summary refs log tree commit diff stats
path: root/target/arm/cpu.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* target/arm: Default to 1GHz cntfrq for 'max' and new CPUsPeter Maydell2024-04-301-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In previous versions of the Arm architecture, the frequency of the generic timers as reported in CNTFRQ_EL0 could be any IMPDEF value, and for QEMU we picked 62.5MHz, giving a timer tick period of 16ns. In Armv8.6, the architecture standardized this frequency to 1GHz. Because there is no ID register feature field that indicates whether a CPU is v8.6 or that it ought to have this counter frequency, we implement this by changing our default CNTFRQ value for all CPUs, with exceptions for backwards compatibility: * CPU types which we already implement will retain the old default value. None of these are v8.6 CPUs, so this is architecturally OK. * CPUs used in versioned machine types with a version of 9.0 or earlier will retain the old default value. The upshot is that the only CPU type that changes is 'max'; but any new type we add in future (whether v8.6 or not) will also get the new 1GHz default. It remains the case that the machine model can override the default value via the 'cntfrq' QOM property (regardless of the CPU type). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240426122913.3427983-5-peter.maydell@linaro.org
* target/arm: Implement ID_AA64MMFR3_EL1Peter Maydell2024-04-301-0/+17
| | | | | | | | | | | | Newer versions of the Arm ARM (e.g. rev K.a) now define fields for ID_AA64MMFR3_EL1. Implement this register, so that we can set the fields if we need to. There's no behaviour change here since we don't currently set the register value to non-zero. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240418152004.2106516-5-peter.maydell@linaro.org
* target: Define TCG_GUEST_DEFAULT_MO in 'cpu-param.h'Philippe Mathieu-Daudé2024-04-261-3/+0
| | | | | | | | | | | | | | | | | | | accel/tcg/ files requires the following definitions: - TARGET_LONG_BITS - TARGET_PAGE_BITS - TARGET_PHYS_ADDR_SPACE_BITS - TCG_GUEST_DEFAULT_MO The first 3 are defined in "cpu-param.h". The last one in "cpu.h", with a bunch of definitions irrelevant for TCG. By moving the TCG_GUEST_DEFAULT_MO definition to "cpu-param.h", we can simplify various accel/tcg includes. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20231211212003.21686-4-philmd@linaro.org>
* target/arm: Handle IS/FS in ISR_EL1 for NMI, VINMI and VFNMIJinjie Ruan2024-04-251-0/+2
| | | | | | | | | | | | Add IS and FS bit in ISR_EL1 and handle the read. With CPU_INTERRUPT_NMI or CPU_INTERRUPT_VINMI, both CPSR_I and ISR_IS must be set. With CPU_INTERRUPT_VFNMI, both CPSR_F and ISR_FS must be set. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-9-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for Non-maskable InterruptJinjie Ruan2024-04-251-0/+6
| | | | | | | | | | This only implements the external delivery method via the GICv3. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-7-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add PSTATE.ALLINTJinjie Ruan2024-04-251-0/+1
| | | | | | | | | | | | | | | | | | | When PSTATE.ALLINT is set, an IRQ or FIQ interrupt that is targeted to ELx, with or without superpriority is masked. As Richard suggested, place ALLINT bit in PSTATE in env->pstate. In the pseudocode, AArch64.ExceptionReturn() calls SetPSTATEFromPSR(), which treats PSTATE.ALLINT as one of the bits which are reinstated from SPSR to PSTATE regardless of whether this is an illegal exception return or not. So handle PSTATE.ALLINT the same way as PSTATE.DAIF in the illegal_return exit path of the exception_return helper. With the change, exception entry and return are automatically handled. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-3-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement FEAT_ECV CNTPOFF_EL2 handlingPeter Maydell2024-03-071-0/+1
| | | | | | | | | | | | | | When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is implemented. This is similar to the existing CNTVOFF_EL2, except that it controls a hypervisor-adjustable offset made to the physical counter and timer. Implement the handling for this register, which includes control/trap bits in SCR_EL3 and CNTHCTL_EL2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
* target/arm: Move some register related defines to internals.hPeter Maydell2024-03-071-128/+0
| | | | | | | | | | | | cpu.h has a lot of #defines relating to CPU register fields. Most of these aren't actually used outside target/arm code, so there's no point in cluttering up the cpu.h file with them. Move some easy ones to internals.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
* hw/core/cpu: Remove gdb_get_dynamic_xml memberAkihiko Odaki2024-02-281-6/+0
| | | | | | | | | | This function is no longer used. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20231213-gdb-v17-9-777047380591@daynix.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240227144335.1196131-14-alex.bennee@linaro.org>
* target/arm: Use GDBFeature for dynamic XMLAkihiko Odaki2024-02-281-11/+10
| | | | | | | | | | | | In preparation for a change to use GDBFeature as a parameter of gdb_register_coprocessor(), convert the internal representation of dynamic feature from plain XML to GDBFeature. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231213-gdb-v17-1-777047380591@daynix.com> Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20240227144335.1196131-6-alex.bennee@linaro.org>
* include/exec: Implement cpu_mmu_index genericallyRichard Henderson2024-02-031-13/+0
| | | | | | | | For user-only mode, use MMU_USER_IDX. For system mode, use CPUClass.mmu_index. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Move GTimer definitions to new 'gtimer.h' headerPhilippe Mathieu-Daudé2024-01-261-7/+1
| | | | | | | | | | | | | Move Arm A-class Generic Timer definitions to the new "target/arm/gtimer.h" header so units in hw/ which don't need access to ARMCPU internals can use them without having to include the huge "cpu.h". Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-20-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Move ARM_CPU_IRQ/FIQ definitions to 'cpu-qom.h' headerPhilippe Mathieu-Daudé2024-01-261-6/+0
| | | | | | | | | | | | | | | | | The ARM_CPU_IRQ/FIQ definitions are used to index the GPIO IRQ created calling qdev_init_gpio_in() in ARMCPU instance_init() handler. To allow non-ARM code to raise interrupt on ARM cores, move they to 'target/arm/cpu-qom.h' which is non-ARM specific and can be included by any hw/ file. File list to include the new header generated using: $ git grep -wEl 'ARM_CPU_(\w*IRQ|FIQ)' Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-18-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Expose M-profile register bank index definitionsPhilippe Mathieu-Daudé2024-01-261-15/+0
| | | | | | | | | | | | | The ARMv7M QDev container accesses the QDev SysTickState by its secure/non-secure bank index. In order to make the "hw/intc/armv7m_nvic.h" header target-agnostic in the next commit, first move the M-profile bank index definitions to "target/arm/cpu-qom.h". Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-16-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Declare ARM_CPU_TYPE_NAME/SUFFIX in 'cpu-qom.h'Philippe Mathieu-Daudé2024-01-261-2/+0
| | | | | | | | | | | Missed in commit 2d56be5a29 ("target: Declare FOO_CPU_TYPE_NAME/SUFFIX in 'cpu-qom.h'"). See it for more details. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-12-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Expose arm_cpu_mp_affinity() in 'multiprocessing.h' headerPhilippe Mathieu-Daudé2024-01-261-5/+1
| | | | | | | | | | | | | | | | Declare arm_cpu_mp_affinity() prototype in the new "target/arm/multiprocessing.h" header so units in hw/arm/ can use it without having to include the huge target-specific "cpu.h". File list to include the new header generated using: $ git grep -lw arm_cpu_mp_affinity Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-11-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Create arm_cpu_mp_affinityRichard Henderson2024-01-261-0/+5
| | | | | | | | | | Wrapper to return the mp affinity bits from the cpu. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-10-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Rename arm_cpu_mp_affinityRichard Henderson2024-01-261-1/+1
| | | | | | | | | | | Rename to arm_build_mp_affinity. This frees up the name for other usage, and emphasizes that the cpu object is not involved. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240118200643.29037-9-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Report VNCR_EL2 based faults correctlyPeter Maydell2024-01-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | If FEAT_NV2 redirects a system register access to a memory offset from VNCR_EL2, that access might fault. In this case we need to report the correct syndrome information: * Data Abort, from same-EL * no ISS information * the VNCR bit (bit 13) is set and the exception must be taken to EL2. Save an appropriate syndrome template when generating code; we can then use that to: * select the right target EL * reconstitute a correct final syndrome for the data abort * report the right syndrome if we take a FEAT_RME granule protection fault on the VNCR-based write Note that because VNCR is bit 13, we must start keeping bit 13 in template syndromes, by adjusting ARM_INSN_START_WORD2_SHIFT. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Implement FEAT_NV2 redirection of sysregs to RAMPeter Maydell2024-01-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | FEAT_NV2 requires that when HCR_EL2.{NV,NV2} == 0b11 then accesses by EL1 to certain system registers are redirected to RAM. The full list of affected registers is in the table in rule R_CSRPQ in the Arm ARM. The registers may be normally accessible at EL1 (like ACTLR_EL1), or normally UNDEF at EL1 (like HCR_EL2). Some registers redirect to RAM only when HCR_EL2.NV1 is 0, and some only when HCR_EL2.NV1 is 1; others trap in both cases. Add the infrastructure for identifying which registers should be redirected and turning them into memory accesses. This code does not set the correct syndrome or arrange for the exception to be taken to the correct target EL if the access via VNCR_EL2 faults; we will do that in the next commit. Subsequent commits will mark up the relevant regdefs to set their nv2_redirect_offset, and if relevant one of the two flags which indicates that the redirect happens only for a particular value of HCR_EL2.NV1. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Handle FEAT_NV2 redirection of SPSR_EL2, ELR_EL2, ESR_EL2, FAR_EL2Peter Maydell2024-01-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Under FEAT_NV2, when HCR_EL2.{NV,NV2} == 0b11 at EL1, accesses to the registers SPSR_EL2, ELR_EL2, ESR_EL2, FAR_EL2 and TFSR_EL2 (which would UNDEF without FEAT_NV or FEAT_NV2) should instead access the equivalent EL1 registers SPSR_EL1, ELR_EL1, ESR_EL1, FAR_EL1 and TFSR_EL1. Because there are only five registers involved and the encoding for the EL1 register is identical to that of the EL2 register except that opc1 is 0, we handle this by finding the EL1 register in the hash table and using it instead. Note that traps that apply to direct accesses to the EL1 register, such as active fine-grained traps or other trap bits, do not trigger when it is accessed via the EL2 encoding in this way. However, some traps that are defined by the EL2 register may apply. We therefore call the EL2 register's accessfn first. The only one of the five which has such traps is TFSR_EL2: make sure its accessfn correctly handles both FEAT_NV (where we trap to EL2 without checking ATA bits) and FEAT_NV2 (where we check ATA bits and then redirect to TFSR_EL1). (We don't need the NV1 tbflag bit until the next patch, but we introduce it here to avoid putting the NV, NV1, NV2 bits in an odd order.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Implement VNCR_EL2 registerPeter Maydell2024-01-091-0/+3
| | | | | | | | | | For FEAT_NV2, a new system register VNCR_EL2 holds the base address of the memory which nested-guest system register accesses are redirected to. Implement this register. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Trap sysreg accesses for FEAT_NVPeter Maydell2024-01-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | For FEAT_NV, accesses to system registers and instructions from EL1 which would normally UNDEF there but which work in EL2 need to instead be trapped to EL2. Detect this both for "we know this will UNDEF at translate time" and "we found this UNDEFs at runtime", and make the affected registers trap to EL2 instead. The Arm ARM defines the set of registers that should trap in terms of their names; for our implementation this would be both awkward and inefficent as a test, so we instead trap based on the opc1 field of the sysreg. The regularity of the architectural choice of encodings for sysregs means that in practice this captures exactly the correct set of registers. Regardless of how we try to define the registers this trapping applies to, there's going to be a certain possibility of breakage if new architectural features introduce new registers that don't follow the current rules (FEAT_MEC is one example already visible in the released sysreg XML, though not yet in the Arm ARM). This approach seems to me to be straightforward and likely to require a minimum of manual overrides. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Allow use of upper 32 bits of TBFLAG_A64Peter Maydell2024-01-091-3/+5
| | | | | | | | | | | | The TBFLAG_A64 TB flag bits go in flags2, which for AArch64 guests we know is 64 bits. However at the moment we use FIELD_EX32() and FIELD_DP32() to read and write these bits, which only works for bits 0 to 31. Since we're about to add a flag that uses bit 32, switch to FIELD_EX64() and FIELD_DP64() so that this will work. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Enable trapping of ERET for FEAT_NVPeter Maydell2024-01-091-1/+1
| | | | | | | | | | | | | | | When FEAT_NV is turned on via the HCR_EL2.NV bit, ERET instructions are trapped, with the same syndrome information as for the existing FEAT_FGT fine-grained trap (in the pseudocode this is handled in AArch64.CheckForEretTrap()). Rename the DisasContext and tbflag bits to reflect that they are no longer exclusively for FGT traps, and set the tbflag bit when FEAT_NV is enabled as well as when the FGT is enabled. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Miguel Luis <miguel.luis@oracle.com>
* target/arm: Use generic cpu_list()Gavin Shan2024-01-051-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No changes of the output from the following command before and after it's applied. [gshan@gshan q]$ ./build/qemu-system-aarch64 -cpu ? Available CPUs: a64fx arm1026 arm1136 arm1136-r2 arm1176 arm11mpcore arm926 arm946 cortex-a15 cortex-a35 cortex-a53 cortex-a55 cortex-a57 cortex-a7 cortex-a710 cortex-a72 cortex-a76 cortex-a8 cortex-a9 cortex-m0 cortex-m3 cortex-m33 cortex-m4 cortex-m55 cortex-m7 cortex-r5 cortex-r52 cortex-r5f max neoverse-n1 neoverse-n2 neoverse-v1 pxa250 pxa255 pxa260 pxa261 pxa262 pxa270-a0 pxa270-a1 pxa270 pxa270-b0 pxa270-b1 pxa270-c0 pxa270-c5 sa1100 sa1110 ti925t Signed-off-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20231114235628.534334-9-gshan@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
* target: Move ArchCPUClass definition to 'cpu.h'Philippe Mathieu-Daudé2023-11-071-0/+25
| | | | | | | | | | | | | The OBJECT_DECLARE_CPU_TYPE() macro forward-declares each ArchCPUClass type. These forward declarations are sufficient for code in hw/ to use the QOM definitions. No need to expose these structure definitions. Keep each local to their target/ by moving them to the corresponding "cpu.h" header. Suggested-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231013140116.255-13-philmd@linaro.org>
* target/arm: Move internal declarations from 'cpu-qom.h' to 'cpu.h'Philippe Mathieu-Daudé2023-11-071-0/+22
| | | | | | | | | | These definitions and declarations are only used by target/arm/, no need to expose them to generic hw/. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231013140116.255-4-philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <c48c9829-3dfa-79cf-3042-454fda0d00dc@linaro.org>
* target: Unify QOM stylePhilippe Mathieu-Daudé2023-11-071-2/+0
| | | | | | | | | | | | | | | | Enforce the style described by commit 067109a11c ("docs/devel: mention the spacing requirement for QOM"): The first declaration of a storage or class structure should always be the parent and leave a visual space between that declaration and the new code. It is also useful to separate backing for properties (options driven by the user) and internal state to make navigation easier. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Message-Id: <20231013140116.255-2-philmd@linaro.org>
* target/arm: Move feature test functions to their own headerPeter Maydell2023-10-271-971/+0
| | | | | | | | | | | | The feature test functions isar_feature_*() now take up nearly a thousand lines in target/arm/cpu.h. This header file is included by a lot of source files, most of which don't need these functions. Move the feature test functions to their own header file. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20231024163510.2972081-2-peter.maydell@linaro.org
* target/arm/arm-powerctl: Correctly init CPUs when powered on to lower ELPeter Maydell2023-10-191-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code for powering on a CPU in arm-powerctl.c has two separate use cases: * emulation of a real hardware power controller * emulation of firmware interfaces (primarily PSCI) with CPU on/off APIs For the first case, we only need to reset the CPU and set its starting PC and X0. For the second case, because we're emulating the firmware we need to ensure that it's in the state that the firmware provides. In particular, when we reset to a lower EL than the highest one we are emulating, we need to put the CPU into a state that permits correct running at that lower EL. We already do a little of this in arm-powerctl.c (for instance we set SCR_HCE to enable the HVC insn) but we don't do enough of it. This means that in the case where we are emulating EL3 but also providing emulated PSCI the guest will crash when a secondary core tries to use a feature that needs an SCR_EL3 bit to be set, such as MTE or PAuth. The hw/arm/boot.c code also has to support this "start guest code in an EL that's lower than the highest emulated EL" case in order to do direct guest kernel booting; it has all the necessary initialization code to set the SCR_EL3 bits. Pull the relevant boot.c code out into a separate function so we can share it between there and arm-powerctl.c. This refactoring has a few code changes that look like they might be behaviour changes but aren't: * if info->secure_boot is false and info->secure_board_setup is true, then the old code would start the first CPU in Hyp mode but without changing SCR.NS and NSACR.{CP11,CP10}. This was wrong behaviour because there's no such thing as Secure Hyp mode. The new code will leave the CPU in SVC. (There is no board which sets secure_boot to false and secure_board_setup to true, so this isn't a behaviour change for any of our boards.) * we don't explicitly clear SCR.NS when arm-powerctl.c does a CPU-on to EL3. This was a no-op because CPU reset will reset to NS == 0. And some real behaviour changes: * we no longer set HCR_EL2.RW when booting into EL2: the guest can and should do that themselves before dropping into their EL1 code. (arm-powerctl and boot did this differently; I opted to use the logic from arm-powerctl, which only sets HCR_EL2.RW when it's directly starting the guest in EL1, because it's more correct, and I don't expect guests to be accidentally depending on our having set the RW bit for them.) * if we are booting a CPU into AArch32 Secure SVC then we won't set SCR.HCE any more. This affects only the vexpress-a15 and raspi2b machine types. Guests booting in this case will either: - be able to set SCR.HCE themselves as part of moving from Secure SVC into NS Hyp mode - will move from Secure SVC to NS SVC, and won't care about behaviour of the HVC insn - will stay in Secure SVC, and won't care about HVC * on an arm-powerctl CPU-on we will now set the SCR bits for pauth/mte/sve/sme/hcx/fgt features The first two of these are very minor and I don't expect guest code to trip over them, so I didn't judge it worth convoluting the code in an attempt to keep exactly the same boot.c behaviour. The third change fixes issue 1899. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1899 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230926155619.4028618-1-peter.maydell@linaro.org
* accel/tcg: Move CPUNegativeOffsetState into CPUStateRichard Henderson2023-10-031-1/+0
| | | | | | | | Retain the separate structure to emphasize its importance. Enforce CPUArchState always follows CPUState without padding. Reviewed-by: Anton Johansson <anjo@rev.ng> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Define new TB flag for ATA0Peter Maydell2023-09-211-0/+1
| | | | | | | | | | | | | | | | Currently the only tag-setting instructions always do so in the context of the current EL, and so we only need one ATA bit in the TB flags. The FEAT_MOPS SETG instructions include ones which set tags for a non-privileged access, so we now also need the equivalent "are tags enabled?" information for EL0. Add the new TB flag, and convert the existing 'bool ata' field in DisasContext to a 'bool ata[2]' that can be indexed by the is_unpriv bit in an instruction, similarly to mte[2]. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230912140434.1333369-9-peter.maydell@linaro.org
* target/arm: Implement FEAT_MOPS enable bitsPeter Maydell2023-09-211-0/+6
| | | | | | | | | | | | | | | | | | | | | | FEAT_MOPS defines a handful of new enable bits: * HCRX_EL2.MSCEn, SCTLR_EL1.MSCEn, SCTLR_EL2.MSCen: define whether the new insns should UNDEF or not * HCRX_EL2.MCE2: defines whether memops exceptions from EL1 should be taken to EL1 or EL2 Since we don't sanitise what bits can be written for the SCTLR registers, we only need to handle the new bits in HCRX_EL2, and define SCTLR_MSCEN for the new SCTLR bit value. The precedence of "HCRX bits acts as 0 if SCR_EL3.HXEn is 0" versus "bit acts as 1 if EL2 disabled" is not clear from the register definition text, but it is clear in the CheckMOPSEnabled() pseudocode(), so we follow that. We'll have to check whether other bits we need to implement in future follow the same logic or not. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230912140434.1333369-3-peter.maydell@linaro.org
* target/arm: Implement FEAT_HBCPeter Maydell2023-09-211-0/+5
| | | | | | | | | | | | | | FEAT_HBC (Hinted conditional branches) provides a new instruction BC.cond, which behaves exactly like the existing B.cond except that it provides a hint to the branch predictor about the likely behaviour of the branch. Since QEMU does not implement branch prediction, we can treat this identically to B.cond. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Update AArch64 ID register field definitionsPeter Maydell2023-09-211-0/+23
| | | | | | | | | Update our AArch64 ID register field definitions from the 2023-06 system register XML release: https://developer.arm.com/documentation/ddi0601/2023-06/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
* Merge tag 'pull-target-arm-20230908' of ↵Stefan Hajnoczi2023-09-111-8/+46
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.linaro.org/people/pmaydell/qemu-arm into staging target-arm queue: * New CPU type: cortex-a710 * Implement new architectural features: - FEAT_PACQARMA3 - FEAT_EPAC - FEAT_Pauth2 - FEAT_FPAC - FEAT_FPACCOMBINE - FEAT_TIDCP1 * Xilinx Versal: Model the CFU/CFI * Implement RMR_ELx registers * Implement handling of HCR_EL2.TIDCP trap bit * arm/kvm: Enable support for KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE * hw/intc/arm_gicv3_its: Avoid maybe-uninitialized error in get_vte() * target/arm: Do not use gen_mte_checkN in trans_STGP * arm64: Restore trapless ptimer access # -----BEGIN PGP SIGNATURE----- # # iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmT7VEkZHHBldGVyLm1h # eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3v7BEACENUKCxsFHRQSLmQkoBCT9 # Lc4SJrGCbVUC6b+4s5ligZSWIoFzp/kY6NPpeRYqFa0DCxozd2T5D81/j7TpSo0C # wUFkZfUq1nGFJ4K5arYcDwhdTtJvvc07YrSbUqufBp6uNGqhR4YmDWPECqBfOlaj # 7bgJM6axsg7FkJJh5zp4cQ4WEfp14MHWRPQWpVTI+9cxNmNymokSVRBhVFkM0Wen # WD4C/nYud8bOxpDfR8GkIqJ+UnUMhUNEhp28QmHdwywgg0zLWOE4ysIxo55cM0+0 # FL3q45PL2e4S24UUx9dkxDBWnKEZ5qpQpPn9F6EhWzfm3n2dqr4uUnfWAEOg6NAi # vnGS9MlL7nZo69OM3h8g7yKDfTKYm2vl9HVZ0ytFA6PLoSnaQyQwli58qnLtiid3 # 17MWPoNQlq6G8tHUTPkrJjdA8XLz0iNPXe5G2kwhuM/S0Lv7ORzDc2pq4qBYLvIw # 9nV0oUWqzyE7zH6bRKxbbPw2sMI7c8qQr9QRyZeLHL7HdcY5ExvX9FH+qii5JDR/ # fZohi1pBoNNwYYTeSRnxgHiQ7OizYq0xQJhrdqcFF9voytZj1yZEZ0mp6Tq0/CIj # YkC/vEyLYBqgrJ2JeUjbV3h1RIzQcVaXxnxwGsyMyceACd6MNMmdbjR7bZk0lNIu # kh+aFEdKajPp56UseJiKBQ== # =5Shq # -----END PGP SIGNATURE----- # gpg: Signature made Fri 08 Sep 2023 13:05:13 EDT # gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE # gpg: issuer "peter.maydell@linaro.org" # gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full] # gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full] # gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full] # gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown] # Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE * tag 'pull-target-arm-20230908' of https://git.linaro.org/people/pmaydell/qemu-arm: (26 commits) arm/kvm: Enable support for KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE target/arm: Enable SCTLR_EL1.TIDCP for user-only target/arm: Implement FEAT_TIDCP1 target/arm: Implement HCR_EL2.TIDCP target/arm: Implement cortex-a710 target/arm: Implement RMR_ELx arm64: Restore trapless ptimer access target/arm: Do not use gen_mte_checkN in trans_STGP hw/arm/versal: Connect the CFRAME_REG and CFRAME_BCAST_REG hw/arm/xlnx-versal: Connect the CFU_APB, CFU_FDRO and CFU_SFR hw/misc: Introduce a model of Xilinx Versal's CFRAME_BCAST_REG hw/misc: Introduce a model of Xilinx Versal's CFRAME_REG hw/misc/xlnx-versal-cfu: Introduce a model of Xilinx Versal's CFU_SFR hw/misc/xlnx-versal-cfu: Introduce a model of Xilinx Versal CFU_FDRO hw/misc: Introduce a model of Xilinx Versal's CFU_APB hw/misc: Introduce the Xilinx CFI interface hw/intc/arm_gicv3_its: Avoid maybe-uninitialized error in get_vte() target/arm: Implement FEAT_FPAC and FEAT_FPACCOMBINE target/arm: Inform helpers whether a PAC instruction is 'combined' target/arm: Implement FEAT_Pauth2 ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| * target/arm: Implement FEAT_TIDCP1Richard Henderson2023-09-081-0/+5
| | | | | | | | | | | | | | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230831232441.66020-5-richard.henderson@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Implement FEAT_PACQARMA3Richard Henderson2023-09-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the QARMA3 cryptographic algorithm for PAC calculation. Implement a cpu feature to select the algorithm and document it. Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230829232335.965414-6-richard.henderson@linaro.org Message-Id: <20230609172324.982888-4-aaron@os.amperecomputing.com> [rth: Merge cpu feature addition from another patch.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Add feature detection for FEAT_Pauth2 and extensionsAaron Lindsay2023-09-081-8/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rename isar_feature_aa64_pauth_arch to isar_feature_aa64_pauth_qarma5 to distinguish the other architectural algorithm qarma3. Add ARMPauthFeature and isar_feature_pauth_feature to cover the other pauth conditions. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230829232335.965414-4-richard.henderson@linaro.org Message-Id: <20230609172324.982888-3-aaron@os.amperecomputing.com> [rth: Add ARMPauthFeature and eliminate most other predicates] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target/arm: Add ID_AA64ISAR2_EL1Aaron Lindsay2023-09-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230829232335.965414-3-richard.henderson@linaro.org [PMM: drop the HVF part of the patch and just comment that we need to do something when the register appears in that API] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* | trivial: Simplify the spots that use TARGET_BIG_ENDIAN as a numeric valueThomas Huth2023-09-081-10/+2
|/ | | | | | | | | | | | | | TARGET_BIG_ENDIAN is *always* defined, either as 0 for little endian targets or as 1 for big endian targets. So we can use this as a value directly in places that need such a 0 or 1 for some reason, instead of taking a detour through an additional local variable or something similar. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* target/arm: Allow cpu to configure GM blocksizeRichard Henderson2023-08-311-0/+2
| | | | | | | | | | | | | Previously we hard-coded the blocksize with GMID_EL1_BS. But the value we choose for -cpu max does not match the value that cortex-a710 uses. Mirror the way we handle dcz_blocksize. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230811214031.171020-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Reduce dcz_blocksize to uint8_tRichard Henderson2023-08-311-1/+2
| | | | | | | | | | This value is only 4 bits wide. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230811214031.171020-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm/helper: Implement CNTHCTL_EL2.CNT[VP]MASKJean-Philippe Brucker2023-08-221-0/+4
| | | | | | | | | | | | | | | | When FEAT_RME is implemented, these bits override the value of CNT[VP]_CTL_EL0.IMASK in Realm and Root state. Move the IRQ state update into a new gt_update_irq() function and test those bits every time we recompute the IRQ state. Since we're removing the IRQ state from some trace events, add a new trace event for gt_update_irq(). Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org> Message-id: 20230809123706.1842548-7-jean-philippe@linaro.org [PMM: only register change hook if not USER_ONLY and if TCG] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Pass an ARMSecuritySpace to arm_is_el2_enabled_secstate()Peter Maydell2023-08-221-5/+8
| | | | | | | | | Pass an ARMSecuritySpace instead of a bool secure to arm_is_el2_enabled_secstate(). This doesn't change behaviour. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-8-peter.maydell@linaro.org
* target/arm/ptw: Pass an ARMSecuritySpace to arm_hcr_el2_eff_secstate()Peter Maydell2023-08-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | arm_hcr_el2_eff_secstate() takes a bool secure, which it uses to determine whether EL2 is enabled in the current security state. With the advent of FEAT_RME this is no longer sufficient, because EL2 can be enabled for Secure state but not for Root, and both of those will pass 'secure == true' in the callsites in ptw.c. As it happens in all of our callsites in ptw.c we either avoid making the call or else avoid using the returned value if we're doing a translation for Root, so this is not a behaviour change even if the experimental FEAT_RME is enabled. But it is less confusing in the ptw.c code if we avoid the use of a bool secure that duplicates some of the information in the ArmSecuritySpace argument. Make arm_hcr_el2_eff_secstate() take an ARMSecuritySpace argument instead. Because we always want to know the HCR_EL2 for the security state defined by the current effective value of SCR_EL3.{NSE,NS}, it makes no sense to pass ARMSS_Root here, and we assert that callers don't do that. To avoid the assert(), we thus push the call to arm_hcr_el2_eff_secstate() down into the cases in regime_translation_disabled() that need it, rather than calling the function and ignoring the result for the Root space translations. All other calls to this function in ptw.c are already in places where we have confirmed that the mmu_idx is a stage 2 translation or that the regime EL is not 3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230807141514.19075-7-peter.maydell@linaro.org
* arm: spelling fixesMichael Tokarev2023-07-251-1/+1
| | | | | Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Restrict KVM-specific fields from ArchCPUPhilippe Mathieu-Daudé2023-06-281-0/+2
| | | | | | | | These fields shouldn't be accessed when KVM is not available. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230405160454.97436-8-philmd@linaro.org>
* target: Widen pc/cs_base in cpu_get_tb_cpu_stateAnton Johansson2023-06-261-2/+2
| | | | | | | Signed-off-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230621135633.1649-4-anjo@rev.ng> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>