it no longer needs to subtract 4 to get the correct value to use if doing base register writeback. STRD has the same problem with not getting the atomicity right; we will deal with that in the following commit. Cc: qemu-stable@nongnu.org Reported-by: Stu Grossman <stu.grossman@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250227142746.1698904-2-peter.maydell@linaro.org
| * | hw/arm: enable secure EL2 timers for sbsa machineAlex Bennée2025-03-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250204125009.2281315-10-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm: enable secure EL2 timers for virt machineAlex Bennée2025-03-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250204125009.2281315-9-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: Document the architectural names of our GTIMERsAlex Bennée2025-03-071-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As we are about to add more physical and virtual timers let's make it clear what each timer does. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250204125009.2281315-8-peter.maydell@linaro.org [PMM: Add timer register name prefix to each comment] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: Implement SEL2 physical and virtual timersAlex Bennée2025-03-075-1/+174
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When FEAT_SEL2 was implemented the SEL2 timers were missed. This shows up when building the latest Hafnium with SPMC_AT_EL=2. The actual implementation utilises the same logic as the rest of the timers so all we need to do is: - define the timers and their access functions - conditionally add the correct system registers - create a new accessfn as the rules are subtly different to the existing secure timer Fixes: e9152ee91c (target/arm: add ARMv8.4-SEL2 system registers) Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250204125009.2281315-7-peter.maydell@linaro.org Cc: qemu-stable@nongnu.org Cc: Andrei Homescu <ahomescu@google.com> Cc: Arve Hjønnevåg <arve@google.com> Cc: Rémi Denis-Courmont <remi.denis.courmont@huawei.com> [PMM: CP_ACCESS_TRAP_UNCATEGORIZED -> CP_ACCESS_UNDEFINED; offset logic now in gt_{indirect,direct}_access_timer_offset() ] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | target/arm: Refactor handling of timer offset for direct register accessesPeter Maydell2025-03-073-54/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When reading or writing the timer registers, sometimes we need to apply one of the timer offsets. Specifically, this happens for direct reads of the counter registers CNTPCT_EL0 and CNTVCT_EL0 (and their self-synchronized variants CNTVCTSS_EL0 and CNTPCTSS_EL0). It also applies for direct reads and writes of the CNT*_TVAL_EL* registers that provide the 32-bit downcounting view of each timer. We currently do this with duplicated code in gt_tval_read() and gt_tval_write() and a special-case in gt_virt_cnt_read() and gt_cnt_read(). Refactor this so that we handle it all in a single function gt_direct_access_timer_offset(), to parallel how we handle the offset for indirect accesses. The call in the WFIT helper previously to gt_virt_cnt_offset() is now to gt_direct_access_timer_offset(); this is the correct behaviour, but it's not immediately obvious that it shouldn't be considered an indirect access, so we add an explanatory comment. This commit should make no behavioural changes. (Cc to stable because the following bugfix commit will depend on this one.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250204125009.2281315-6-peter.maydell@linaro.org
| * | target/arm: Always apply CNTVOFF_EL2 for CNTV_TVAL_EL02 accessesPeter Maydell2025-03-071-9/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we handle CNTV_TVAL_EL02 by calling gt_tval_read() for the EL1 virt timer. This is almost correct, but the underlying CNTV_TVAL_EL0 register behaves slightly differently. CNTV_TVAL_EL02 always applies the CNTVOFF_EL2 offset; CNTV_TVAL_EL0 doesn't do so if we're at EL2 and HCR_EL2.E2H is 1. We were getting this wrong, because we ended up in gt_virt_cnt_offset() and did the E2H check. Factor out the tval read/write calculation from the selection of the offset, so that we can special case gt_virt_tval_read() and gt_virt_tval_write() to unconditionally pass CNTVOFF_EL2. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250204125009.2281315-5-peter.maydell@linaro.org
| * | target/arm: Make CNTPS_* UNDEF from Secure EL1 when Secure EL2 is enabledPeter Maydell2025-03-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we added Secure EL2 support, we missed that this needs an update to the access code for the EL3 physical timer registers. These are supposed to UNDEF from Secure EL1 when Secure EL2 is enabled. (Note for stable backporting: for backports to branches where CP_ACCESS_UNDEFINED is not defined, the old name to use instead is CP_ACCESS_TRAP_UNCATEGORIZED.) Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250204125009.2281315-4-peter.maydell@linaro.org
| * | target/arm: Don't apply CNTVOFF_EL2 for EL2_VIRT timerPeter Maydell2025-03-071-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CNTVOFF_EL2 offset register should only be applied for accessses to CNTVCT_EL0 and for the EL1 virtual timer (CNTV_*). We were incorrectly applying it for the EL2 virtual timer (CNTHV_*). Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250204125009.2281315-3-peter.maydell@linaro.org
| * | target/arm: Apply correct timer offset when calculating deadlinesPeter Maydell2025-03-071-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we are calculating timer deadlines, the correct definition of whether or not to apply an offset to the physical count is described in the Arm ARM DDI4087 rev L.a section D12.2.4.1. This is different from when the offset should be applied for a direct read of the counter sysreg. We got this right for the EL1 physical timer and for the EL1 virtual timer, but got all the rest wrong: they should be using a zero offset always. Factor the offset calculation out into a function that has a comment documenting exactly which offset it is calculating and which gets the HYP, SEC, and HYPVIRT cases right. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-id: 20250204125009.2281315-2-peter.maydell@linaro.org
| * | tests/functional/test_arm_sx1: Check whether the serial console is workingThomas Huth2025-03-072-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The kernel that is used in the sx1 test prints the usual Linux log onto the serial console, but this test currently ignores it. To make sure that the serial device is working properly, let's check for some strings in the output here. While we're at it, also add the test to the corresponding section in the MAINTAINERS file. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250226104833.1176253-1-thuth@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/gpio: npcm7xx: fixup out-of-bounds accessPatrick Venture2025-03-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The reg isn't validated to be a possible register before it's dereferenced for one case. The mmio space registered for the gpio device is 4KiB but there aren't that many registers in the struct. Cc: qemu-stable@nongnu.org Fixes: 526dbbe0874 ("hw/gpio: Add GPIO model for Nuvoton NPCM7xx") Signed-off-by: Patrick Venture <venture@google.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250226024603.493148-1-venture@google.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * | hw/arm/smmu-common: Remove the repeated ttb fieldJianChunfu2025-03-071-1/+0
| |/ | | | | | | | | | | | | | | | | | | SMMUTransCfg->ttb is never used in QEMU, TT base address can be accessed by SMMUTransCfg->tt[i]->ttb. Signed-off-by: JianChunfu <jansef.jian@hj-micro.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Message-id: 20250221031034.69822-1-jansef.jian@hj-micro.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | Merge tag 'pull-request-2025-03-07' of https://gitlab.com/thuth/qemu into ↵Stefan Hajnoczi2025-03-0818-60/+197
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | staging * Bug fixes and some small improvements for functional tests * Improve performance of s390x PCI passthrough devices with relaxed translation # -----BEGIN PGP SIGNATURE----- # # iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmfK3dsRHHRodXRoQHJl # ZGhhdC5jb20ACgkQLtnXdP5wLbUfDQ/8CopnzCKGKFhyM5skrHbhDbUVbul6yV4L # kIOo7N8OlrNcQB90bj+Udy+mUANHjkmSiBa5lJ/78ej4DFS6CxeVgrl1fSEl36xn # GjWDwSUiN8pG1O4YtnDqWVTBieGSzbkQr1jHgpeAnvv08s+TtmudP1T8IznWU2v9 # FqD78SdebZ0Kua+ksBgMxwkHd6VMw13vsu6KuT9VBhie40LcDrFOuG8RDz/qo4IO # Yg9s1Bqcy7Wa4+0ldMXS1plSdIqJBtVc/HDTg1QwH994b4Lvr7ffrFZmuVcd2dbE # XKQ5jAMOYZqWdlXszkyd8moYGhmevCkQlALhpnbHixnfakfFYX0wTiJB6oCthFQ0 # It0J/ntNsCmJiIHNbPLzsJ1pE5+ureRnGbxVe05n+zfm8MaXL6s4nSdZzHyp8n43 # UZQqVzK55Q34K9O0qoUdCdBCjMKS9v5u95jjJo8+nc8sJoeQTssOoiixwB/E4y21 # 9qSh7CbDjQK4zwuzQ7jKD603zAJH6ivvsHXlMBMXJFBiSMCAoQQ1vyou6yRHswRr # gLHDwiWUx8SX8ckbbJ/+Zo9+T8JBMvC5hNYG8VoAtlTQusG4bHSbKdPNNH0eHsEp # f7RlZPRizkcK3w0Nj+u4kXdnnex3QLLSgnyAYq7zEl6V+mho8KqaBezkO7wQDHZy # +GW5ignQ1Gs= # =CyiZ # -----END PGP SIGNATURE----- # gpg: Signature made Fri 07 Mar 2025 19:51:55 HKT # gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5 # gpg: issuer "thuth@redhat.com" # gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full] # gpg: aka "Thomas Huth <thuth@redhat.com>" [full] # gpg: aka "Thomas Huth <huth@tuxfamily.org>" [full] # gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown] # Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5 * tag 'pull-request-2025-03-07' of https://gitlab.com/thuth/qemu: s390x/pci: indicate QEMU supports relaxed translation for passthrough s390x/pci: add support for guests that request direct mapping MAINTAINERS: Add docs/devel/testing/functional.rst to the functional section doc: add missing 'Asset' type in function test doc tests/functional/test_virtio_balloon: Only use KVM for running this test tests/functional: fix race in virtio balloon test tests/functional: Increase the timeout of the mips64el_replay test tests/functional/test_mips_malta: Add a network test via the pcnet NIC tests/functional: Move the code for testing HTTP downloads to a common function tests/functional: stop output from zstd command when uncompressing tests/functional: drop unused 'get_tag' method tests/functional: skip memaddr tests on 32-bit builds tests/functional: reduce tuxrun maxmem to work on 32-bit hosts tests/functional: set 'qemu_bin' as an object level field tests/functional: remove unused 'bin_prefix' variable Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * | s390x/pci: indicate QEMU supports relaxed translation for passthroughMatthew Rosato2025-03-072-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifying this bit in the guest CLP response indicates that the guest can optionally choose to skip translation and instead use identity-mapped operations. Tested-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Message-ID: <20250226210013.238349-3-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | s390x/pci: add support for guests that request direct mappingMatthew Rosato2025-03-075-8/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When receiving a guest mpcifc(4) or mpcifc(6) instruction without the T bit set, treat this as a request to perform direct mapping instead of address translation. In order to facilitate this, pin the entirety of guest memory into the host iommu. Pinning for the direct mapping case is handled via vfio and its memory listener. Additionally, ram discard settings are inherited from vfio: coordinated discards (e.g. virtio-mem) are allowed while uncoordinated discards (e.g. virtio-balloon) are disabled. Subsequent guest DMA operations are all expected to be of the format guest_phys+sdma, allowing them to be used as lookup into the host iommu table. Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com> Reviewed-by: David Hildenbrand <david@redhat.com> Message-ID: <20250226210013.238349-2-mjrosato@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | MAINTAINERS: Add docs/devel/testing/functional.rst to the functional sectionThomas Huth2025-03-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add an entry for docs/devel/testing/functional.rst to get notified on patches that change this file. Message-ID: <20250306105124.702131-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | doc: add missing 'Asset' type in function test docAditya Gupta2025-03-071-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Seems 'Asset' got missed in the documentation by mistake. Also fix the one spellcheck issue pointed by spellcheck Signed-off-by: Aditya Gupta <adityag@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20250306060706.1982992-1-adityag@linux.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/functional/test_virtio_balloon: Only use KVM for running this testThomas Huth2025-03-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The virtio_balloon test is currently hanging for unknown reasons when being run on the shared gitlab CI runners (which don't provide KVM, thus it's running in TCG mode there). All other functional tests that use the same asset (the Fedora 31 kernel) have already been marked to work only with KVM in the past, so those other tests are skipped on the shared gitlab CI runners. As long as the problem isn't fully understood and fixed, let's do the same with the virtio_balloon test to avoid that the CI is failing here. Message-ID: <20250307063904.1081961-1-thuth@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/functional: fix race in virtio balloon testDaniel P. Berrangé2025-03-071-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two race conditions in the recently added virtio balloon test * The /dev/vda device node is not ready * The virtio-balloon driver has not issued the first stats refresh To fix the former, monitor dmesg for a line about 'vda'. To fix the latter, retry the stats query until seeing fresh data. Adding 'quiet' to the kernel command line reduces serial output which otherwise slows boot, making it less likely to hit the former race too. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20250304183340.3749797-1-berrange@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> [thuth: Break long line to avoid checkpatch error] Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/functional: Increase the timeout of the mips64el_replay testThomas Huth2025-03-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We run the gitlab-CI with the untrusted tests enabled, and the test_replay_mips64el_malta_5KEc_cpio subtest is rather slow, so this already hit the standard 90 seconds timeout in the CI. Increase the timeout for more headroom. Reported-by: Stefan Hajnoczi <stefanha@redhat.com> Message-ID: <20250305074353.52552-1-thuth@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/functional/test_mips_malta: Add a network test via the pcnet NICThomas Huth2025-03-071-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | The kernel has a driver for the pcnet NIC included, and the initrd has a "tftp" command, so we can test a simple network transfer here, too. Message-ID: <20250227103915.19795-3-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
| * | tests/functional: Move the code for testing HTTP downloads to a common functionThomas Huth2025-03-072-22/+26
| | | | | | | | | | | | | | | | | | | | | | | | We are going to use this code in other tests, too, so let's move it to the qemu_test module to be able to re-use it more easily. Message-ID: <20250227103915.19795-2-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>