summary refs log tree commit diff stats
Commit message (Collapse)AuthorAgeFilesLines
* target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASKJean-Philippe Brucker2023-08-224-14/+68
| | | | | | | | | | | | | | | | When FEAT_RME is implemented, these bits override the value of CNT[VP]_CTL_EL0.IMASK in Realm and Root state. Move the IRQ state update into a new gt_update_irq() function and test those bits every time we recompute the IRQ state. Since we're removing the IRQ state from some trace events, add a new trace event for gt_update_irq(). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230809123706.1842548-7-jean-philippe@linaro.org [PMM: only register change hook if not USER_ONLY and if TCG] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/helper: Check SCR_EL3.{NSE, NS} encoding for AT instructionsJean-Philippe Brucker2023-08-221-11/+27
| | | | | | | | | | | | The AT instruction is UNDEFINED if the {NSE,NS} configuration is invalid. Add a function to check this on all AT instructions that apply to an EL lower than 3. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230809123706.1842548-6-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Pass security space rather than flag for AT instructionsJean-Philippe Brucker2023-08-223-30/+27
| | | | | | | | | | | | | | | | | | | | | At the moment we only handle Secure and Nonsecure security spaces for the AT instructions. Add support for Realm and Root. For AArch64, arm_security_space() gives the desired space. ARM DDI0487J says (R_NYXTL): If EL3 is implemented, then when an address translation instruction that applies to an Exception level lower than EL3 is executed, the Effective value of SCR_EL3.{NSE, NS} determines the target Security state that the instruction applies to. For AArch32, some instructions can access NonSecure space from Secure, so we still need to pass the state explicitly to do_ats_write(). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-5-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Skip granule protection checks for AT instructionsJean-Philippe Brucker2023-08-223-18/+26
| | | | | | | | | | | | | | | | | GPC checks are not performed on the output address for AT instructions, as stated by ARM DDI 0487J in D8.12.2: When populating PAR_EL1 with the result of an address translation instruction, granule protection checks are not performed on the final output address of a successful translation. Rename get_phys_addr_with_secure(), since it's only used to handle AT instructions. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-4-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/helper: Fix tlbmask and tlbbits for TLBI VAE2*Jean-Philippe Brucker2023-08-221-10/+40
| | | | | | | | | | | | | | | | | | | | When HCR_EL2.E2H is enabled, TLB entries are formed using the EL2&0 translation regime, instead of the EL2 translation regime. The TLB VAE2* instructions invalidate the regime that corresponds to the current value of HCR_EL2.E2H. At the moment we only invalidate the EL2 translation regime. This causes problems with RMM, which issues TLBI VAE2IS instructions with HCR_EL2.E2H enabled. Update vae2_tlbmask() to take HCR_EL2.E2H into account. Add vae2_tlbbits() as well, since the top-byte-ignore configuration is different between the EL2&0 and EL2 regime. Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-3-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/ptw: Load stage-2 tables from realm physical spaceJean-Philippe Brucker2023-08-221-8/+18
| | | | | | | | | | In realm state, stage-2 translation tables are fetched from the realm physical address space (R_PGRQD). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230809123706.1842548-2-jean-philippe@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Adjust PAR_EL1.SH for Device and Normal-NC memory typesPeter Maydell2023-08-221-1/+14
| | | | | | | | | | | | | | The PAR_EL1.SH field documents that for the cases of: * Device memory * Normal memory with both Inner and Outer Non-Cacheable the field should be 0b10 rather than whatever was in the translation table descriptor field. (In the pseudocode this is handled by PAREncodeShareability().) Perform this adjustment when assembling a PAR value. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-16-peter.maydell@linaro.org
* target/arm/ptw: Report stage 2 fault level for stage 2 faults on stage 1 ptwPeter Maydell2023-08-221-3/+7
| | | | | | | | | | | When we report faults due to stage 2 faults during a stage 1 page table walk, the 'level' parameter should be the level of the walk in stage 2 that faulted, not the level of the walk in stage 1. Correct the reporting of these faults. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-15-peter.maydell@linaro.org
* target/arm/ptw: Check for block descriptors at invalid levelsPeter Maydell2023-08-221-2/+23
| | | | | | | | | | | | | | | | The architecture doesn't permit block descriptors at any arbitrary level of the page table walk; it depends on the granule size which levels are permitted. We implemented only a partial version of this check which assumes that block descriptors are valid at all levels except level 3, which meant that we wouldn't deliver the Translation fault for all cases of this sort of guest page table error. Implement the logic corresponding to the pseudocode AArch64.DecodeDescriptorType() and AArch64.BlockDescSupported(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-14-peter.maydell@linaro.org
* target/arm/ptw: Set attributes correctly for MMU disabled data accessesPeter Maydell2023-08-221-5/+7
| | | | | | | | | | | | | When the MMU is disabled, data accesses should be Device nGnRnE, Outer Shareable, Untagged. We handle the other cases from AArch64.S1DisabledOutput() correctly but missed this one. Device nGnRnE is memattr == 0, so the only part we were missing was that shareability should be set to 2 for both insn fetches and data accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-13-peter.maydell@linaro.org
* target/arm/ptw: Drop S1Translate::out_securePeter Maydell2023-08-221-5/+2
| | | | | | | | | | | | | We only use S1Translate::out_secure in two places, where we are setting up MemTxAttrs for a page table load. We can use arm_space_is_secure(ptw->out_space) instead, which guarantees that we're setting the MemTxAttrs secure and space fields consistently, and allows us to drop the out_secure field in S1Translate entirely. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-12-peter.maydell@linaro.org
* target/arm/ptw: Remove S1Translate::in_securePeter Maydell2023-08-221-13/+0
| | | | | | | | | We no longer look at the in_secure field of the S1Translate struct anyway, so we can remove it and all the code which sets it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-11-peter.maydell@linaro.org
* target/arm/ptw: Remove last uses of ptw->in_securePeter Maydell2023-08-221-4/+7
| | | | | | | | | Replace the last uses of ptw->in_secure with appropriate checks on ptw->in_space. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-10-peter.maydell@linaro.org
* target/arm/ptw: Only fold in NSTable bit effects in Secure statePeter Maydell2023-08-221-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | When we do a translation in Secure state, the NSTable bits in table descriptors may downgrade us to NonSecure; we update ptw->in_secure and ptw->in_space accordingly. We guard that check correctly with a conditional that means it's only applied for Secure stage 1 translations. However, later on in get_phys_addr_lpae() we fold the effects of the NSTable bits into the final descriptor attributes bits, and there we do it unconditionally regardless of the CPU state. That means that in Realm state (where in_secure is false) we will set bit 5 in attrs, and later use it to decide to output to non-secure space. We don't in fact need to do this folding in at all any more (since commit 2f1ff4e7b9f30c): if an NSTable bit was set then we have already set ptw->in_space to ARMSS_NonSecure, and in that situation we don't look at attrs bit 5. The only thing we still need to deal with is the real NS bit in the final descriptor word, so we can just drop the code that ORed in the NSTable bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-9-peter.maydell@linaro.org
* target/arm: Pass an ARMSecuritySpace to arm_is_el2_enabled_secstate()Peter Maydell2023-08-222-6/+9
| | | | | | | | | Pass an ARMSecuritySpace instead of a bool secure to arm_is_el2_enabled_secstate(). This doesn't change behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-8-peter.maydell@linaro.org
* target/arm/ptw: Pass an ARMSecuritySpace to arm_hcr_el2_eff_secstate()Peter Maydell2023-08-223-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arm_hcr_el2_eff_secstate() takes a bool secure, which it uses to determine whether EL2 is enabled in the current security state. With the advent of FEAT_RME this is no longer sufficient, because EL2 can be enabled for Secure state but not for Root, and both of those will pass 'secure == true' in the callsites in ptw.c. As it happens in all of our callsites in ptw.c we either avoid making the call or else avoid using the returned value if we're doing a translation for Root, so this is not a behaviour change even if the experimental FEAT_RME is enabled. But it is less confusing in the ptw.c code if we avoid the use of a bool secure that duplicates some of the information in the ArmSecuritySpace argument. Make arm_hcr_el2_eff_secstate() take an ARMSecuritySpace argument instead. Because we always want to know the HCR_EL2 for the security state defined by the current effective value of SCR_EL3.{NSE,NS}, it makes no sense to pass ARMSS_Root here, and we assert that callers don't do that. To avoid the assert(), we thus push the call to arm_hcr_el2_eff_secstate() down into the cases in regime_translation_disabled() that need it, rather than calling the function and ignoring the result for the Root space translations. All other calls to this function in ptw.c are already in places where we have confirmed that the mmu_idx is a stage 2 translation or that the regime EL is not 3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-7-peter.maydell@linaro.org
* target/arm/ptw: Pass ARMSecurityState to regime_translation_disabled()Peter Maydell2023-08-221-7/+8
| | | | | | | | | Plumb the ARMSecurityState through to regime_translation_disabled() rather than just a bool is_secure. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-6-peter.maydell@linaro.org
* target/arm/ptw: Pass ptw into get_phys_addr_pmsa*() and get_phys_addr_disabled()Peter Maydell2023-08-221-21/+36
| | | | | | | | | | | | | | | | | | In commit 6d2654ffacea813916176 we created the S1Translate struct and used it to plumb through various arguments that we were previously passing one-at-a-time to get_phys_addr_v5(), get_phys_addr_v6(), and get_phys_addr_lpae(). Extend that pattern to get_phys_addr_pmsav5(), get_phys_addr_pmsav7(), get_phys_addr_pmsav8() and get_phys_addr_disabled(), so that all the get_phys_addr_* functions we call from get_phys_addr_nogpc() take the S1Translate struct rather than the mmu_idx and is_secure bool. (This refactoring is a prelude to having the called functions look at ptw->is_space rather than using an is_secure boolean.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-5-peter.maydell@linaro.org
* target/arm/ptw: Set s1ns bit in fault info more consistentlyPeter Maydell2023-08-221-4/+15
| | | | | | | | | | | | | | | | | | | | The s1ns bit in ARMMMUFaultInfo is documented as "true if we faulted on a non-secure IPA while in secure state". Both the places which look at this bit only do so after having confirmed that this is a stage 2 fault and we're dealing with Secure EL2, which leaves the ptw.c code free to set the bit to any random value in the other cases. Instead of taking advantage of that freedom, consistently make the bit be set to false for the "not a stage 2 fault for Secure EL2" cases. This removes some cases where we were using an 'is_secure' boolean and leaving the reader guessing about whether that was the right thing for Realm and Root cases. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-4-peter.maydell@linaro.org
* target/arm/ptw: Don't report GPC faults on stage 1 ptw as stage2 faultsPeter Maydell2023-08-221-2/+8
| | | | | | | | | | | | | | | | | | | | | In S1_ptw_translate() we set up the ARMMMUFaultInfo if the attempt to translate the page descriptor address into a physical address fails. This used to only be possible if we are doing a stage 2 ptw for that descriptor address, and so the code always sets fi->stage2 and fi->s1ptw to true. However, with FEAT_RME it is also possible for the lookup of the page descriptor address to fail because of a Granule Protection Check fault. These should not be reported as stage 2, otherwise arm_deliver_fault() will incorrectly set HPFAR_EL2. Similarly the s1ptw bit should only be set for stage 2 faults on stage 1 translation table walks, i.e. not for GPC faults. Add a comment to the the other place where we might detect a stage2-fault-on-stage-1-ptw, in arm_casq_ptw(), noting why we know in that case that it must really be a stage 2 fault and not a GPC fault. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-3-peter.maydell@linaro.org
* target/arm/ptw: Don't set fi->s1ptw for UnsuppAtomicUpdate faultPeter Maydell2023-08-221-1/+0
| | | | | | | | | | | | For an Unsupported Atomic Update fault where the stage 1 translation table descriptor update can't be done because it's to an unsupported memory type, this is a stage 1 abort (per the Arm ARM R_VSXXT). This means we should not set fi->s1ptw, because this will cause the code in the get_phys_addr_lpae() error-exit path to mark it as stage 2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-2-peter.maydell@linaro.org
* accel/kvm: Make kvm_dirty_ring_reaper_init() voidAkihiko Odaki2023-08-221-7/+2
| | | | | | | | | | The returned value was always zero and had no meaning. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-7-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* accel/kvm: Free as when an error occurredAkihiko Odaki2023-08-221-0/+1
| | | | | | | | | | | An error may occur after s->as is allocated, for example if the KVM_CREATE_VM ioctl call fails. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-6-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: tweaked commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* accel/kvm: Use negative KVM type for error propagationAkihiko Odaki2023-08-223-2/+7
| | | | | | | | | | | | | | On MIPS, kvm_arch_get_default_type() returns a negative value when an error occurred so handle the case. Also, let other machines return negative values when errors occur and declare returning a negative value as the correct way to propagate an error that happened when determining KVM type. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-5-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* mips: Report an error when KVM_VM_MIPS_VZ is unavailableAkihiko Odaki2023-08-221-0/+1
| | | | | | | | | | | | On MIPS, QEMU requires KVM_VM_MIPS_VZ type for KVM. Report an error in such a case as other architectures do when an error occurred during KVM type decision. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-4-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* accel/kvm: Specify default IPA size for arm64Akihiko Odaki2023-08-221-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before this change, the default KVM type, which is used for non-virt machine models, was 0. The kernel documentation says: > On arm64, the physical address size for a VM (IPA Size limit) is > limited to 40bits by default. The limit can be configured if the host > supports the extension KVM_CAP_ARM_VM_IPA_SIZE. When supported, use > KVM_VM_TYPE_ARM_IPA_SIZE(IPA_Bits) to set the size in the machine type > identifier, where IPA_Bits is the maximum width of any physical > address used by the VM. The IPA_Bits is encoded in bits[7-0] of the > machine type identifier. > > e.g, to configure a guest to use 48bit physical address size:: > > vm_fd = ioctl(dev_fd, KVM_CREATE_VM, KVM_VM_TYPE_ARM_IPA_SIZE(48)); > > The requested size (IPA_Bits) must be: > > == ========================================================= > 0 Implies default size, 40bits (for backward compatibility) > N Implies N bits, where N is a positive integer such that, > 32 <= N <= Host_IPA_Limit > == ========================================================= > Host_IPA_Limit is the maximum possible value for IPA_Bits on the host > and is dependent on the CPU capability and the kernel configuration. > The limit can be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the > KVM_CHECK_EXTENSION ioctl() at run-time. > > Creation of the VM will fail if the requested IPA size (whether it is > implicit or explicit) is unsupported on the host. https://docs.kernel.org/virt/kvm/api.html#kvm-create-vm So if Host_IPA_Limit < 40, specifying 0 as the type will fail. This actually confused libvirt, which uses "none" machine model to probe the KVM availability, on M2 MacBook Air. Fix this by using Host_IPA_Limit as the default type when KVM_CAP_ARM_VM_IPA_SIZE is available. Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-3-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* kvm: Introduce kvm_arch_get_default_type hookAkihiko Odaki2023-08-2210-13/+31
| | | | | | | | | | | | | | | | | | | kvm_arch_get_default_type() returns the default KVM type. This hook is particularly useful to derive a KVM type that is valid for "none" machine model, which is used by libvirt to probe the availability of KVM. For MIPS, the existing mips_kvm_type() is reused. This function ensures the availability of VZ which is mandatory to use KVM on the current QEMU. Cc: qemu-stable@nongnu.org Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-id: 20230727073134.134102-2-akihiko.odaki@daynix.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: added doc comment for new function] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* qtest: microbit-test: add tests for nRF51 DETECTChris Laplante2023-08-221-0/+44
| | | | | | | | | | Exercise the DETECT mechanism of the GPIO peripheral. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-7-chris@laplante.io [PMM: fixed coding style nits] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qtest: irq_intercept_[out/in]: return FAIL if no intercepts are installedChris Laplante2023-08-221-2/+10
| | | | | | | | | This is much better than just silently failing with OK. Signed-off-by: Chris Laplante <chris@laplante.io> Message-id: 20230728160324.1159090-6-chris@laplante.io Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qtest: bail from irq_intercept_in if name is specifiedChris Laplante2023-08-221-0/+8
| | | | | | | | | Named interception of in-GPIOs is not supported yet. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-5-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qtest: implement named interception of out-GPIOChris Laplante2023-08-223-8/+27
| | | | | | | | | | Adds qtest_irq_intercept_out_named method, which utilizes a new optional name parameter to the irq_intercept_out qtest command. Signed-off-by: Chris Laplante <chris@laplante.io> Message-id: 20230728160324.1159090-4-chris@laplante.io Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* qtest: factor out qtest_install_gpio_out_interceptChris Laplante2023-08-221-6/+10
| | | | | | | Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-3-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw/gpio/nrf51: implement DETECT signalChris Laplante2023-08-222-1/+14
| | | | | | | | | | | | | Implement nRF51 DETECT signal in the GPIO peripheral. The reference manual makes mention of a per-pin DETECT signal, but these are not exposed to the user. See https://devzone.nordicsemi.com/f/nordic-q-a/39858/gpio-per-pin-detect-signal-available for more information. Currently, I don't see a reason to model these. Signed-off-by: Chris Laplante <chris@laplante.io> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20230728160324.1159090-2-chris@laplante.io Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* Open 8.2 development treeRichard Henderson2023-08-221-1/+1
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Update version for v8.1.0 releaseRichard Henderson2023-08-221-1/+1
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Update version for v8.1.0-rc4 releaseRichard Henderson2023-08-151-1/+1
| | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Merge tag 'pull-tcg-20230814' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson2023-08-141-0/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tcg/i386: Output %gs prefix in tcg_out_vex_opc # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmTa3j0dHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/8QQf8DhuMzyl5obTahtBa # BaxC6tyuvsGrhgxnAzGLrQ/fexlLcCBXi5j61zPmNPecgMYDYWy+bwGd4XnGy/TM # xJVjb/g5c0xXKhDYRpqbsD8L0iLWl+aWZX4pmbu8/FutWSOq9LTqU/XOHrdUVxH2 # FArIiGKdaAA4nf8MD9N1/2EfXnOhrXmPtc+qAJGQvQ1fvEWT9X7WKCXaUd8x8p9h # gCtm0CEJ11kmOcgH/mdXGL/Uv6U6Tx/8O5NbrKarSbFcxNMT1eTNOY5fceJioa/Q # fEkhNGMYlPXGrKeDFWeIYyf6P+5BwJRCRijKwPU5lPuXUkGKspQt24DOJyld/sWh # jq2lHQ== # =+LFD # -----END PGP SIGNATURE----- # gpg: Signature made Mon 14 Aug 2023 07:09:01 PM PDT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-tcg-20230814' of https://gitlab.com/rth7680/qemu: tcg/i386: Output %gs prefix in tcg_out_vex_opc Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * tcg/i386: Output %gs prefix in tcg_out_vex_opcRichard Henderson2023-08-121-0/+3
|/ | | | | | | | | Missing the segment prefix means that user-only fails to add guest_base for some 128-bit load/store. Fixes: 098d0fc10d2 ("tcg/i386: Support 128-bit load/store") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1763 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* Merge tag 'pull-riscv-to-apply-20230811-3' of ↵Richard Henderson2023-08-112-8/+21
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/alistair23/qemu into staging Sixth RISC-V PR for 8.1 This is a last minute PR for RISC-V. The main goal is to fix https://gitlab.com/qemu-project/qemu/-/issues/1823 which is a regression that means the aclint option cannot be enabled. While we are here we also fixup KVM issue. * KVM: fix mvendorid size * Fixup aclint check # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmTWfK0ACgkQr3yVEwxT # gBNDTw/9EnIjXKBCwSejcL3xYpwTDbUbwou3dkkSjnEkhmxvPPM3H0pWet+xYlPg # Lgt9b9clHZAjqGoHFxEdU8fS0MY4Jq5jDAinsS2TK6czLPBe5EEhyVjoDH5iRhTX # AymK1XgwQ2kAuw2lhcb74GDboajkC7hNhr2Km1hLtpYV7bCW/efAUSO7adG4KBlB # SCu06s9VdFtINW0mVN249JvRVQ1408HCQ5gwA0lLVdXhfHluVidwOjc//ELtdnQn # SeHdX1V+e+3fiYuqmr2UHaJXp9s0ZInOyLIDBPA97SOUdaO/oy+siZYRk25yV99h # Ec7tpNnYJjzppmc++GlzTNpUWVEBM6j+QyD7ioEj4yAGkMEjUlgLcImyGng1TT4i # uvABg91uzJyBoUga3GhZYt/sPW00Jft4VYH3QvGOOwjarIor8K0J7sox8eIOfEs4 # JqCIYX4kas+DwK4+i8WyjMeuihWFJ5ipKR7Gwhbe5uQ5szTXFYIT4TZH/78BWozI # dMu5HOyu5+l9yCy39NP7FjNJ6VQKBYGvlkUr5rLRS0yQWGThaK8wIBMXcuZCW96p # hSy/pratHQYaIRr0ZiqRcNyFNsTMua/C2DMPcjQR1ci8xdj010DoriyS0Vsh88xq # pVgC6gYn59gDUdBx0gB/ZSMu4O+F/+Z5htnucoTxvwpKxUU48Lg= # =x8Fl # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Aug 2023 11:23:41 AM PDT # gpg: using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013 # gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65 9296 AF7C 9513 0C53 8013 * tag 'pull-riscv-to-apply-20230811-3' of https://github.com/alistair23/qemu: hw/riscv/virt.c: change 'aclint' TCG check target/riscv/kvm.c: fix mvendorid size in vcpu_set_machine_ids() Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * hw/riscv/virt.c: change 'aclint' TCG checkDaniel Henrique Barboza2023-08-111-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The 'aclint' property is being conditioned with tcg acceleration in virt_machine_class_init(). But acceleration code starts later than the class init of the board, meaning that tcg_enabled() will be always be false during class_init(), and the option is never being declared even when declaring TCG accel: $ ./build/qemu-system-riscv64 -M virt,accel=tcg,aclint=on qemu-system-riscv64: Property 'virt-machine.aclint' not found Fix it by moving the check from class_init() to machine_init(). Tune the description to mention that the option is TCG only. Cc: Philippe Mathieu-Daudé <philmd@linaro.org> Fixes: c0716c81b ("hw/riscv/virt: Restrict ACLINT to TCG") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1823 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20230811160224.440697-2-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
| * target/riscv/kvm.c: fix mvendorid size in vcpu_set_machine_ids()Daniel Henrique Barboza2023-08-111-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cpu->cfg.mvendorid is a 32 bit field and kvm_set_one_reg() always write a target_ulong val, i.e. a 64 bit field in a 64 bit host. Given that we're passing a pointer to the mvendorid field, the reg is reading 64 bits starting from mvendorid and going 32 bits in the next field, marchid. Here's an example: $ ./qemu-system-riscv64 -machine virt,accel=kvm -m 2G -smp 1 \ -cpu rv64,marchid=0xab,mvendorid=0xcd,mimpid=0xef(...) (inside the guest) # cat /proc/cpuinfo processor : 0 hart : 0 isa : rv64imafdc_zicbom_zicboz_zihintpause_zbb_sstc mmu : sv57 mvendorid : 0xab000000cd marchid : 0xab mimpid : 0xef 'mvendorid' was written as a combination of 0xab (the value from the adjacent field, marchid) and its intended value 0xcd. Fix it by assigning cpu->cfg.mvendorid to a target_ulong var 'reg' and use it as input for kvm_set_one_reg(). Here's the result with this patch applied and using the same QEMU command line: # cat /proc/cpuinfo processor : 0 hart : 0 isa : rv64imafdc_zicbom_zicboz_zihintpause_zbb_sstc mmu : sv57 mvendorid : 0xcd marchid : 0xab mimpid : 0xef This bug affects only the generic (rv64) CPUs when running with KVM in a 64 bit env since the 'host' CPU does not allow the machine IDs to be changed via command line. Fixes: 1fb5a622f7 ("target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs") Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Andrew Jones <ajones@ventanamicro.com> Message-ID: <20230802180058.281385-1-dbarboza@ventanamicro.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
* | Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu ↵Richard Henderson2023-08-112-1/+2
|\ \ | |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | into staging pci: last minute bugfixes two fixes that seem very safe and important enough to sneak in before the release. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> # -----BEGIN PGP SIGNATURE----- # # iQFDBAABCAAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmTWXvIPHG1zdEByZWRo # YXQuY29tAAoJECgfDbjSjVRpe7sH/0KteOBt324LUYZ+4NR6EQE5KDsCANGiySBK # r0B6lhcFHvNd2ej0g2hW7lL6nVVCQBkJLLzfNIR/aHkeCmOttfbhv4eF4S6Ho27d # DpkXCPZRT6F11gY7G1swFapNS/f0P7F5LGRjq4sbuw3FpyHBz0DqCQ0GOab2Qorq # VfuOfA01nYGNzHOKrEL7k9Io55oqPVcAe+5TaipNCQ4nW82i32ItTyFjQFdLIAay # qY4HEwP9vPuVwWNdQjXJNfirLMO5GQfEbyKDAjap2sL25zAV2w+mgn7xg/xkTfM6 # iMX2m14lKRMy2hr8dEVh/XdLf7loAN1jSE8/Wdt+PEaexolqxCM= # =1GLE # -----END PGP SIGNATURE----- # gpg: Signature made Fri 11 Aug 2023 09:16:50 AM PDT # gpg: using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469 # gpg: issuer "mst@redhat.com" # gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [undefined] # gpg: aka "Michael S. Tsirkin <mst@redhat.com>" [undefined] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 0270 606B 6F3C DF3D 0B17 0970 C350 3912 AFBE 8E67 # Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA 8A0D 281F 0DB8 D28D 5469 * tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu: pci: Fix the update of interrupt disable bit in PCI_COMMAND register hw/pci-host: Allow extended config space access for Designware PCIe host Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * pci: Fix the update of interrupt disable bit in PCI_COMMAND registerGuoyi Tu2023-08-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The PCI_COMMAND register is located at offset 4 within the PCI configuration space and occupies 2 bytes. The interrupt disable bit is at the 10th bit, which corresponds to the byte at offset 5 in the PCI configuration space. In our testing environment, the guest driver may directly updates the byte at offset 5 in the PCI configuration space. The backtrace looks like as following: at hw/pci/pci.c:1442 at hw/virtio/virtio-pci.c:605 val=5, len=1) at hw/pci/pci_host.c:81 In this situation, the range_covers_byte function called by the pci_default_write_config function will return false, resulting in the inability to handle the interrupt disable update event. To fix this issue, we can use the ranges_overlap function instead of range_covers_byte to determine whether the interrupt bit has been updated. Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn> Signed-off-by: yuanminghao <yuanmh12@chinatelecom.cn> Message-Id: <ce2d0437-8faa-4d61-b536-4668f645a959@chinatelecom.cn> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Fixes: b6981cb57be5 ("pci: interrupt disable bit support")
| * hw/pci-host: Allow extended config space access for Designware PCIe hostJason Chien2023-08-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In pcie_bus_realize(), a root bus is realized as a PCIe bus and a non-root bus is realized as a PCIe bus if its parent bus is a PCIe bus. However, the child bus "dw-pcie" is realized before the parent bus "pcie" which is the root PCIe bus. Thus, the extended configuration space is not accessible on "dw-pcie". The issue can be resolved by adding the PCI_BUS_EXTENDED_CONFIG_SPACE flag to "pcie" before "dw-pcie" is realized. Signed-off-by: Jason Chien <jason.chien@sifive.com> Message-Id: <20230809102257.25121-1-jason.chien@sifive.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Frank Chang <frank.chang@sifive.com> Signed-off-by: Jason Chien &lt;<a href="mailto:jason.chien@sifive.com" target="_blank">jason.chien@sifive.com</a>&gt;<br>
* | Update version for v8.1.0-rc3 releaseRichard Henderson2023-08-101-1/+1
| | | | | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* | Merge tag 'pull-tcg-20230810' of https://gitlab.com/rth7680/qemu into stagingRichard Henderson2023-08-106-11/+59
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | accel/tcg: Avoid reading too much in load_atom_{2,4} tests/tcg: ensure system-mode gdb tests start stopped gdbstub: more fixes for client Ctrl-C handling # -----BEGIN PGP SIGNATURE----- # # iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmTVJ4EdHHJpY2hhcmQu # aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV+/iAf9EUojONGO1FQCUokR # +8kfHFaGH5R5U4v6Zd6xlwHt94iagW8s+DdpM/YdmgZFxQ5jglCCsLOXQYtJ/HPu # McKRv86Yr264ysrwYzTuyOLIC585UU0KzYbGBQvjCSeQ43Au5bR/3ec35Lwgm7OO # eukLdpmuD4QoSgBmVgkbziKH1zaX8NjgPoWGfFqxfzzWUZBfU4VfyLgGKw2gtqoz # fMTORiqbnzSvQfYINNJ0qBTyXWm0YmydDzaK6zfBrsCzdMk3JYksxgneItvqgRar # A5UAYUPhBPftIyTAnI3PQo+siyuaDhFRU9BwHb25a/pkuOUg8PBFO2HruseLmmdl # bPcnhQ== # =7c0w # -----END PGP SIGNATURE----- # gpg: Signature made Thu 10 Aug 2023 11:08:01 AM PDT # gpg: using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F # gpg: issuer "richard.henderson@linaro.org" # gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate] * tag 'pull-tcg-20230810' of https://gitlab.com/rth7680/qemu: gdbstub: don't complain about preemptive ACK chars gdbstub: more fixes for client Ctrl-C handling tests/tcg: ensure system-mode gdb tests start stopped accel/tcg: Avoid reading too much in load_atom_{2,4} Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | gdbstub: don't complain about preemptive ACK charsAlex Bennée2023-08-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting a remote connection GDB sends an '+': /* Ack any packet which the remote side has already sent. */ remote_serial_write ("+", 1); which gets flagged as a garbage character in the gdbstub state machine. As gdb does send it out lets be permissive about the handling so we can better see real issues. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: gdb-patches@sourceware.org Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230810153640.1879717-9-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | gdbstub: more fixes for client Ctrl-C handlingAlex Bennée2023-08-102-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The original fix caused problems with spurious characters on other system emulation. So: - instead of spamming output make the warning a trace point - ensure we only allow a stop reply if it was 0x3 Suggested-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <456ed3318421dd7946bdfb5ceda7e05332da368c.1690910333.git.quic_mathbern@quicinc.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230810153640.1879717-8-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | tests/tcg: ensure system-mode gdb tests start stoppedAlex Bennée2023-08-101-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without -S we run into potential races with tests starting before the gdbstub attaches. We don't need to worry about user-mode as enabling the gdbstub implies we wait for the initial connection. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230810153640.1879717-7-alex.bennee@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
| * | accel/tcg: Avoid reading too much in load_atom_{2,4}Richard Henderson2023-08-103-3/+47
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | When load_atom_extract_al16_or_al8 is inexpensive, we want to use it early, in order to avoid the overhead of required_atomicity. However, we must not read past the end of the page. If there are more than 8 bytes remaining, then both the "aligned 16" and "aligned 8" paths align down so that the read has at least 16 bytes remaining on the page. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>