Hi; here's a target-arm pullreq to go in before softfreeze.

This is actually pretty much entirely bugfixes (since the

SEL2 timers we implement here are a missing part of a feature

we claim to already implement).

The following changes since commit 98c7362b1efe651327385a25874a73e008c6549e:

Merge tag 'accel-cpus-20250306' of https://github.com/philmd/qemu into staging (2025-03-07 07:39:49 +0800)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250307

for you to fetch changes up to 0ce0739d46983e5e88fa9c149cb305689c9d8c6f:

target/rx: Remove TCG_CALL_NO_WG from helpers which write env (2025-03-07 15:03:20 +0000)

* hw/arm/smmu-common: Remove the repeated ttb field

* hw/gpio: npcm7xx: fixup out-of-bounds access

* tests/functional/test_arm_sx1: Check whether the serial console is working

* target/arm: Fix minor bugs in generic timer register handling

* target/arm: Implement SEL2 physical and virtual timers

* target/arm: Correct STRD, LDRD atomicity and fault behaviour

* target/arm: Make dummy debug registers RAZ, not NOP

* util/qemu-timer.c: Don't warp timer from timerlist_rearm()

* include/exec/memop.h: Expand comment for MO_ATOM_SUBALIGN

* hw/arm/smmu: Introduce smmu_configs_inv_sid_range() helper

* target/rx: Set exception vector base to 0xffffff80

* target/rx: Remove TCG_CALL_NO_WG from helpers which write env

Alex Bennée (4):

target/arm: Implement SEL2 physical and virtual timers

target/arm: Document the architectural names of our GTIMERs

hw/arm: enable secure EL2 timers for virt machine

hw/arm: enable secure EL2 timers for sbsa machine

JianChunfu (2):

hw/arm/smmu-common: Remove the repeated ttb field

hw/arm/smmu: Introduce smmu_configs_inv_sid_range() helper

Keith Packard (2):

target/rx: Set exception vector base to 0xffffff80

target/rx: Remove TCG_CALL_NO_WG from helpers which write env

Patrick Venture (1):

hw/gpio: npcm7xx: fixup out-of-bounds access

Peter Maydell (11):

target/arm: Apply correct timer offset when calculating deadlines

target/arm: Don't apply CNTVOFF_EL2 for EL2_VIRT timer

target/arm: Make CNTPS_* UNDEF from Secure EL1 when Secure EL2 is enabled

target/arm: Always apply CNTVOFF_EL2 for CNTV_TVAL_EL02 accesses

target/arm: Refactor handling of timer offset for direct register accesses

target/arm: Correct LDRD atomicity and fault behaviour

target/arm: Correct STRD atomicity

target/arm: Drop unused address_offset from op_addr_{rr, ri}_post()

target/arm: Make dummy debug registers RAZ, not NOP

util/qemu-timer.c: Don't warp timer from timerlist_rearm()

include/exec/memop.h: Expand comment for MO_ATOM_SUBALIGN

From: Patrick Venture <venture@google.com>

The reg isn't validated to be a possible register before

it's dereferenced for one case. The mmio space registered

for the gpio device is 4KiB but there aren't that many

registers in the struct.

Cc: qemu-stable@nongnu.org

Fixes: 526dbbe0874 ("hw/gpio: Add GPIO model for Nuvoton NPCM7xx")

Signed-off-by: Patrick Venture <venture@google.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20250226024603.493148-1-venture@google.com

hw/gpio/npcm7xx_gpio.c | 3 +--

1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/npcm7xx_gpio.c b/hw/gpio/npcm7xx_gpio.c

--- a/hw/gpio/npcm7xx_gpio.c

+++ b/hw/gpio/npcm7xx_gpio.c

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_gpio_regs_write(void *opaque, hwaddr addr, uint64_t v,

return;

}

- diff = s->regs[reg] ^ value;

-

switch (reg) {

case NPCM7XX_GPIO_TLOCK1:

case NPCM7XX_GPIO_TLOCK2:

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_gpio_regs_write(void *opaque, hwaddr addr, uint64_t v,

case NPCM7XX_GPIO_PU:

case NPCM7XX_GPIO_PD:

case NPCM7XX_GPIO_IEM:

+ diff = s->regs[reg] ^ value;

s->regs[reg] = value;

npcm7xx_gpio_update_pins(s, diff);

2.43.0

From: Thomas Huth <thuth@redhat.com>

MAINTAINERS | 1 +

tests/functional/test_arm_sx1.py | 7 ++++---

2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ S: Maintained

F: hw/*/omap*

F: include/hw/arm/omap.h

F: docs/system/arm/sx1.rst

+F: tests/functional/test_arm_sx1.py

IPack

M: Alberto Garcia <berto@igalia.com>

diff --git a/tests/functional/test_arm_sx1.py b/tests/functional/test_arm_sx1.py

index XXXXXXX..XXXXXXX 100755

--- a/tests/functional/test_arm_sx1.py

+++ b/tests/functional/test_arm_sx1.py

@@ -XXX,XX +XXX,XX @@ def test_arm_sx1_initrd(self):

self.vm.add_args('-append', f'kunit.enable=0 rdinit=/sbin/init {self.CONSOLE_ARGS}')

self.vm.add_args('-no-reboot')

self.launch_kernel(zimage_path,

- initrd=initrd_path)

+ initrd=initrd_path,

+ wait_for='Boot successful')

self.vm.wait(timeout=120)

def test_arm_sx1_sd(self):

@@ -XXX,XX +XXX,XX @@ def test_arm_sx1_sd(self):

self.vm.add_args('-no-reboot')

self.vm.add_args('-snapshot')

self.vm.add_args('-drive', f'format=raw,if=sd,file={sd_fs_path}')

- self.launch_kernel(zimage_path)

+ self.launch_kernel(zimage_path, wait_for='Boot successful')

self.vm.wait(timeout=120)

def test_arm_sx1_flash(self):

@@ -XXX,XX +XXX,XX @@ def test_arm_sx1_flash(self):

self.vm.add_args('-no-reboot')

self.vm.add_args('-snapshot')

self.vm.add_args('-drive', f'format=raw,if=pflash,file={flash_path}')

- self.launch_kernel(zimage_path)

+ self.launch_kernel(zimage_path, wait_for='Boot successful')

self.vm.wait(timeout=120)

if __name__ == '__main__':

2.43.0

When we are calculating timer deadlines, the correct definition of

whether or not to apply an offset to the physical count is described

in the Arm ARM DDI4087 rev L.a section D12.2.4.1. This is different

from when the offset should be applied for a direct read of the

counter sysreg.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20250204125009.2281315-2-peter.maydell@linaro.org

target/arm/helper.c | 29 +++++++++++++++++++++++++++--

1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_phys_cnt_offset(CPUARMState *env)

return gt_phys_raw_cnt_offset(env);

+static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx)

+ /*

+ * Return the timer offset to use for indirect accesses to the timer.

+ * This is the Offset value as defined in D12.2.4.1 "Operation of the

+ * CompareValue views of the timers".

+ *

+ * The condition here is not always the same as the condition for

+ * whether to apply an offset register when doing a direct read of

+ * the counter sysreg; those conditions are described in the

+ * access pseudocode for each counter register.

+ switch (timeridx) {

+ case GTIMER_PHYS:

+ return gt_phys_raw_cnt_offset(env);

+ case GTIMER_VIRT:

+ return env->cp15.cntvoff_el2;

+ case GTIMER_HYP:

+ case GTIMER_SEC:

+ case GTIMER_HYPVIRT:

+ return 0;

+ default:

+ g_assert_not_reached();

+ }

static void gt_recalc_timer(ARMCPU *cpu, int timeridx)

ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];

@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)

* Timer enabled: calculate and set current ISTATUS, irq, and

* reset timer to when ISTATUS next has to change

*/

- uint64_t offset = timeridx == GTIMER_VIRT ?

- cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);

+ uint64_t offset = gt_indirect_access_timer_offset(&cpu->env, timeridx);

uint64_t count = gt_get_countervalue(&cpu->env);

/* Note that this must be unsigned 64 bit arithmetic: */

int istatus = count - offset >= gt->cval;

2.43.0

The CNTVOFF_EL2 offset register should only be applied for accessses

to CNTVCT_EL0 and for the EL1 virtual timer (CNTV_*). We were

incorrectly applying it for the EL2 virtual timer (CNTHV_*).

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20250204125009.2281315-3-peter.maydell@linaro.org

target/arm/helper.c | 2 --

1 file changed, 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,

switch (timeridx) {

case GTIMER_VIRT:

- case GTIMER_HYPVIRT:

offset = gt_virt_cnt_offset(env);

break;

case GTIMER_PHYS:

@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

switch (timeridx) {

case GTIMER_VIRT:

- case GTIMER_HYPVIRT:

offset = gt_virt_cnt_offset(env);

break;

case GTIMER_PHYS:

2.43.0

When we added Secure EL2 support, we missed that this needs an update

to the access code for the EL3 physical timer registers. These are

supposed to UNDEF from Secure EL1 when Secure EL2 is enabled.

(Note for stable backporting: for backports to branches where

CP_ACCESS_UNDEFINED is not defined, the old name to use instead

is CP_ACCESS_TRAP_UNCATEGORIZED.)

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20250204125009.2281315-4-peter.maydell@linaro.org

target/arm/helper.c | 3 +++

1 file changed, 3 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_stimer_access(CPUARMState *env,

if (!arm_is_secure(env)) {

return CP_ACCESS_UNDEFINED;

}

+ if (arm_is_el2_enabled(env)) {

+ return CP_ACCESS_UNDEFINED;

+ }

if (!(env->cp15.scr_el3 & SCR_ST)) {

return CP_ACCESS_TRAP_EL3;

}

2.43.0

Currently we handle CNTV_TVAL_EL02 by calling gt_tval_read() for the

EL1 virt timer. This is almost correct, but the underlying

CNTV_TVAL_EL0 register behaves slightly differently. CNTV_TVAL_EL02

always applies the CNTVOFF_EL2 offset; CNTV_TVAL_EL0 doesn't do so if

we're at EL2 and HCR_EL2.E2H is 1.

We were getting this wrong, because we ended up in

gt_virt_cnt_offset() and did the E2H check.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20250204125009.2281315-5-peter.maydell@linaro.org

target/arm/helper.c | 36 +++++++++++++++++++++++++++---------

1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

gt_recalc_timer(env_archcpu(env), timeridx);

}

+static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset)

+{

+ return (uint32_t)(env->cp15.c14_timer[timeridx].cval -

+ (gt_get_countervalue(env) - offset));

+}

+

static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,

int timeridx)

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,

break;

}

- return (uint32_t)(env->cp15.c14_timer[timeridx].cval -

- (gt_get_countervalue(env) - offset));

+ return do_tval_read(env, timeridx, offset);

+}

+

+static void do_tval_write(CPUARMState *env, int timeridx, uint64_t value,

+ uint64_t offset)

+{

+ trace_arm_gt_tval_write(timeridx, value);

+ env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +

+ sextract64(value, 0, 32);

+ gt_recalc_timer(env_archcpu(env), timeridx);

}

static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

offset = gt_phys_cnt_offset(env);

break;

}

-

- trace_arm_gt_tval_write(timeridx, value);

- env->cp15.c14_timer[timeridx].cval = gt_get_countervalue(env) - offset +

- sextract64(value, 0, 32);

- gt_recalc_timer(env_archcpu(env), timeridx);

+ do_tval_write(env, timeridx, value, offset);

}

static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static void gt_virt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

static uint64_t gt_virt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)

- return gt_tval_read(env, ri, GTIMER_VIRT);

+ /*

+ * This is CNTV_TVAL_EL02; unlike the underlying CNTV_TVAL_EL0

+ * we always apply CNTVOFF_EL2. Special case that here rather

+ * than going into the generic gt_tval_read() and then having

+ * to re-detect that it's this register.

+ * Note that the accessfn/perms mean we know we're at EL2 or EL3 here.

+ */

+ return do_tval_read(env, GTIMER_VIRT, env->cp15.cntvoff_el2);

static void gt_virt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

uint64_t value)

{

- gt_tval_write(env, ri, GTIMER_VIRT, value);

+ /* Similarly for writes to CNTV_TVAL_EL02 */

+ do_tval_write(env, GTIMER_VIRT, value, env->cp15.cntvoff_el2);

static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,

2.43.0

When reading or writing the timer registers, sometimes we need to

apply one of the timer offsets. Specifically, this happens for

direct reads of the counter registers CNTPCT_EL0 and CNTVCT_EL0 (and

their self-synchronized variants CNTVCTSS_EL0 and CNTPCTSS_EL0). It

also applies for direct reads and writes of the CNT*_TVAL_EL*

registers that provide the 32-bit downcounting view of each timer.

We currently do this with duplicated code in gt_tval_read() and

gt_tval_write() and a special-case in gt_virt_cnt_read() and

gt_cnt_read(). Refactor this so that we handle it all in a single

function gt_direct_access_timer_offset(), to parallel how we handle

the offset for indirect accesses.

The call in the WFIT helper previously to gt_virt_cnt_offset() is

now to gt_direct_access_timer_offset(); this is the correct

behaviour, but it's not immediately obvious that it shouldn't be

considered an indirect access, so we add an explanatory comment.

This commit should make no behavioural changes.

(Cc to stable because the following bugfix commit will

depend on this one.)

Cc: qemu-stable@nongnu.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20250204125009.2281315-6-peter.maydell@linaro.org

---

target/arm/internals.h | 5 +-

target/arm/helper.c | 103 +++++++++++++++++++------------------

target/arm/tcg/op_helper.c | 8 ++-

3 files changed, 62 insertions(+), 54 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ int delete_hw_watchpoint(target_ulong addr, target_ulong len, int type);

uint64_t gt_get_countervalue(CPUARMState *env);

/*

* Return the currently applicable offset between the system counter

- * and CNTVCT_EL0 (this will be either 0 or the value of CNTVOFF_EL2).

+ * and the counter for the specified timer, as used for direct register

+ * accesses.

*/

-uint64_t gt_virt_cnt_offset(CPUARMState *env);

+uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx);

/*

* Return mask of ARMMMUIdxBit values corresponding to an "invalidate

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)

return 0;

}

-static uint64_t gt_phys_cnt_offset(CPUARMState *env)

-{

- if (arm_current_el(env) >= 2) {

- return 0;

- }

- return gt_phys_raw_cnt_offset(env);

-}

-

static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx)

{

/*

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx)

}

}

+uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx)

+{

+ /*

+ * Return the timer offset to use for direct accesses to the

+ * counter registers CNTPCT and CNTVCT, and for direct accesses

+ * to the CNT*_TVAL registers.

+ *

+ * This isn't exactly the same as the indirect-access offset,

+ * because here we also care about what EL the register access

+ * is being made from.

+ *

+ * This corresponds to the access pseudocode for the registers.

+ */

+ uint64_t hcr;

+

+ switch (timeridx) {

+ case GTIMER_PHYS:

+ if (arm_current_el(env) >= 2) {

+ return 0;

+ }

+ return gt_phys_raw_cnt_offset(env);

+ case GTIMER_VIRT:

+ switch (arm_current_el(env)) {

+ case 2:

+ hcr = arm_hcr_el2_eff(env);

+ if (hcr & HCR_E2H) {

+ return 0;

+ }

+ break;

+ case 0:

+ hcr = arm_hcr_el2_eff(env);

+ if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {

+ return 0;

+ }

+ break;

+ }

+ return env->cp15.cntvoff_el2;

+ case GTIMER_HYP:

+ case GTIMER_SEC:

+ case GTIMER_HYPVIRT:

+ return 0;

+ default:

+ g_assert_not_reached();

+ }

+}

+

static void gt_recalc_timer(ARMCPU *cpu, int timeridx)

{

ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];

@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,

static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

- return gt_get_countervalue(env) - gt_phys_cnt_offset(env);

-}

-

-uint64_t gt_virt_cnt_offset(CPUARMState *env)

-{

- uint64_t hcr;

-

- switch (arm_current_el(env)) {

- case 2:

- hcr = arm_hcr_el2_eff(env);

- if (hcr & HCR_E2H) {

- return 0;

- }

- break;

- case 0:

- hcr = arm_hcr_el2_eff(env);

- if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {

- return 0;

- }

- break;

- }

-

- return env->cp15.cntvoff_el2;

+ uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_PHYS);

+ return gt_get_countervalue(env) - offset;

}

static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

- return gt_get_countervalue(env) - gt_virt_cnt_offset(env);

+ uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT);

+ return gt_get_countervalue(env) - offset;

}

static void gt_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static uint64_t do_tval_read(CPUARMState *env, int timeridx, uint64_t offset)

static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,

int timeridx)

{

- uint64_t offset = 0;

-

- switch (timeridx) {

- case GTIMER_VIRT:

- offset = gt_virt_cnt_offset(env);

- break;

- case GTIMER_PHYS:

- offset = gt_phys_cnt_offset(env);

- break;

- }

+ uint64_t offset = gt_direct_access_timer_offset(env, timeridx);

return do_tval_read(env, timeridx, offset);

}

@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

int timeridx,

uint64_t value)

{

- uint64_t offset = 0;

+ uint64_t offset = gt_direct_access_timer_offset(env, timeridx);

- switch (timeridx) {

- case GTIMER_VIRT:

- offset = gt_virt_cnt_offset(env);

- break;

- case GTIMER_PHYS:

- offset = gt_phys_cnt_offset(env);

- break;

- }

do_tval_write(env, timeridx, value, offset);

}

diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/op_helper.c

+++ b/target/arm/tcg/op_helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(wfit)(CPUARMState *env, uint64_t timeout)

int target_el = check_wfx_trap(env, false, &excp);

/* The WFIT should time out when CNTVCT_EL0 >= the specified value. */

uint64_t cntval = gt_get_countervalue(env);

- uint64_t offset = gt_virt_cnt_offset(env);

+ /*

+ * We want the value that we would get if we read CNTVCT_EL0 from

+ * the current exception level, so the direct_access offset, not

+ * the indirect_access one. Compare the pseudocode LocalTimeoutEvent(),

+ * which calls VirtualCounterTimer().

+ */

+ uint64_t offset = gt_direct_access_timer_offset(env, GTIMER_VIRT);

uint64_t cntvct = cntval - offset;

uint64_t nexttick;

--

2.43.0

From: Alex Bennée <alex.bennee@linaro.org>

When FEAT_SEL2 was implemented the SEL2 timers were missed. This

shows up when building the latest Hafnium with SPMC_AT_EL=2. The

actual implementation utilises the same logic as the rest of the

timers so all we need to do is:

- define the timers and their access functions

- conditionally add the correct system registers

- create a new accessfn as the rules are subtly different to the

existing secure timer

Fixes: e9152ee91c (target/arm: add ARMv8.4-SEL2 system registers)

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20250204125009.2281315-7-peter.maydell@linaro.org

Cc: qemu-stable@nongnu.org

Cc: Andrei Homescu <ahomescu@google.com>

Cc: Arve Hjønnevåg <arve@google.com>

Cc: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

[PMM: CP_ACCESS_TRAP_UNCATEGORIZED -> CP_ACCESS_UNDEFINED;

offset logic now in gt_{indirect,direct}_access_timer_offset() ]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

include/hw/arm/bsa.h | 2 +

target/arm/cpu.h | 2 +

target/arm/gtimer.h | 4 +-

target/arm/cpu.c | 4 ++

target/arm/helper.c | 163 +++++++++++++++++++++++++++++++++++++++++++

5 files changed, 174 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/bsa.h b/include/hw/arm/bsa.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/bsa.h

+++ b/include/hw/arm/bsa.h

#define QEMU_ARM_BSA_H

/* These are architectural INTID values */

+#define ARCH_TIMER_S_EL2_VIRT_IRQ 19

+#define ARCH_TIMER_S_EL2_IRQ 20

#define VIRTUAL_PMU_IRQ 23

#define ARCH_GIC_MAINT_IRQ 25

#define ARCH_TIMER_NS_EL2_IRQ 26

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ void arm_gt_vtimer_cb(void *opaque);

void arm_gt_htimer_cb(void *opaque);

void arm_gt_stimer_cb(void *opaque);

void arm_gt_hvtimer_cb(void *opaque);

+void arm_gt_sel2timer_cb(void *opaque);

+void arm_gt_sel2vtimer_cb(void *opaque);

unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);

void gt_rme_post_el_change(ARMCPU *cpu, void *opaque);

diff --git a/target/arm/gtimer.h b/target/arm/gtimer.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/gtimer.h

+++ b/target/arm/gtimer.h

@@ -XXX,XX +XXX,XX @@ enum {

GTIMER_HYP = 2,

GTIMER_SEC = 3,

GTIMER_HYPVIRT = 4,

-#define NUM_GTIMERS 5

+ GTIMER_S_EL2_PHYS = 5, /* CNTHPS_* ; only if FEAT_SEL2 */

+ GTIMER_S_EL2_VIRT = 6, /* CNTHVS_* ; only if FEAT_SEL2 */

+#define NUM_GTIMERS 7

#endif

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

arm_gt_stimer_cb, cpu);

cpu->gt_timer[GTIMER_HYPVIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,

arm_gt_hvtimer_cb, cpu);

+ cpu->gt_timer[GTIMER_S_EL2_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,

+ arm_gt_sel2timer_cb, cpu);

+ cpu->gt_timer[GTIMER_S_EL2_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,

+ arm_gt_sel2vtimer_cb, cpu);

}

#endif

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_stimer_access(CPUARMState *env,

}

}

+static CPAccessResult gt_sel2timer_access(CPUARMState *env,

+ const ARMCPRegInfo *ri,

+ bool isread)

+{

+ /*

+ * The AArch64 register view of the secure EL2 timers are mostly

+ * accessible from EL3 and EL2 although can also be trapped to EL2

+ * from EL1 depending on nested virt config.

+ */

+ switch (arm_current_el(env)) {

+ case 0: /* UNDEFINED */

+ return CP_ACCESS_UNDEFINED;

+ case 1:

+ if (!arm_is_secure(env)) {

+ /* UNDEFINED */

+ return CP_ACCESS_UNDEFINED;

+ } else if (arm_hcr_el2_eff(env) & HCR_NV) {

+ /* Aarch64.SystemAccessTrap(EL2, 0x18) */

+ return CP_ACCESS_TRAP_EL2;

+ }

+ /* UNDEFINED */

+ return CP_ACCESS_UNDEFINED;

+ case 2:

+ if (!arm_is_secure(env)) {

+ /* UNDEFINED */

+ return CP_ACCESS_UNDEFINED;

+ }

+ return CP_ACCESS_OK;

+ case 3:

+ if (env->cp15.scr_el3 & SCR_EEL2) {

+ return CP_ACCESS_OK;

+ } else {

+ return CP_ACCESS_UNDEFINED;

+ }

+ default:

+ g_assert_not_reached();

+ }

+}

+

uint64_t gt_get_countervalue(CPUARMState *env)

{

ARMCPU *cpu = env_archcpu(env);

@@ -XXX,XX +XXX,XX @@ static uint64_t gt_indirect_access_timer_offset(CPUARMState *env, int timeridx)

case GTIMER_HYP:

case GTIMER_SEC:

case GTIMER_HYPVIRT:

+ case GTIMER_S_EL2_PHYS:

+ case GTIMER_S_EL2_VIRT:

return 0;

default:

g_assert_not_reached();

@@ -XXX,XX +XXX,XX @@ uint64_t gt_direct_access_timer_offset(CPUARMState *env, int timeridx)

case GTIMER_HYP:

case GTIMER_SEC:

case GTIMER_HYPVIRT:

+ case GTIMER_S_EL2_PHYS:

+ case GTIMER_S_EL2_VIRT:

return 0;

default:

g_assert_not_reached();

@@ -XXX,XX +XXX,XX @@ static void gt_sec_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,

gt_ctl_write(env, ri, GTIMER_SEC, value);

}

+static void gt_sec_pel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ gt_timer_reset(env, ri, GTIMER_S_EL2_PHYS);

+}

+

+static void gt_sec_pel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_cval_write(env, ri, GTIMER_S_EL2_PHYS, value);

+}

+

+static uint64_t gt_sec_pel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ return gt_tval_read(env, ri, GTIMER_S_EL2_PHYS);

+}

+

+static void gt_sec_pel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_tval_write(env, ri, GTIMER_S_EL2_PHYS, value);

+}

+

+static void gt_sec_pel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_ctl_write(env, ri, GTIMER_S_EL2_PHYS, value);

+}

+

+static void gt_sec_vel2_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ gt_timer_reset(env, ri, GTIMER_S_EL2_VIRT);

+}

+

+static void gt_sec_vel2_cval_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_cval_write(env, ri, GTIMER_S_EL2_VIRT, value);

+}

+

+static uint64_t gt_sec_vel2_tval_read(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ return gt_tval_read(env, ri, GTIMER_S_EL2_VIRT);

+}

+

+static void gt_sec_vel2_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_tval_write(env, ri, GTIMER_S_EL2_VIRT, value);

+}

+

+static void gt_sec_vel2_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ gt_ctl_write(env, ri, GTIMER_S_EL2_VIRT, value);

+}

+

static void gt_hv_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri)

{

gt_timer_reset(env, ri, GTIMER_HYPVIRT);

@@ -XXX,XX +XXX,XX @@ void arm_gt_stimer_cb(void *opaque)

gt_recalc_timer(cpu, GTIMER_SEC);

}

+void arm_gt_sel2timer_cb(void *opaque)

+{

+ ARMCPU *cpu = opaque;

+

+ gt_recalc_timer(cpu, GTIMER_S_EL2_PHYS);

+}

+

+void arm_gt_sel2vtimer_cb(void *opaque)

+{

+ ARMCPU *cpu = opaque;

+

+ gt_recalc_timer(cpu, GTIMER_S_EL2_VIRT);

+}

+

void arm_gt_hvtimer_cb(void *opaque)

{

ARMCPU *cpu = opaque;

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_sec_cp_reginfo[] = {

.access = PL2_RW, .accessfn = sel2_access,

.nv2_redirect_offset = 0x48,

.fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },

+#ifndef CONFIG_USER_ONLY

+ /* Secure EL2 Physical Timer */

+ { .name = "CNTHPS_TVAL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 0,

+ .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .readfn = gt_sec_pel2_tval_read,

+ .writefn = gt_sec_pel2_tval_write,

+ .resetfn = gt_sec_pel2_timer_reset,

+ },

+ { .name = "CNTHPS_CTL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 1,

+ .type = ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].ctl),

+ .resetvalue = 0,

+ .writefn = gt_sec_pel2_ctl_write, .raw_writefn = raw_write,

+ },

+ { .name = "CNTHPS_CVAL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 5, .opc2 = 2,

+ .type = ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_PHYS].cval),

+ .writefn = gt_sec_pel2_cval_write, .raw_writefn = raw_write,

+ },

+ /* Secure EL2 Virtual Timer */

+ { .name = "CNTHVS_TVAL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 0,

+ .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .readfn = gt_sec_vel2_tval_read,

+ .writefn = gt_sec_vel2_tval_write,

+ .resetfn = gt_sec_vel2_timer_reset,

+ },

+ { .name = "CNTHVS_CTL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 1,

+ .type = ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].ctl),

+ .resetvalue = 0,

+ .writefn = gt_sec_vel2_ctl_write, .raw_writefn = raw_write,

+ },

+ { .name = "CNTHVS_CVAL_EL2", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 4, .opc2 = 2,

+ .type = ARM_CP_IO, .access = PL2_RW,

+ .accessfn = gt_sel2timer_access,

+ .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_S_EL2_VIRT].cval),

+ .writefn = gt_sec_vel2_cval_write, .raw_writefn = raw_write,

+ },

static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,