summary refs log tree commit diff stats
path: root/target/arm (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Kconfig: kvm: allow building without any boardPaolo Bonzini2024-05-031-0/+2
| | | | | | | | | | | | | | | KVM code might have to call functions on the PCIDevice that is passed to kvm_arch_fixup_msi_route(). This fails in the case where --without-default-devices is used and no board is configured. While this is not really a useful configuration, and therefore setting up stubs for CONFIG_PCI is overkill, failing the build is impolite. Just include the PCI subsystem if kvm_arch_fixup_msi_route() requires it, as is the case for ARM and x86. Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/arm: Default to 1GHz cntfrq for 'max' and new CPUsPeter Maydell2024-04-306-8/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In previous versions of the Arm architecture, the frequency of the generic timers as reported in CNTFRQ_EL0 could be any IMPDEF value, and for QEMU we picked 62.5MHz, giving a timer tick period of 16ns. In Armv8.6, the architecture standardized this frequency to 1GHz. Because there is no ID register feature field that indicates whether a CPU is v8.6 or that it ought to have this counter frequency, we implement this by changing our default CNTFRQ value for all CPUs, with exceptions for backwards compatibility: * CPU types which we already implement will retain the old default value. None of these are v8.6 CPUs, so this is architecturally OK. * CPUs used in versioned machine types with a version of 9.0 or earlier will retain the old default value. The upshot is that the only CPU type that changes is 'max'; but any new type we add in future (whether v8.6 or not) will also get the new 1GHz default. It remains the case that the machine model can override the default value via the 'cntfrq' QOM property (regardless of the CPU type). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240426122913.3427983-5-peter.maydell@linaro.org
* target/arm: Refactor default generic timer frequency handlingPeter Maydell2024-04-303-25/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The generic timer frequency is settable by board code via a QOM property "cntfrq", but otherwise defaults to 62.5MHz. The way this is done includes some complication resulting from how this was originally a fixed value with no QOM property. Clean it up: * always set cpu->gt_cntfrq_hz to some sensible value, whether the CPU has the generic timer or not, and whether it's system or user-only emulation * this means we can always use gt_cntfrq_hz, and never need the old GTIMER_SCALE define * set the default value in exactly one place, in the realize fn The aim here is to pave the way for handling the ARMv8.6 requirement that the generic timer frequency is always 1GHz. We're going to do that by having old CPU types keep their legacy-in-QEMU behaviour and having the default for any new CPU types be a 1GHz rather han 62.5MHz cntfrq, so we want the point where the default is decided to be in one place, and in code, not in a DEFINE_PROP_UINT64() initializer. This commit should have no behavioural changes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240426122913.3427983-2-peter.maydell@linaro.org
* target/arm: Enable FEAT_Spec_FPACC for -cpu maxPeter Maydell2024-04-301-0/+4
| | | | | | | | | | | | | | | | | | FEAT_Spec_FPACC is a feature describing speculative behaviour in the event of a PAC authontication failure when FEAT_FPACCOMBINE is implemented. FEAT_Spec_FPACC means that the speculative use of pointers processed by a PAC Authentication is not materially different in terms of the impact on cached microarchitectural state (caches, TLBs, etc) between passing and failing of the PAC Authentication. QEMU doesn't do speculative execution, so we can advertise this feature. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240418152004.2106516-6-peter.maydell@linaro.org
* target/arm: Implement ID_AA64MMFR3_EL1Peter Maydell2024-04-304-2/+25
| | | | | | | | | | | | Newer versions of the Arm ARM (e.g. rev K.a) now define fields for ID_AA64MMFR3_EL1. Implement this register, so that we can set the fields if we need to. There's no behaviour change here since we don't currently set the register value to non-zero. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240418152004.2106516-5-peter.maydell@linaro.org
* target/arm: Enable FEAT_ETS2 for -cpu maxPeter Maydell2024-04-302-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FEAT_ETS2 is a tighter set of guarantees about memory ordering involving translation table walks than the old FEAT_ETS; FEAT_ETS has been retired from the Arm ARM and the old ID_AA64MMFR1.ETS == 1 now gives no greater guarantees than ETS == 0. FEAT_ETS2 requires: * the virtual address of a load or store that appears in program order after a DSB cannot be translated until after the DSB completes (section B2.10.9) * TLB maintenance operations that only affect translations without execute permission are guaranteed complete after a DSB (R_BLDZX) * if a memory access RW2 is ordered-before memory access RW2, then RW1 is also ordered-before any translation table walk generated by RW2 that generates a Translation, Address size or Access flag fault (R_NNFPF, I_CLGHP) As with FEAT_ETS, QEMU is already compliant, because we do not reorder translation table walk memory accesses relative to other memory accesses, and we always guarantee to have finished TLB maintenance as soon as the TLB op is done. Update the documentation to list FEAT_ETS2 instead of the no-longer-existent FEAT_ETS, and update the 'max' CPU ID registers. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240418152004.2106516-4-peter.maydell@linaro.org
* target/arm: Enable FEAT_CSV2_3 for -cpu maxPeter Maydell2024-04-301-2/+2
| | | | | | | | | | | | | | | | FEAT_CSV2_3 adds a mechanism to identify if hardware cannot disclose information about whether branch targets and branch history trained in one hardware described context can control speculative execution in a different hardware context. There is no branch prediction in TCG, so we don't need to do anything to be compliant with this. Upadte the '-cpu max' ID registers to advertise the feature. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240418152004.2106516-3-peter.maydell@linaro.org
* target/arm: Restrict translation disabled alignment check to VMSARichard Henderson2024-04-301-2/+10
| | | | | | | | | | | | | | | | For cpus using PMSA, when the MPU is disabled, the default memory type is Normal, Non-cachable. This means that it should not have alignment restrictions enforced. Cc: qemu-stable@nongnu.org Fixes: 59754f85ed3 ("target/arm: Do memory type alignment check when translation disabled") Reported-by: Clément Chigot <chigot@adacore.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Clément Chigot <chigot@adacore.com> Message-id: 20240422170722.117409-1-richard.henderson@linaro.org [PMM: trivial comment, commit message tweaks] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hvf: arm: Remove PL1_WRITE_MASKZenghui Yu2024-04-301-1/+0
| | | | | | | | | | As it had never been used since the first commit a1477da3ddeb ("hvf: Add Apple Silicon support"). Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20240422092715.71973-1-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* exec: Declare CPUBreakpoint/CPUWatchpoint type in 'breakpoint.h' headerPhilippe Mathieu-Daudé2024-04-261-0/+1
| | | | | | | | | | | | | The CPUBreakpoint and CPUWatchpoint structures are declared in "hw/core/cpu.h", which contains declarations related to CPUState and CPUClass. Some source files only require the BP/WP definitions and don't need to pull in all CPU* API. In order to simplify, create a new "exec/breakpoint.h" header. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Anton Johansson <anjo@rev.ng> Message-Id: <20240418192525.97451-3-philmd@linaro.org>
* accel/hvf: Use accel-specific per-vcpu @dirty fieldPhilippe Mathieu-Daudé2024-04-261-2/+2
| | | | | | | | | | | HVF has a specific use of the CPUState::vcpu_dirty field (CPUState::vcpu_dirty is not used by common code). To make this field accel-specific, add and use a new @dirty variable in the AccelCPUState structure. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240424174506.326-4-philmd@linaro.org>
* target: Define TCG_GUEST_DEFAULT_MO in 'cpu-param.h'Philippe Mathieu-Daudé2024-04-262-5/+4
| | | | | | | | | | | | | | | | | | | accel/tcg/ files requires the following definitions: - TARGET_LONG_BITS - TARGET_PAGE_BITS - TARGET_PHYS_ADDR_SPACE_BITS - TCG_GUEST_DEFAULT_MO The first 3 are defined in "cpu-param.h". The last one in "cpu.h", with a bunch of definitions irrelevant for TCG. By moving the TCG_GUEST_DEFAULT_MO definition to "cpu-param.h", we can simplify various accel/tcg includes. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Nicholas Piggin <npiggin@gmail.com> Message-Id: <20231211212003.21686-4-philmd@linaro.org>
* exec: Rename NEED_CPU_H -> COMPILING_PER_TARGETPhilippe Mathieu-Daudé2024-04-261-2/+2
| | | | | | | | | | | | | | | | | | 'NEED_CPU_H' guard target-specific code; it is defined by meson altogether with the 'CONFIG_TARGET' definition. Rename NEED_CPU_H as COMPILING_PER_TARGET to clarify its meaning. Mechanical change running: $ sed -i s/NEED_CPU_H/COMPILING_PER_TARGET/g $(git grep -l NEED_CPU_H) then manually add a /* COMPILING_PER_TARGET */ comment after the '#endif' when the block is large. Inspired-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240322161439.6448-4-philmd@linaro.org>
* hw, target: Add ResetType argument to hold and exit phase methodsPeter Maydell2024-04-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | We pass a ResetType argument to the Resettable class enter phase method, but we don't pass it to hold and exit, even though the callsites have it readily available. This means that if a device cared about the ResetType it would need to record it in the enter phase method to use later on. Pass the type to all three of the phase methods to avoid having to do that. Commit created with for dir in hw target include; do \ spatch --macro-file scripts/cocci-macro-file.h \ --sp-file scripts/coccinelle/reset-type.cocci \ --keep-comments --smpl-spacing --in-place \ --include-headers --dir $dir; done and no manual edits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Luc Michel <luc.michel@amd.com> Message-id: 20240412160809.1260625-5-peter.maydell@linaro.org
* target/arm: Add FEAT_NMI to maxJinjie Ruan2024-04-251-0/+1
| | | | | | | | | | Enable FEAT_NMI on the 'max' CPU. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-24-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle NMI in arm_cpu_do_interrupt_aarch64()Jinjie Ruan2024-04-251-0/+3
| | | | | | | | | | | | | | According to Arm GIC section 4.6.3 Interrupt superpriority, the interrupt with superpriority is always IRQ, never FIQ, so the NMI exception trap entry behave like IRQ. And VINMI(vIRQ with Superpriority) can be raised from the GIC or come from the hcrx_el2.HCRX_VINMI bit, VFNMI(vFIQ with Superpriority) come from the hcrx_el2.HCRX_VFNMI bit. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-13-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle PSTATE.ALLINT on taking an exceptionJinjie Ruan2024-04-251-0/+8
| | | | | | | | | | | Set or clear PSTATE.ALLINT on taking an exception to ELx according to the SCTLR_ELx.SPINTMASK bit. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-10-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle IS/FS in ISR_EL1 for NMI, VINMI and VFNMIJinjie Ruan2024-04-252-0/+15
| | | | | | | | | | | | Add IS and FS bit in ISR_EL1 and handle the read. With CPU_INTERRUPT_NMI or CPU_INTERRUPT_VINMI, both CPSR_I and ISR_IS must be set. With CPU_INTERRUPT_VFNMI, both CPSR_F and ISR_FS must be set. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-9-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for NMI in arm_phys_excp_target_el()Jinjie Ruan2024-04-251-0/+1
| | | | | | | | | | | | According to Arm GIC section 4.6.3 Interrupt superpriority, the interrupt with superpriority is always IRQ, never FIQ, so handle NMI same as IRQ in arm_phys_excp_target_el(). Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-8-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for Non-maskable InterruptJinjie Ruan2024-04-255-16/+193
| | | | | | | | | | This only implements the external delivery method via the GICv3. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-7-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Support MSR access to ALLINTJinjie Ruan2024-04-251-0/+35
| | | | | | | | | | | | Support ALLINT msr access as follow: mrs <xt>, ALLINT // read allint msr ALLINT, <xt> // write allint with imm Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-6-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Implement ALLINT MSR (immediate)Jinjie Ruan2024-04-254-0/+33
| | | | | | | | | | | | | Add ALLINT MSR (immediate) to decodetree, in which the CRm is 0b000x. The EL0 check is necessary to ALLINT, and the EL1 check is necessary when imm == 1. So implement it inline for EL2/3, or EL1 with imm==0. Avoid the unconditional write to pc and use raise_exception_ra to unwind. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-5-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add support for FEAT_NMI, Non-maskable InterruptJinjie Ruan2024-04-251-0/+3
| | | | | | | | | | | Add support for FEAT_NMI. NMI (FEAT_NMI) is an mandatory feature in ARMv8.8-A and ARM v9.3-A. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-4-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Add PSTATE.ALLINTJinjie Ruan2024-04-252-2/+3
| | | | | | | | | | | | | | | | | | | When PSTATE.ALLINT is set, an IRQ or FIQ interrupt that is targeted to ELx, with or without superpriority is masked. As Richard suggested, place ALLINT bit in PSTATE in env->pstate. In the pseudocode, AArch64.ExceptionReturn() calls SetPSTATEFromPSR(), which treats PSTATE.ALLINT as one of the bits which are reinstated from SPSR to PSTATE regardless of whether this is an illegal exception return or not. So handle PSTATE.ALLINT the same way as PSTATE.DAIF in the illegal_return exit path of the exception_return helper. With the change, exception entry and return are automatically handled. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-3-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Handle HCR_EL2 accesses for bits introduced with FEAT_NMIJinjie Ruan2024-04-252-1/+12
| | | | | | | | | | | | FEAT_NMI defines another three new bits in HCRX_EL2: TALLINT, HCRX_VINMI and HCRX_VFNMI. When the feature is enabled, allow these bits to be written in HCRX_EL2. Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20240407081733.3231820-2-ruanjinjie@huawei.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* KVM: remove kvm_arch_cpu_check_are_resettablePaolo Bonzini2024-04-231-5/+0
| | | | | | | | | | Board reset requires writing a fresh CPU state. As far as KVM is concerned, the only thing that blocks reset is that CPU state is encrypted; therefore, kvm_cpus_are_resettable() can simply check if that is the case. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* target/arm: Use insn_start from DisasContextBaseRichard Henderson2024-04-093-8/+8
| | | | | | | | To keep the multiple update check, replace insn_start with insn_start_updated. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
* target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3Peter Maydell2024-04-081-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we do an AT address translation operation, the page table walk is supposed to be performed in the context of the EL we're doing the walk for, so for instance an AT S1E2R walk is done for EL2. In the pseudocode an EL is passed to AArch64.AT(), which calls SecurityStateAtEL() to find the security state that we should be doing the walk with. In ats_write64() we get this wrong, instead using the current security space always. This is fine for AT operations performed from EL1 and EL2, because there the current security state and the security state for the lower EL are the same. But for AT operations performed from EL3, the current security state is always either Secure or Root, whereas we want to use the security state defined by SCR_EL3.{NS,NSE} for the walk. This affects not just guests using FEAT_RME but also ones where EL3 is Secure state and the EL3 code is trying to do an AT for a NonSecure EL2 or EL1. Use arm_security_space_below_el3() to get the SecuritySpace to pass to do_ats_write() for all AT operations except the AT S1E3* operations. Cc: qemu-stable@nongnu.org Fixes: e1ee56ec2383 ("target/arm: Pass security space rather than flag for AT instructions") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2250 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240405180232.3570066-1-peter.maydell@linaro.org
* target/arm: Fix CNTPOFF_EL2 trap to missing EL3Pierre-Clément Tosi2024-04-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | EL2 accesses to CNTPOFF_EL2 should only ever trap to EL3 if EL3 is present, as described by the reference manual (for MRS): /* ... */ elsif PSTATE.EL == EL2 then if Halted() && HaveEL(EL3) && /*...*/ then UNDEFINED; elsif HaveEL(EL3) && SCR_EL3.ECVEn == '0' then /* ... */ else X[t, 64] = CNTPOFF_EL2; However, the existing implementation of gt_cntpoff_access() always returns CP_ACCESS_TRAP_EL3 for EL2 accesses with SCR_EL3.ECVEn unset. In pseudo-code terminology, this corresponds to assuming that HaveEL(EL3) is always true, which is wrong. As a result, QEMU panics in access_check_cp_reg() when started without EL3 and running EL2 code accessing the register (e.g. any recent KVM booting a guest). Therefore, add the HaveEL(EL3) check to gt_cntpoff_access(). Fixes: 2808d3b38a52 ("target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling") Signed-off-by: Pierre-Clément Tosi <ptosi@google.com> Message-id: m3al6amhdkmsiy2f62w72ufth6dzn45xg5cz6xljceyibphnf4@ezmmpwk4tnhl Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* accel/hvf: Un-inline hvf_arch_supports_guest_debug()Philippe Mathieu-Daudé2024-04-021-1/+1
| | | | | | | | | | See previous commit and commit 9de9fa5cf2 ("Avoid using inlined functions with external linkage") for rationale. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20240313184954.42513-3-philmd@linaro.org>
* target/arm: take HSTR traps of cp15 accesses to EL2, not EL1Peter Maydell2024-04-021-1/+1
| | | | | | | | | | | | | | | | | The HSTR_EL2 register allows the hypervisor to trap AArch32 EL1 and EL0 accesses to cp15 registers. We incorrectly implemented this so they trap to EL1 when we detect the need for a HSTR trap at code generation time. (The check in access_check_cp_reg() which we do at runtime to catch traps from EL0 is correctly routing them to EL2.) Use the correct target EL when generating the code to take the trap. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2226 Fixes: 049edada5e93df ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240325133116.2075362-1-peter.maydell@linaro.org
* Merge tag 'pull-error-2024-03-12' of https://repo.or.cz/qemu/armbru into stagingPeter Maydell2024-03-121-12/+4
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Error reporting patches for 2024-03-12 # -----BEGIN PGP SIGNATURE----- # # iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmXwWOYSHGFybWJydUBy # ZWRoYXQuY29tAAoJEDhwtADrkYZT+voP/jAEyPfbtwggKLHjSCkHchn/uUziLJ2o # //i7+ZV9soCizAEkW+AkIR17PsMCaRsa8W4AULLn+ZaDJNy1Vlj2WYIkgeFm/rba # AWfNXywIg7dLnj0Hd98nz13hPuP52hO9vpakPhcua9L6mmk1htdqbbGIFIIfbQhp # e6FM+sBEW44uGcZx+N0wMEpKF0F7RId/jzH4mfP35WE7CLaAr2EfTXFaadAM636e # QsrM8wuiNAPQeyXz14gxYTWAnnMGglM5WQ4hoxSGN0y8c007gvff5vMKc7vapn4/ # DdiYJqpq/DIWaiGL0Fl8Cpry3WrQ8UY0st745kCLF/f9nlL0GvnBGdLdUaap7lQZ # A/C1sDKNubAGwzcw643AhV73QHc9f5kDBdWIj5wj3k5DQmBmgKACzGs1edDVVB+2 # OaStqZZ/V9Q5gljjh6PiHEptTjPhsaftX7GGjbhXTJUDFB9GONSCEVwAdZZxJ0Pm # 6cQLtcIMtcjL4xXNz6niVZkxGT/zu4kqbZ01LudIqEQAnULwRiVpyjkCmReSAOPP # eBtkCQtn7WPlz4N3ZiV2+a1p4/e88KH9wvxF+XvPEJjgsdeUmxX44f82ouLPJzvE # fOXE11tRr41u9m+UmoinVo581CKYGlkRJlNQWQwFOmnXoKP2nPZzADxraihkCR5p # wT0Hz9uwJs94 # =6FSf # -----END PGP SIGNATURE----- # gpg: Signature made Tue 12 Mar 2024 13:30:14 GMT # gpg: using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653 # gpg: issuer "armbru@redhat.com" # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full] # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" [full] # Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867 4E5F 3870 B400 EB91 8653 * tag 'pull-error-2024-03-12' of https://repo.or.cz/qemu/armbru: target/loongarch: Fix query-cpu-model-expansion to reject props target: Improve error reporting for CpuModelInfo member @props target/i386: Fix query-cpu-model-expansion to reject props target: Simplify type checks for CpuModelInfo member @props Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| * target: Improve error reporting for CpuModelInfo member @propsMarkus Armbruster2024-03-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | query-cpu-model-comparison, query-cpu-model-baseline, and query-cpu-model-expansion take CpuModelInfo arguments. Errors in @props members of these arguments are reported for 'props', without further context. For instance, s390x rejects {"execute": "query-cpu-model-comparison", "arguments": {"modela": {"name": "z13", "props": {}}, "modelb": {"name": "z14", "props": []}}} with {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'props', expected: object"}} This is unusual; the common QAPI unmarshaling machinery would complain about 'modelb.props'. Our hand-written code to visit the @props member neglects to provide the context. Tweak it so it provides it. The command above now fails with {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'modelb.props', expected: dict"}} Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240305145919.2186971-4-armbru@redhat.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
| * target: Simplify type checks for CpuModelInfo member @propsMarkus Armbruster2024-03-121-12/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CpuModelInfo member @props is semantically a mapping from name to value, and syntactically a JSON object on the wire. This translates to QDict in C. Since the QAPI schema language lacks the means to express 'object', we use 'any' instead. This is QObject in C. Commands taking a CpuModelInfo argument need to check the QObject is a QDict. For arm, riscv, and s390x, the code checks right before passing the QObject to visit_start_struct(). visit_start_struct() then checks again. Delete the first check. The error message for @props that are not an object changes slightly to the the message we get for this kind of type error in other contexts. Minor improvement. Additionally, error messages about members of @props now refer to 'props.prop-name' instead of just 'prop-name'. Another minor improvement. Both changes are visible in tests/qtest/arm-cpu-features.c. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-ID: <20240305145919.2186971-2-armbru@redhat.com> Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com> [Drop #include now superfluous]
* | target: Replace CPU_GET_CLASS(cpu -> obj) in cpu_reset_hold() handlerPhilippe Mathieu-Daudé2024-03-121-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since CPU() macro is a simple cast, the following are equivalent: Object *obj; CPUState *cs = CPU(obj) In order to ease static analysis when running scripts/coccinelle/cpu_env.cocci from the previous commit, replace: - CPU_GET_CLASS(cpu); + CPU_GET_CLASS(obj); Most code use the 'cs' variable name for CPUState handle. Replace few 's' -> 'cs' to unify cpu_reset_hold() style. No logical change in this patch. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Acked-by: Richard Henderson <richard.henderson@linaro.org> Message-ID: <20240129164514.73104-7-philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
* | bulk: Access existing variables initialized to &S->F when availablePhilippe Mathieu-Daudé2024-03-123-6/+6
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a variable is initialized to &struct->field, use it in place. Rationale: while this makes the code more concise, this also helps static analyzers. Mechanical change using the following Coccinelle spatch script: @@ type S, F; identifier s, m, v; @@ S *s; ... F *v = &s->m; <+... - &s->m + v ...+> Inspired-by: Zhao Liu <zhao1.liu@intel.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20240129164514.73104-2-philmd@linaro.org> Acked-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Zhao Liu <zhao1.liu@intel.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com> [thuth: Dropped hunks that need a rebase, and fixed sizeof() in pmu_realize()] Signed-off-by: Thomas Huth <thuth@redhat.com>
* target/arm: Move v7m-related code from cpu32.c into a separate fileThomas Huth2024-03-084-261/+296
| | | | | | | | | | Move the code to a separate file so that we do not have to compile it anymore if CONFIG_ARM_V7M is not set. Signed-off-by: Thomas Huth <thuth@redhat.com> Message-id: 20240308141051.536599-2-thuth@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Fix 32-bit SMOPARichard Henderson2024-03-071-33/+46
| | | | | | | | | | | | | | While the 8-bit input elements are sequential in the input vector, the 32-bit output elements are not sequential in the output matrix. Do not attempt to compute 2 32-bit outputs at the same time. Cc: qemu-stable@nongnu.org Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20240305163931.242795-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Enable FEAT_ECV for 'max' CPUPeter Maydell2024-03-071-0/+1
| | | | | | | | | Enable all FEAT_ECV features on the 'max' CPU. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
* target/arm: Implement FEAT_ECV CNTPOFF_EL2 handlingPeter Maydell2024-03-074-2/+73
| | | | | | | | | | | | | | When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is implemented. This is similar to the existing CNTVOFF_EL2, except that it controls a hypervisor-adjustable offset made to the physical counter and timer. Implement the handling for this register, which includes control/trap bits in SCR_EL3 and CNTHCTL_EL2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
* target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0Peter Maydell2024-03-071-0/+43
| | | | | | | | | | | | | | | | | | | | For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are defined, which are "self-synchronized" views of the physical and virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers (meaning that no barriers are needed around accesses to them to ensure that reads of them do not occur speculatively and out-of-order with other instructions). For QEMU, all our system registers are self-synchronized, so we can simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0 to the new register encodings. This means we now implement all the functionality required for ID_AA64MMFR0_EL1.ECV == 0b0001. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
* target/arm: Implement new FEAT_ECV trap bitsPeter Maydell2024-03-072-5/+51
| | | | | | | | | | | | | | | | | | | | | | | | The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is: * four new trap bits for various counter and timer registers * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control scaling of the event stream. This is a no-op for us, because we don't implement the event stream (our WFE is a NOP): all we need to do is allow CNTHCTL_EL2.ENVTIS to be read and written. * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and TRFCR_EL2.TS: these are all no-ops for us, because we don't implement FEAT_SPE or FEAT_TRF. * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning that no barriers are needed around their accesses. For us these are just the same as the normal views, because all our sysregs are inherently self-sychronizing. In this commit we implement the trap handling and permit the new CNTHCTL_EL2 bits to be written. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
* target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be writtenPeter Maydell2024-03-071-0/+18
| | | | | | | | | | | | | Don't allow the guest to write CNTHCTL_EL2 bits which don't exist. This is not strictly architecturally required, but it is how we've tended to implement registers more recently. In particular, bits [19:18] are only present with FEAT_RME, and bits [17:12] will only be present with FEAT_ECV. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
* target/arm: use FIELD macro for CNTHCTL bit definitionsPeter Maydell2024-03-072-7/+29
| | | | | | | | | | We prefer the FIELD macro over ad-hoc #defines for register bits; switch CNTHCTL to that style before we add any more bits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
* target/arm: Timer _EL02 registers UNDEF for E2H == 0Peter Maydell2024-03-071-1/+1
| | | | | | | | | | The timer _EL02 registers should UNDEF for invalid accesses from EL2 or EL3 when HCR_EL2.E2H == 0, not take a cp access trap. We were delivering the exception to EL2 with the wrong syndrome. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
* target/arm: Move some register related defines to internals.hPeter Maydell2024-03-072-128/+128
| | | | | | | | | | | | cpu.h has a lot of #defines relating to CPU register fields. Most of these aren't actually used outside target/arm code, so there's no point in cluttering up the cpu.h file with them. Move some easy ones to internals.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
* target/arm: Do memory type alignment check when translation enabledRichard Henderson2024-03-051-0/+39
| | | | | | | | | | | | | If translation is enabled, and the PTE memory type is Device, enable checking alignment via TLB_CHECK_ALIGNMENT. While the check is done later than it should be per the ARM, it's better than not performing the check at all. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301204110.656742-7-richard.henderson@linaro.org [PMM: tweaks to comment text] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Do memory type alignment check when translation disabledRichard Henderson2024-03-051-2/+32
| | | | | | | | | | | | | | If translation is disabled, the default memory type is Device, which requires alignment checking. This is more optimally done early via the MemOp given to the TCG memory operation. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reported-by: Idan Horowitz <idan.horowitz@gmail.com> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301204110.656742-6-richard.henderson@linaro.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1204 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Support 32-byte alignment in pow2_alignRichard Henderson2024-03-051-7/+1
| | | | | | | | | | | Now that we have removed TARGET_PAGE_BITS_MIN-6 from TLB_FLAGS_MASK, we can test for 32-byte alignment. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20240301204110.656742-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* target/arm: Enable TARGET_PAGE_BITS_VARY for AArch64 user-onlyRichard Henderson2024-02-292-23/+34
| | | | | | | | | | Since aarch64 binaries are generally built for multiple page sizes, it is trivial to allow the page size to vary. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Acked-by: Helge Deller <deller@gmx.de> Message-Id: <20240102015808.132373-31-richard.henderson@linaro.org>