The following changes since commit 5767815218efd3cbfd409505ed824d5f356044ae:

Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging (2024-02-14 15:45:52 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240215

for you to fetch changes up to f780e63fe731b058fe52d43653600d8729a1b5f2:

docs: Add documentation for the mps3-an536 board (2024-02-15 14:32:39 +0000)

* hw/arm/xilinx_zynq: Wire FIQ between CPU <> GIC

* linux-user/aarch64: Choose SYNC as the preferred MTE mode

* Fix some errors in SVE/SME handling of MTE tags

* hw/pci-host/raven.c: Mark raven_io_ops as implementing unaligned accesses

* hw/block/tc58128: Don't emit deprecation warning under qtest

* tests/qtest: Fix handling of npcm7xx and GMAC tests

* hw/arm/virt: Wire up non-secure EL2 virtual timer IRQ

* tests/qtest/npcm7xx_emc-test: Connect all NICs to a backend

* Don't assert on vmload/vmsave of M-profile CPUs

* hw/arm/smmuv3: add support for stage 1 access fault

* hw/arm/stellaris: QOM cleanups

* Use new CBAR encoding for all v8 CPUs, not all aarch64 CPUs

* Improve Cortex_R52 IMPDEF sysreg modelling

* Allow access to SPSR_hyp from hyp mode

* New board model mps3-an536 (Cortex-R52)

Luc Michel (1):

hw/arm/smmuv3: add support for stage 1 access fault

Nabih Estefan (1):

tests/qtest: Fix GMAC test to run on a machine in upstream QEMU

Peter Maydell (22):

hw/pci-host/raven.c: Mark raven_io_ops as implementing unaligned accesses

hw/block/tc58128: Don't emit deprecation warning under qtest

tests/qtest/meson.build: Don't include qtests_npcm7xx in qtests_aarch64

tests/qtest/bios-tables-test: Allow changes to virt GTDT

hw/arm/virt: Wire up non-secure EL2 virtual timer IRQ

tests/qtest/bios-tables-tests: Update virt golden reference

hw/arm/npcm7xx: Call qemu_configure_nic_device() for GMAC modules

tests/qtest/npcm7xx_emc-test: Connect all NICs to a backend

target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU

target/arm: Use new CBAR encoding for all v8 CPUs, not all aarch64 CPUs

target/arm: The Cortex-R52 has a read-only CBAR

target/arm: Add Cortex-R52 IMPDEF sysregs

target/arm: Allow access to SPSR_hyp from hyp mode

hw/misc/mps2-scc: Fix condition for CFG3 register

hw/misc/mps2-scc: Factor out which-board conditionals

hw/misc/mps2-scc: Make changes needed for AN536 FPGA image

hw/arm/mps3r: Initial skeleton for mps3-an536 board

hw/arm/mps3r: Add CPUs, GIC, and per-CPU RAM

hw/arm/mps3r: Add UARTs

hw/arm/mps3r: Add GPIO, watchdog, dual-timer, I2C devices

hw/arm/mps3r: Add remaining devices

docs: Add documentation for the mps3-an536 board

Philippe Mathieu-Daudé (5):

hw/arm/xilinx_zynq: Wire FIQ between CPU <> GIC

hw/arm/stellaris: Convert ADC controller to Resettable interface

hw/arm/stellaris: Convert I2C controller to Resettable interface

hw/arm/stellaris: Add missing QOM 'machine' parent

hw/arm/stellaris: Add missing QOM 'SoC' parent

Richard Henderson (6):

linux-user/aarch64: Choose SYNC as the preferred MTE mode

target/arm: Fix nregs computation in do_{ld,st}_zpa

target/arm: Adjust and validate mtedesc sizem1

target/arm: Split out make_svemte_desc

target/arm: Handle mte in do_ldrq, do_ldro

target/arm: Fix SVE/SME gross MTE suppression checks

MAINTAINERS | 3 +-

docs/system/arm/mps2.rst | 37 +-

configs/devices/arm-softmmu/default.mak | 1 +

hw/arm/smmuv3-internal.h | 1 +

include/hw/arm/smmu-common.h | 1 +

include/hw/arm/virt.h | 2 +

include/hw/misc/mps2-scc.h | 1 +

linux-user/aarch64/target_prctl.h | 29 +-

target/arm/internals.h | 2 +-

target/arm/tcg/translate-a64.h | 2 +

hw/arm/mps3r.c | 640 ++++++++++++++++++++++++++++++++

hw/arm/npcm7xx.c | 1 +

hw/arm/smmu-common.c | 11 +

hw/arm/smmuv3.c | 1 +

hw/arm/stellaris.c | 47 ++-

hw/arm/virt-acpi-build.c | 20 +-

hw/arm/virt.c | 60 ++-

hw/arm/xilinx_zynq.c | 2 +

hw/block/tc58128.c | 4 +-

hw/misc/mps2-scc.c | 138 ++++++-

hw/pci-host/raven.c | 1 +

target/arm/helper.c | 14 +-

target/arm/tcg/cpu32.c | 109 ++++++

target/arm/tcg/op_helper.c | 43 ++-

target/arm/tcg/sme_helper.c | 8 +-

target/arm/tcg/sve_helper.c | 12 +-

target/arm/tcg/translate-sme.c | 15 +-

target/arm/tcg/translate-sve.c | 83 +++--

target/arm/tcg/translate.c | 19 +-

tests/qtest/npcm7xx_emc-test.c | 5 +-

tests/qtest/npcm_gmac-test.c | 84 +----

hw/arm/Kconfig | 5 +

hw/arm/meson.build | 1 +

tests/data/acpi/virt/FACP | Bin 276 -> 276 bytes

tests/data/acpi/virt/GTDT | Bin 96 -> 104 bytes

tests/qtest/meson.build | 4 +-

36 files changed, 1184 insertions(+), 222 deletions(-)

create mode 100644 hw/arm/mps3r.c

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Similarly to commits dadbb58f59..5ae79fe825 for other ARM boards,

connect FIQ output of the GIC CPU interfaces to the CPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240130152548.17855-1-philmd@linaro.org

hw/arm/xilinx_zynq.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c

--- a/hw/arm/xilinx_zynq.c

+++ b/hw/arm/xilinx_zynq.c

@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)

sysbus_mmio_map(busdev, 0, MPCORE_PERIPHBASE);

sysbus_connect_irq(busdev, 0,

qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));

+ sysbus_connect_irq(busdev, 1,

+ qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_FIQ));

for (n = 0; n < 64; n++) {

pic[n] = qdev_get_gpio_in(dev, n);

2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The field is encoded as [0-3], which is convenient for

indexing our array of function pointers, but the true

value is [1-4]. Adjust before calling do_mem_zpa.

Add an assert, and move the comment re passing ZT to

the helper back next to the relevant code.

Cc: qemu-stable@nongnu.org

Fixes: 206adacfb8d ("target/arm: Add mte helpers for sve scalar + int loads")

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Tested-by: Gustavo Romero <gustavo.romero@linaro.org>

Message-id: 20240207025210.8837-3-richard.henderson@linaro.org

target/arm/tcg/translate-sve.c | 16 ++++++++--------

1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c

--- a/target/arm/tcg/translate-sve.c

+++ b/target/arm/tcg/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

TCGv_ptr t_pg;

int desc = 0;

- /*

- * For e.g. LD4, there are not enough arguments to pass all 4

- * registers as pointers, so encode the regno into the data field.

- * For consistency, do this even for LD1.

- */

+ assert(mte_n >= 1 && mte_n <= 4);

if (s->mte_active[0]) {

int msz = dtype_msz(dtype);

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

addr = clean_data_tbi(s, addr);

}

+ /*

+ * For e.g. LD4, there are not enough arguments to pass all 4

+ * registers as pointers, so encode the regno into the data field.

+ * For consistency, do this even for LD1.

+ */

desc = simd_desc(vsz, vsz, zt | desc);

t_pg = tcg_temp_new_ptr();

@@ -XXX,XX +XXX,XX @@ static void do_ld_zpa(DisasContext *s, int zt, int pg,

* accessible via the instruction encoding.

*/

assert(fn != NULL);

- do_mem_zpa(s, zt, pg, addr, dtype, nreg, false, fn);

+ do_mem_zpa(s, zt, pg, addr, dtype, nreg + 1, false, fn);

static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)

@@ -XXX,XX +XXX,XX @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

if (nreg == 0) {

/* ST1 */

fn = fn_single[s->mte_active[0]][be][msz][esz];

- nreg = 1;

} else {

/* ST2, ST3, ST4 -- msz == esz, enforced by encoding */

assert(msz == esz);

fn = fn_multiple[s->mte_active[0]][be][nreg - 1][msz];

}

assert(fn != NULL);

- do_mem_zpa(s, zt, pg, addr, msz_dtype(s, msz), nreg, true, fn);

+ do_mem_zpa(s, zt, pg, addr, msz_dtype(s, msz), nreg + 1, true, fn);

}

static bool trans_ST_zprr(DisasContext *s, arg_rprr_store *a)

2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Share code that creates mtedesc and embeds within simd_desc.

Cc: qemu-stable@nongnu.org

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Tested-by: Gustavo Romero <gustavo.romero@linaro.org>

Message-id: 20240207025210.8837-5-richard.henderson@linaro.org

target/arm/tcg/translate-a64.h | 2 ++

target/arm/tcg/translate-sme.c | 15 +++--------

target/arm/tcg/translate-sve.c | 47 ++++++++++++++++++----------------

3 files changed, 31 insertions(+), 33 deletions(-)

diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h

--- a/target/arm/tcg/translate-a64.h

+++ b/target/arm/tcg/translate-a64.h

@@ -XXX,XX +XXX,XX @@ bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,

bool sve_access_check(DisasContext *s);

bool sme_enabled_check(DisasContext *s);

bool sme_enabled_check_with_svcr(DisasContext *s, unsigned);

+uint32_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,

+ uint32_t msz, bool is_write, uint32_t data);

/* This function corresponds to CheckStreamingSVEEnabled. */

static inline bool sme_sm_enabled_check(DisasContext *s)

diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/translate-sme.c

+++ b/target/arm/tcg/translate-sme.c

@@ -XXX,XX +XXX,XX @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)

TCGv_ptr t_za, t_pg;

TCGv_i64 addr;

- int svl, desc = 0;

+ uint32_t desc;

bool be = s->be_data == MO_BE;

bool mte = s->mte_active[0];

@@ -XXX,XX +XXX,XX @@ static bool trans_LDST1(DisasContext *s, arg_LDST1 *a)

tcg_gen_shli_i64(addr, cpu_reg(s, a->rm), a->esz);

tcg_gen_add_i64(addr, addr, cpu_reg_sp(s, a->rn));

- if (mte) {

- desc = FIELD_DP32(desc, MTEDESC, MIDX, get_mem_index(s));

- desc = FIELD_DP32(desc, MTEDESC, TBI, s->tbid);

- desc = FIELD_DP32(desc, MTEDESC, TCMA, s->tcma);

- desc = FIELD_DP32(desc, MTEDESC, WRITE, a->st);

- desc = FIELD_DP32(desc, MTEDESC, SIZEM1, (1 << a->esz) - 1);

- desc <<= SVE_MTEDESC_SHIFT;

- } else {

+ if (!mte) {

addr = clean_data_tbi(s, addr);

}

- svl = streaming_vec_reg_size(s);

- desc = simd_desc(svl, svl, desc);

+ desc = make_svemte_desc(s, streaming_vec_reg_size(s), 1, a->esz, a->st, 0);

fns[a->esz][be][a->v][mte][a->st](tcg_env, t_za, t_pg, addr,

tcg_constant_i32(desc));

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c

--- a/target/arm/tcg/translate-sve.c

+++ b/target/arm/tcg/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static const uint8_t dtype_esz[16] = {

3, 2, 1, 3

};

-static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

- int dtype, uint32_t mte_n, bool is_write,

- gen_helper_gvec_mem *fn)

+uint32_t make_svemte_desc(DisasContext *s, unsigned vsz, uint32_t nregs,

+ uint32_t msz, bool is_write, uint32_t data)

{

- unsigned vsz = vec_full_reg_size(s);

- TCGv_ptr t_pg;

uint32_t sizem1;

- int desc = 0;

+ uint32_t desc = 0;

- assert(mte_n >= 1 && mte_n <= 4);

- sizem1 = (mte_n << dtype_msz(dtype)) - 1;

+ /* Assert all of the data fits, with or without MTE enabled. */

+ assert(nregs >= 1 && nregs <= 4);

+ sizem1 = (nregs << msz) - 1;

assert(sizem1 <= R_MTEDESC_SIZEM1_MASK >> R_MTEDESC_SIZEM1_SHIFT);

+ assert(data < 1u << SVE_MTEDESC_SHIFT);

if (s->mte_active[0]) {

desc = FIELD_DP32(desc, MTEDESC, MIDX, get_mem_index(s));

desc = FIELD_DP32(desc, MTEDESC, TBI, s->tbid);

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

desc = FIELD_DP32(desc, MTEDESC, WRITE, is_write);

desc = FIELD_DP32(desc, MTEDESC, SIZEM1, sizem1);

desc <<= SVE_MTEDESC_SHIFT;

- } else {

+ return simd_desc(vsz, vsz, desc | data);

+static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

+ int dtype, uint32_t nregs, bool is_write,

+ gen_helper_gvec_mem *fn)

+ TCGv_ptr t_pg;

+ uint32_t desc;

+ if (!s->mte_active[0]) {

addr = clean_data_tbi(s, addr);

}

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

* registers as pointers, so encode the regno into the data field.

* For consistency, do this even for LD1.

*/

- desc = simd_desc(vsz, vsz, zt | desc);

+ desc = make_svemte_desc(s, vec_full_reg_size(s), nregs,

+ dtype_msz(dtype), is_write, zt);

t_pg = tcg_temp_new_ptr();

tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,

int scale, TCGv_i64 scalar, int msz, bool is_write,

gen_helper_gvec_mem_scatter *fn)

{

- unsigned vsz = vec_full_reg_size(s);

TCGv_ptr t_zm = tcg_temp_new_ptr();

TCGv_ptr t_pg = tcg_temp_new_ptr();

TCGv_ptr t_zt = tcg_temp_new_ptr();

- int desc = 0;

-

- if (s->mte_active[0]) {

- desc = FIELD_DP32(desc, MTEDESC, MIDX, get_mem_index(s));

- desc = FIELD_DP32(desc, MTEDESC, TBI, s->tbid);

- desc = FIELD_DP32(desc, MTEDESC, TCMA, s->tcma);

- desc = FIELD_DP32(desc, MTEDESC, WRITE, is_write);

- desc = FIELD_DP32(desc, MTEDESC, SIZEM1, (1 << msz) - 1);

- desc <<= SVE_MTEDESC_SHIFT;

- }

- desc = simd_desc(vsz, vsz, desc | scale);

+ uint32_t desc;

tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));

tcg_gen_addi_ptr(t_zm, tcg_env, vec_full_reg_offset(s, zm));

tcg_gen_addi_ptr(t_zt, tcg_env, vec_full_reg_offset(s, zt));

+ desc = make_svemte_desc(s, vec_full_reg_size(s), 1, msz, is_write, scale);

fn(tcg_env, t_zt, t_pg, t_zm, scalar, tcg_constant_i32(desc));

2.34.1

These functions "use the standard load helpers", but

fail to clean_data_tbi or populate mtedesc.

Cc: qemu-stable@nongnu.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Tested-by: Gustavo Romero <gustavo.romero@linaro.org>

Message-id: 20240207025210.8837-6-richard.henderson@linaro.org

target/arm/tcg/translate-sve.c | 15 +++++++++++++--

1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c

--- a/target/arm/tcg/translate-sve.c

+++ b/target/arm/tcg/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static void do_ldrq(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)

unsigned vsz = vec_full_reg_size(s);

TCGv_ptr t_pg;

int poff;

+ uint32_t desc;

/* Load the first quadword using the normal predicated load helpers. */

+ if (!s->mte_active[0]) {

+ addr = clean_data_tbi(s, addr);

+ }

+

poff = pred_full_reg_offset(s, pg);

if (vsz > 16) {

/*

@@ -XXX,XX +XXX,XX @@ static void do_ldrq(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)

gen_helper_gvec_mem *fn

= ldr_fns[s->mte_active[0]][s->be_data == MO_BE][dtype][0];

- fn(tcg_env, t_pg, addr, tcg_constant_i32(simd_desc(16, 16, zt)));

+ desc = make_svemte_desc(s, 16, 1, dtype_msz(dtype), false, zt);

+ fn(tcg_env, t_pg, addr, tcg_constant_i32(desc));

/* Replicate that first quadword. */

if (vsz > 16) {

@@ -XXX,XX +XXX,XX @@ static void do_ldro(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)

unsigned vsz_r32;

TCGv_ptr t_pg;

int poff, doff;

+ uint32_t desc;

if (vsz < 32) {

/*

@@ -XXX,XX +XXX,XX @@ static void do_ldro(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)

/* Load the first octaword using the normal predicated load helpers. */

+ if (!s->mte_active[0]) {

+ addr = clean_data_tbi(s, addr);

+ }

poff = pred_full_reg_offset(s, pg);

if (vsz > 32) {

@@ -XXX,XX +XXX,XX @@ static void do_ldro(DisasContext *s, int zt, int pg, TCGv_i64 addr, int dtype)

gen_helper_gvec_mem *fn

= ldr_fns[s->mte_active[0]][s->be_data == MO_BE][dtype][0];

- fn(tcg_env, t_pg, addr, tcg_constant_i32(simd_desc(32, 32, zt)));

+ desc = make_svemte_desc(s, 32, 1, dtype_msz(dtype), false, zt);

+ fn(tcg_env, t_pg, addr, tcg_constant_i32(desc));

/*

* Replicate that first octaword.

2.34.1

The TBI and TCMA bits are located within mtedesc, not desc.

Cc: qemu-stable@nongnu.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Tested-by: Gustavo Romero <gustavo.romero@linaro.org>

Message-id: 20240207025210.8837-7-richard.henderson@linaro.org

target/arm/tcg/sme_helper.c | 8 ++++----

target/arm/tcg/sve_helper.c | 12 ++++++------

2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c

--- a/target/arm/tcg/sme_helper.c

+++ b/target/arm/tcg/sme_helper.c

@@ -XXX,XX +XXX,XX @@ void sme_ld1_mte(CPUARMState *env, void *za, uint64_t *vg,

desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);

/* Perform gross MTE suppression early. */

- if (!tbi_check(desc, bit55) ||

- tcma_check(desc, bit55, allocation_tag_from_addr(addr))) {

+ if (!tbi_check(mtedesc, bit55) ||

+ tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {

mtedesc = 0;

}

@@ -XXX,XX +XXX,XX @@ void sme_st1_mte(CPUARMState *env, void *za, uint64_t *vg, target_ulong addr,

desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);

/* Perform gross MTE suppression early. */

- if (!tbi_check(desc, bit55) ||

- tcma_check(desc, bit55, allocation_tag_from_addr(addr))) {

+ if (!tbi_check(mtedesc, bit55) ||

+ tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {

mtedesc = 0;

}

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/sve_helper.c

+++ b/target/arm/tcg/sve_helper.c

@@ -XXX,XX +XXX,XX @@ void sve_ldN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,

desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);

/* Perform gross MTE suppression early. */

- if (!tbi_check(desc, bit55) ||

- tcma_check(desc, bit55, allocation_tag_from_addr(addr))) {

+ if (!tbi_check(mtedesc, bit55) ||

+ tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {

mtedesc = 0;

}

@@ -XXX,XX +XXX,XX @@ void sve_ldnfff1_r_mte(CPUARMState *env, void *vg, target_ulong addr,

desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);

/* Perform gross MTE suppression early. */

- if (!tbi_check(desc, bit55) ||

- tcma_check(desc, bit55, allocation_tag_from_addr(addr))) {

+ if (!tbi_check(mtedesc, bit55) ||

+ tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {

mtedesc = 0;

}

@@ -XXX,XX +XXX,XX @@ void sve_stN_r_mte(CPUARMState *env, uint64_t *vg, target_ulong addr,

desc = extract32(desc, 0, SIMD_DATA_SHIFT + SVE_MTEDESC_SHIFT);

/* Perform gross MTE suppression early. */

- if (!tbi_check(desc, bit55) ||

- tcma_check(desc, bit55, allocation_tag_from_addr(addr))) {

+ if (!tbi_check(mtedesc, bit55) ||

+ tcma_check(mtedesc, bit55, allocation_tag_from_addr(addr))) {

mtedesc = 0;

}

2.34.1

The raven_io_ops MemoryRegionOps is the only one in the source tree

which sets .valid.unaligned to indicate that it should support

unaligned accesses and which does not also set .impl.unaligned to

indicate that its read and write functions can do the unaligned

handling themselves. This is a problem, because at the moment the

core memory system does not implement the support for handling

unaligned accesses by doing a series of aligned accesses and

combining them (system/memory.c:access_with_adjusted_size() has a

TODO comment noting this).

Fortunately raven_io_read() and raven_io_write() will correctly deal

with the case of being passed an unaligned address, so we can fix the

missing unaligned access support by setting .impl.unaligned in the

MemoryRegionOps struct.

Fixes: 9a1839164c9c8f06 ("raven: Implement non-contiguous I/O region")

hw/pci-host/raven.c | 1 +

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c

--- a/hw/pci-host/raven.c

+++ b/hw/pci-host/raven.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps raven_io_ops = {

.write = raven_io_write,

.endianness = DEVICE_LITTLE_ENDIAN,

.impl.max_access_size = 4,

+ .impl.unaligned = true,

.valid.unaligned = true,

};

2.34.1

Armv8.1+ CPUs have the Virtual Host Extension (VHE) which adds a

non-secure EL2 virtual timer. We implemented the timer itself in the

CPU model, but never wired up its IRQ line to the GIC.

Wire up the IRQ line (this is always safe whether the CPU has the

interrupt or not, since it always creates the outbound IRQ line).

Report it to the guest via dtb and ACPI if the CPU has the feature.

The DTB binding is documented in the kernel's

Documentation/devicetree/bindings/timer/arm\,arch_timer.yaml

and the ACPI table entries are documented in the ACPI specification

version 6.3 or later.

Because the IRQ line ACPI binding is new in 6.3, we need to bump the

FADT table rev to show that we might be using 6.3 features.

Note that exposing this IRQ in the DTB will trigger a bug in EDK2

versions prior to edk2-stable202311, for users who use the virt board

with 'virtualization=on' to enable EL2 emulation and are booting an

EDK2 guest BIOS, if that EDK2 has assertions enabled. The effect is

that EDK2 will assert on bootup:

ASSERT [ArmTimerDxe] /home/kraxel/projects/qemu/roms/edk2/ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.c(72): PropSize == 36 || PropSize == 48

If you see that assertion you should do one of:

* update your EDK2 binaries to edk2-stable202311 or newer

* use the 'virt-8.2' versioned machine type

* not use 'virtualization=on'

(The versions shipped with QEMU itself have the fix.)

include/hw/arm/virt.h | 2 ++

hw/arm/virt-acpi-build.c | 20 ++++++++++----

hw/arm/virt.c | 60 ++++++++++++++++++++++++++++++++++------

3 files changed, 67 insertions(+), 15 deletions(-)

@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {

/* Machines < 6.2 have no support for describing cpu topology to guest */

bool no_cpu_topology;

bool no_tcg_lpa2;

+ bool no_ns_el2_virt_timer_irq;

struct VirtMachineState {

@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {

PCIBus *bus;

char *oem_id;

char *oem_table_id;

+ bool ns_el2_virt_timer_irq;

};

#define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt-acpi-build.c

+++ b/hw/arm/virt-acpi-build.c

@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

}

/*

- * ACPI spec, Revision 5.1

- * 5.2.24 Generic Timer Description Table (GTDT)

+ * ACPI spec, Revision 6.5

+ * 5.2.25 Generic Timer Description Table (GTDT)

*/

static void

build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

uint32_t irqflags = vmc->claim_edge_triggered_timers ?

1 : /* Interrupt is Edge triggered */

0; /* Interrupt is Level triggered */

- AcpiTable table = { .sig = "GTDT", .rev = 2, .oem_id = vms->oem_id,

+ AcpiTable table = { .sig = "GTDT", .rev = 3, .oem_id = vms->oem_id,

.oem_table_id = vms->oem_table_id };

acpi_table_begin(&table, table_data);

@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

build_append_int_noprefix(table_data, 0, 4);

/* Platform Timer Offset */

build_append_int_noprefix(table_data, 0, 4);

-

+ if (vms->ns_el2_virt_timer_irq) {

+ /* Virtual EL2 Timer GSIV */

+ build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_VIRT_IRQ, 4);

+ /* Virtual EL2 Timer Flags */

+ build_append_int_noprefix(table_data, irqflags, 4);

+ } else {

+ build_append_int_noprefix(table_data, 0, 4);

+ build_append_int_noprefix(table_data, 0, 4);

+ }

acpi_table_end(linker, &table);

}

@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

static void build_fadt_rev6(GArray *table_data, BIOSLinker *linker,

VirtMachineState *vms, unsigned dsdt_tbl_offset)

{

- /* ACPI v6.0 */

+ /* ACPI v6.3 */

AcpiFadtData fadt = {

.rev = 6,

- .minor_ver = 0,

+ .minor_ver = 3,

.flags = 1 << ACPI_FADT_F_HW_REDUCED_ACPI,

.xdsdt_tbl_offset = &dsdt_tbl_offset,

};

@@ -XXX,XX +XXX,XX @@ static void create_randomness(MachineState *ms, const char *node)

qemu_fdt_setprop(ms->fdt, node, "rng-seed", seed.rng, sizeof(seed.rng));

}

+/*

+ * The CPU object always exposes the NS EL2 virt timer IRQ line,

+ * but we don't want to advertise it to the guest in the dtb or ACPI

+ * table unless it's really going to do something.

+ */

+static bool ns_el2_virt_timer_present(void)

+ ARMCPU *cpu = ARM_CPU(qemu_get_cpu(0));

+ CPUARMState *env = &cpu->env;

+

+ return arm_feature(env, ARM_FEATURE_AARCH64) &&

+ arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu);

+}

+

static void create_fdt(VirtMachineState *vms)

{

MachineState *ms = MACHINE(vms);

@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)

"arm,armv7-timer");

}

qemu_fdt_setprop(ms->fdt, "/timer", "always-on", NULL, 0);

- qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);

+ if (vms->ns_el2_virt_timer_irq) {

+ qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_VIRT_IRQ), irqflags);

+ } else {

+ qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);

}

static void fdt_add_cpu_nodes(const VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)

[GTIMER_VIRT] = ARCH_TIMER_VIRT_IRQ,

[GTIMER_HYP] = ARCH_TIMER_NS_EL2_IRQ,

[GTIMER_SEC] = ARCH_TIMER_S_EL1_IRQ,

+ [GTIMER_HYPVIRT] = ARCH_TIMER_NS_EL2_VIRT_IRQ,

};

for (unsigned irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {

@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)

qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);

object_unref(cpuobj);

}

+

+ /* Now we've created the CPUs we can see if they have the hypvirt timer */

+ vms->ns_el2_virt_timer_irq = ns_el2_virt_timer_present() &&

+ !vmc->no_ns_el2_virt_timer_irq;

+

fdt_add_timer_nodes(vms);

fdt_add_cpu_nodes(vms);

@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(9, 0)

static void virt_machine_8_2_options(MachineClass *mc)

+ VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));

+

virt_machine_9_0_options(mc);

compat_props_add(mc->compat_props, hw_compat_8_2, hw_compat_8_2_len);

+ /*

+ * Don't expose NS_EL2_VIRT timer IRQ in DTB on ACPI on 8.2 and

+ * earlier machines. (Exposing it tickles a bug in older EDK2

+ * guest BIOS binaries.)

+ */

+ vmc->no_ns_el2_virt_timer_irq = true;

}

DEFINE_VIRT_MACHINE(8, 2)

2.34.1

Update the virt golden reference files to say that the FACP is ACPI

v6.3, and the GTDT table is a revision 3 table with space for the

virtual EL2 timer.

Diffs from iasl:

@@ -XXX,XX +XXX,XX @@

/*

* Intel ACPI Component Architecture

* AML/ASL+ Disassembler version 20200925 (64-bit version)

* Copyright (c) 2000 - 2020 Intel Corporation

*

- * Disassembly of tests/data/acpi/virt/FACP, Mon Jan 22 13:48:40 2024

+ * Disassembly of /tmp/aml-W8RZH2, Mon Jan 22 13:48:40 2024