thanks

Thomas Huth (1):

hw/char/stm32l4x5_usart: Fix memory corruption by adding correct class_size

Zenghui Yu (1):

hvf: arm: Remove PL1_WRITE_MASK

docs/system/arm/b-l475e-iot01a.rst | 3 +-

docs/system/arm/emulation.rst | 42 ++++-

include/hw/display/dm163.h | 59 ++++++

include/hw/watchdog/sbsa_gwdt.h | 3 +-

target/arm/cpu.h | 28 +++

target/arm/internals.h | 15 +-

hw/arm/b-l475e-iot01a.c | 105 +++++++++--

hw/arm/npcm7xx.c | 3 +-

hw/arm/sbsa-ref.c | 16 ++

hw/arm/stm32l4x5_soc.c | 6 +-

hw/char/stm32l4x5_usart.c | 1 +

hw/core/clock.c | 1 -

hw/core/machine.c | 4 +-

hw/display/dm163.c | 349 ++++++++++++++++++++++++++++++++++++

hw/dma/xlnx_dpdma.c | 20 +--

hw/watchdog/sbsa_gwdt.c | 15 +-

target/arm/cpu.c | 42 +++--

target/arm/cpu64.c | 2 +

target/arm/helper.c | 22 +--

target/arm/hvf/hvf.c | 3 +-

target/arm/kvm.c | 2 +

target/arm/tcg/cpu32.c | 6 +-

target/arm/tcg/cpu64.c | 28 ++-

target/arm/tcg/hflags.c | 12 +-

tests/qtest/dm163-test.c | 194 ++++++++++++++++++++

tests/qtest/stm32l4x5_gpio-test.c | 13 +-

tests/qtest/stm32l4x5_syscfg-test.c | 17 +-

hw/arm/Kconfig | 1 +

hw/display/Kconfig | 3 +

hw/display/meson.build | 1 +

hw/display/trace-events | 14 ++

tests/avocado/boot_linux_console.py | 70 ++++----

tests/avocado/replay_kernel.py | 8 +-

tests/qtest/meson.build | 2 +

34 files changed, 987 insertions(+), 123 deletions(-)

create mode 100644 include/hw/display/dm163.h

create mode 100644 hw/display/dm163.c

create mode 100644 tests/qtest/dm163-test.c

From: Raphael Poggi <raphael.poggi@lynxleap.co.uk>

clock_propagate() has an assert that clk->source is NULL, i.e. that

you are calling it on a clock which has no source clock. This made

sense in the original design where the only way for a clock's

frequency to change if it had a source clock was when that source

clock changed. However, we subsequently added multiplier/divider

support, but didn't look at what that meant for propagation.

If a clock-management device changes the multiplier or divider value

on a clock, it needs to propagate that change down to child clocks,

even if the clock has a source clock set. So the assertion is now

incorrect.

Remove the assertion.

Signed-off-by: Raphael Poggi <raphael.poggi@lynxleap.co.uk>

Message-id: 20240419162951.23558-1-raphael.poggi@lynxleap.co.uk

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

[PMM: Rewrote the commit message]

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/core/clock.c | 1 -

1 file changed, 1 deletion(-)

diff --git a/hw/core/clock.c b/hw/core/clock.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/core/clock.c

+++ b/hw/core/clock.c

@@ -XXX,XX +XXX,XX @@ static void clock_propagate_period(Clock *clk, bool call_callbacks)

void clock_propagate(Clock *clk)

{

- assert(clk->source == NULL);

trace_clock_propagate(CLOCK_PATH(clk));

clock_propagate_period(clk, true);

}

--

2.34.1

From: Zenghui Yu <zenghui.yu@linux.dev>

As it had never been used since the first commit a1477da3ddeb ("hvf: Add

Apple Silicon support").

Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>

Message-id: 20240422092715.71973-1-zenghui.yu@linux.dev

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/hvf/hvf.c | 1 -

1 file changed, 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/hvf/hvf.c

+++ b/target/arm/hvf/hvf.c

@@ -XXX,XX +XXX,XX @@ void hvf_arm_init_debug(void)

#define HVF_SYSREG(crn, crm, op0, op1, op2) \

ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)

-#define PL1_WRITE_MASK 0x4

#define SYSREG_OP0_SHIFT 20

#define SYSREG_OP0_MASK 0x3

--

2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

For cpus using PMSA, when the MPU is disabled, the default memory

type is Normal, Non-cachable. This means that it should not

have alignment restrictions enforced.

Cc: qemu-stable@nongnu.org

Fixes: 59754f85ed3 ("target/arm: Do memory type alignment check when translation disabled")

Reported-by: Clément Chigot <chigot@adacore.com>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Tested-by: Clément Chigot <chigot@adacore.com>

Message-id: 20240422170722.117409-1-richard.henderson@linaro.org

[PMM: trivial comment, commit message tweaks]

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/tcg/hflags.c | 12 ++++++++++--

1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/hflags.c

+++ b/target/arm/tcg/hflags.c

@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)

}

/*

- * If translation is disabled, then the default memory type is

- * Device(-nGnRnE) instead of Normal, which requires that alignment

+ * With PMSA, when the MPU is disabled, all memory types in the

+ * default map are Normal, so don't need aligment enforcing.

+ */

+ if (arm_feature(env, ARM_FEATURE_PMSA)) {

+ return false;

+ }

+

+ /*

+ * With VMSA, if translation is disabled, then the default memory type

+ * is Device(-nGnRnE) instead of Normal, which requires that alignment

* be enforced. Since this affects all ram, it is most efficient

* to handle this during translation.

*/

--

2.34.1

As of version DDI0487K.a of the Arm ARM, some architectural features

which previously didn't have official names have been named. Add

these to the list of features which QEMU's TCG emulation supports.

Mostly these are features which we thought of as part of baseline 8.0

support. For SVE and SVE2, the names have been brought into line

with the FEAT_* naming convention of other extensions, and some

sub-components split into separate FEAT_ items. In a few cases (eg

FEAT_CCIDX, FEAT_DPB2) the omission from our list was just an oversight.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20240418152004.2106516-2-peter.maydell@linaro.org

---

docs/system/arm/emulation.rst | 38 +++++++++++++++++++++++++++++++++--

1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/emulation.rst

+++ b/docs/system/arm/emulation.rst

@@ -XXX,XX +XXX,XX @@ Armv8 versions of the A-profile architecture. It also has support for

the following architecture extensions:

- FEAT_AA32BF16 (AArch32 BFloat16 instructions)

+- FEAT_AA32EL0 (Support for AArch32 at EL0)

+- FEAT_AA32EL1 (Support for AArch32 at EL1)

+- FEAT_AA32EL2 (Support for AArch32 at EL2)

+- FEAT_AA32EL3 (Support for AArch32 at EL3)

- FEAT_AA32HPD (AArch32 hierarchical permission disables)

- FEAT_AA32I8MM (AArch32 Int8 matrix multiplication instructions)

+- FEAT_AA64EL0 (Support for AArch64 at EL0)

+- FEAT_AA64EL1 (Support for AArch64 at EL1)

+- FEAT_AA64EL2 (Support for AArch64 at EL2)

+- FEAT_AA64EL3 (Support for AArch64 at EL3)

+- FEAT_AdvSIMD (Advanced SIMD Extension)

- FEAT_AES (AESD and AESE instructions)

+- FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)

+- FEAT_ASID16 (16 bit ASID)

- FEAT_BBM at level 2 (Translation table break-before-make levels)

- FEAT_BF16 (AArch64 BFloat16 instructions)

- FEAT_BTI (Branch Target Identification)

+- FEAT_CCIDX (Extended cache index)

- FEAT_CRC32 (CRC32 instructions)

+- FEAT_Crypto (Cryptographic Extension)

- FEAT_CSV2 (Cache speculation variant 2)

- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)

- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_DGH (Data gathering hint)

- FEAT_DIT (Data Independent Timing instructions)

- FEAT_DPB (DC CVAP instruction)

+- FEAT_DPB2 (DC CVADP instruction)

+- FEAT_Debugv8p1 (Debug with VHE)

- FEAT_Debugv8p2 (Debug changes for v8.2)

- FEAT_Debugv8p4 (Debug changes for v8.4)

- FEAT_DotProd (Advanced SIMD dot product instructions)

- FEAT_DoubleFault (Double Fault Extension)

- FEAT_E0PD (Preventing EL0 access to halves of address maps)

- FEAT_ECV (Enhanced Counter Virtualization)

+- FEAT_EL0 (Support for execution at EL0)

+- FEAT_EL1 (Support for execution at EL1)

+- FEAT_EL2 (Support for execution at EL2)

+- FEAT_EL3 (Support for execution at EL3)

- FEAT_EPAC (Enhanced pointer authentication)

- FEAT_ETS (Enhanced Translation Synchronization)

- FEAT_EVT (Enhanced Virtualization Traps)

+- FEAT_F32MM (Single-precision Matrix Multiplication)

+- FEAT_F64MM (Double-precision Matrix Multiplication)

- FEAT_FCMA (Floating-point complex number instructions)

- FEAT_FGT (Fine-Grained Traps)

- FEAT_FHM (Floating-point half-precision multiplication instructions)

+- FEAT_FP (Floating Point extensions)

- FEAT_FP16 (Half-precision floating-point data processing)

- FEAT_FPAC (Faulting on AUT* instructions)

- FEAT_FPACCOMBINE (Faulting on combined pointer authentication instructions)

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_LSE (Large System Extensions)

- FEAT_LSE2 (Large System Extensions v2)

- FEAT_LVA (Large Virtual Address space)

+- FEAT_MixedEnd (Mixed-endian support)

+- FEAT_MixdEndEL0 (Mixed-endian support at EL0)

- FEAT_MOPS (Standardization of memory operations)

- FEAT_MTE (Memory Tagging Extension)

- FEAT_MTE2 (Memory Tagging Extension)

- FEAT_MTE3 (MTE Asymmetric Fault Handling)

+- FEAT_MTE_ASYM_FAULT (Memory tagging asymmetric faults)

- FEAT_NMI (Non-maskable Interrupt)

- FEAT_NV (Nested Virtualization)

- FEAT_NV2 (Enhanced nested virtualization support)

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_PAuth (Pointer authentication)

- FEAT_PAuth2 (Enhancements to pointer authentication)

- FEAT_PMULL (PMULL, PMULL2 instructions)

+- FEAT_PMUv3 (PMU extension version 3)

- FEAT_PMUv3p1 (PMU Extensions v3.1)

- FEAT_PMUv3p4 (PMU Extensions v3.4)

- FEAT_PMUv3p5 (PMU Extensions v3.5)

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_SME_FA64 (Full A64 instruction set in Streaming SVE mode)

- FEAT_SME_F64F64 (Double-precision floating-point outer product instructions)

- FEAT_SME_I16I64 (16-bit to 64-bit integer widening outer product instructions)

+- FEAT_SVE (Scalable Vector Extension)

+- FEAT_SVE_AES (Scalable Vector AES instructions)

+- FEAT_SVE_BitPerm (Scalable Vector Bit Permutes instructions)

+- FEAT_SVE_PMULL128 (Scalable Vector PMULL instructions)

+- FEAT_SVE_SHA3 (Scalable Vector SHA3 instructions)

+- FEAT_SVE_SM4 (Scalable Vector SM4 instructions)

+- FEAT_SVE2 (Scalable Vector Extension version 2)

- FEAT_SPECRES (Speculation restriction instructions)

- FEAT_SSBS (Speculative Store Bypass Safe)

+- FEAT_TGran16K (Support for 16KB memory translation granule size at stage 1)

+- FEAT_TGran4K (Support for 4KB memory translation granule size at stage 1)

+- FEAT_TGran64K (Support for 64KB memory translation granule size at stage 1)

- FEAT_TIDCP1 (EL0 use of IMPLEMENTATION DEFINED functionality)

- FEAT_TLBIOS (TLB invalidate instructions in Outer Shareable domain)

- FEAT_TLBIRANGE (TLB invalidate range instructions)

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_VHE (Virtualization Host Extensions)

- FEAT_VMID16 (16-bit VMID)

- FEAT_XNX (Translation table stage 2 Unprivileged Execute-never)

-- SVE (The Scalable Vector Extension)

-- SVE2 (The Scalable Vector Extension v2)

For information on the specifics of these extensions, please refer

to the `Armv8-A Arm Architecture Reference Manual

--

2.34.1

FEAT_CSV2_3 adds a mechanism to identify if hardware cannot disclose

information about whether branch targets and branch history trained

in one hardware described context can control speculative execution

in a different hardware context.

There is no branch prediction in TCG, so we don't need to do anything

to be compliant with this. Upadte the '-cpu max' ID registers to

advertise the feature.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240418152004.2106516-3-peter.maydell@linaro.org

---

docs/system/arm/emulation.rst | 1 +

target/arm/tcg/cpu64.c | 4 ++--

2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/emulation.rst

+++ b/docs/system/arm/emulation.rst

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)

- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)

- FEAT_CSV2_2 (Cache speculation variant 2, version 2)

+- FEAT_CSV2_3 (Cache speculation variant 2, version 3)

- FEAT_CSV3 (Cache speculation variant 3)

- FEAT_DGH (Data gathering hint)

- FEAT_DIT (Data Independent Timing instructions)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/cpu64.c

+++ b/target/arm/tcg/cpu64.c

@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);

t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1); /* FEAT_SEL2 */

t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1); /* FEAT_DIT */

- t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 2); /* FEAT_CSV2_2 */

+ t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 3); /* FEAT_CSV2_3 */

t = FIELD_DP64(t, ID_AA64PFR0, CSV3, 1); /* FEAT_CSV3 */

cpu->isar.id_aa64pfr0 = t;

@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3); /* FEAT_MTE3 */

t = FIELD_DP64(t, ID_AA64PFR1, RAS_FRAC, 0); /* FEAT_RASv1p1 + FEAT_DoubleFault */

t = FIELD_DP64(t, ID_AA64PFR1, SME, 1); /* FEAT_SME */

- t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_2 */

+ t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_3 */

t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1); /* FEAT_NMI */

cpu->isar.id_aa64pfr1 = t;

--

2.34.1

FEAT_ETS2 is a tighter set of guarantees about memory ordering

involving translation table walks than the old FEAT_ETS; FEAT_ETS has

been retired from the Arm ARM and the old ID_AA64MMFR1.ETS == 1

now gives no greater guarantees than ETS == 0.

FEAT_ETS2 requires:

* the virtual address of a load or store that appears in program

order after a DSB cannot be translated until after the DSB

completes (section B2.10.9)

* TLB maintenance operations that only affect translations without

execute permission are guaranteed complete after a DSB

(R_BLDZX)

* if a memory access RW2 is ordered-before memory access RW2,

then RW1 is also ordered-before any translation table walk

generated by RW2 that generates a Translation, Address size

or Access flag fault (R_NNFPF, I_CLGHP)

As with FEAT_ETS, QEMU is already compliant, because we do not

reorder translation table walk memory accesses relative to other

memory accesses, and we always guarantee to have finished TLB

maintenance as soon as the TLB op is done.

Update the documentation to list FEAT_ETS2 instead of the

no-longer-existent FEAT_ETS, and update the 'max' CPU ID registers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240418152004.2106516-4-peter.maydell@linaro.org

---

docs/system/arm/emulation.rst | 2 +-

target/arm/tcg/cpu32.c | 2 +-

target/arm/tcg/cpu64.c | 2 +-

3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/emulation.rst

+++ b/docs/system/arm/emulation.rst

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_EL2 (Support for execution at EL2)

- FEAT_EL3 (Support for execution at EL3)

- FEAT_EPAC (Enhanced pointer authentication)

-- FEAT_ETS (Enhanced Translation Synchronization)

+- FEAT_ETS2 (Enhanced Translation Synchronization)

- FEAT_EVT (Enhanced Virtualization Traps)

- FEAT_F32MM (Single-precision Matrix Multiplication)

- FEAT_F64MM (Double-precision Matrix Multiplication)

diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/cpu32.c

+++ b/target/arm/tcg/cpu32.c

@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)

cpu->isar.id_mmfr4 = t;

t = cpu->isar.id_mmfr5;

- t = FIELD_DP32(t, ID_MMFR5, ETS, 1); /* FEAT_ETS */

+ t = FIELD_DP32(t, ID_MMFR5, ETS, 2); /* FEAT_ETS2 */

cpu->isar.id_mmfr5 = t;

t = cpu->isar.id_pfr0;

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/cpu64.c

+++ b/target/arm/tcg/cpu64.c

@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1); /* FEAT_LOR */

t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 3); /* FEAT_PAN3 */

t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* FEAT_XNX */

- t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 1); /* FEAT_ETS */

+ t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 2); /* FEAT_ETS2 */

t = FIELD_DP64(t, ID_AA64MMFR1, HCX, 1); /* FEAT_HCX */

t = FIELD_DP64(t, ID_AA64MMFR1, TIDCP1, 1); /* FEAT_TIDCP1 */

cpu->isar.id_aa64mmfr1 = t;

--

2.34.1

Newer versions of the Arm ARM (e.g. rev K.a) now define fields for

ID_AA64MMFR3_EL1. Implement this register, so that we can set the

fields if we need to. There's no behaviour change here since we

don't currently set the register value to non-zero.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240418152004.2106516-5-peter.maydell@linaro.org

---

target/arm/cpu.h | 17 +++++++++++++++++

target/arm/helper.c | 6 ++++--

target/arm/hvf/hvf.c | 2 ++

target/arm/kvm.c | 2 ++

4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ struct ArchCPU {

uint64_t id_aa64mmfr0;

uint64_t id_aa64mmfr1;

uint64_t id_aa64mmfr2;

+ uint64_t id_aa64mmfr3;

uint64_t id_aa64dfr0;

uint64_t id_aa64dfr1;

uint64_t id_aa64zfr0;

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR2, BBM, 52, 4)

FIELD(ID_AA64MMFR2, EVT, 56, 4)

FIELD(ID_AA64MMFR2, E0PD, 60, 4)

+FIELD(ID_AA64MMFR3, TCRX, 0, 4)

+FIELD(ID_AA64MMFR3, SCTLRX, 4, 4)

+FIELD(ID_AA64MMFR3, S1PIE, 8, 4)

+FIELD(ID_AA64MMFR3, S2PIE, 12, 4)

+FIELD(ID_AA64MMFR3, S1POE, 16, 4)

+FIELD(ID_AA64MMFR3, S2POE, 20, 4)

+FIELD(ID_AA64MMFR3, AIE, 24, 4)

+FIELD(ID_AA64MMFR3, MEC, 28, 4)

+FIELD(ID_AA64MMFR3, D128, 32, 4)

+FIELD(ID_AA64MMFR3, D128_2, 36, 4)

+FIELD(ID_AA64MMFR3, SNERR, 40, 4)

+FIELD(ID_AA64MMFR3, ANERR, 44, 4)

+FIELD(ID_AA64MMFR3, SDERR, 52, 4)

+FIELD(ID_AA64MMFR3, ADERR, 56, 4)

+FIELD(ID_AA64MMFR3, SPEC_FPACC, 60, 4)

+

FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)

FIELD(ID_AA64DFR0, TRACEVER, 4, 4)

FIELD(ID_AA64DFR0, PMUVER, 8, 4)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

.access = PL1_R, .type = ARM_CP_CONST,

.accessfn = access_aa64_tid3,

.resetvalue = cpu->isar.id_aa64mmfr2 },

- { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

+ { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,

.access = PL1_R, .type = ARM_CP_CONST,

.accessfn = access_aa64_tid3,

- .resetvalue = 0 },

+ .resetvalue = cpu->isar.id_aa64mmfr3 },

{ .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,

.access = PL1_R, .type = ARM_CP_CONST,

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

.exported_bits = R_ID_AA64MMFR1_AFP_MASK },

{ .name = "ID_AA64MMFR2_EL1",

.exported_bits = R_ID_AA64MMFR2_AT_MASK },

+ { .name = "ID_AA64MMFR3_EL1",

+ .exported_bits = 0 },

{ .name = "ID_AA64MMFR*_EL1_RESERVED",

.is_glob = true },

{ .name = "ID_AA64DFR0_EL1",

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/hvf/hvf.c

+++ b/target/arm/hvf/hvf.c

@@ -XXX,XX +XXX,XX @@ static struct hvf_sreg_match hvf_sreg_match[] = {

#endif

{ HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) },

{ HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) },

+ /* Add ID_AA64MMFR3_EL1 here when HVF supports it */

{ HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) },

{ HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) },

@@ -XXX,XX +XXX,XX @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)

{ HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },

{ HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },

{ HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 },

+ /* Add ID_AA64MMFR3_EL1 here when HVF supports it */

};

hv_vcpu_t fd;

hv_return_t r = HV_SUCCESS;

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)

ARM64_SYS_REG(3, 0, 0, 7, 1));

err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,

ARM64_SYS_REG(3, 0, 0, 7, 2));

+ err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr3,

+ ARM64_SYS_REG(3, 0, 0, 7, 3));

/*

* Note that if AArch32 support is not present in the host,

--

2.34.1

FEAT_Spec_FPACC is a feature describing speculative behaviour in the

event of a PAC authontication failure when FEAT_FPACCOMBINE is

implemented. FEAT_Spec_FPACC means that the speculative use of

pointers processed by a PAC Authentication is not materially

different in terms of the impact on cached microarchitectural state

(caches, TLBs, etc) between passing and failing of the PAC

Authentication.

QEMU doesn't do speculative execution, so we can advertise

this feature.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240418152004.2106516-6-peter.maydell@linaro.org

---

docs/system/arm/emulation.rst | 1 +

target/arm/tcg/cpu64.c | 4 ++++

2 files changed, 5 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/emulation.rst

+++ b/docs/system/arm/emulation.rst

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_FP16 (Half-precision floating-point data processing)

- FEAT_FPAC (Faulting on AUT* instructions)

- FEAT_FPACCOMBINE (Faulting on combined pointer authentication instructions)

+- FEAT_FPACC_SPEC (Speculative behavior of combined pointer authentication instructions)

- FEAT_FRINTTS (Floating-point to integer instructions)

- FEAT_FlagM (Flag manipulation instructions v2)

- FEAT_FlagM2 (Enhancements to flag manipulation instructions)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/cpu64.c

+++ b/target/arm/tcg/cpu64.c

@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1); /* FEAT_E0PD */

cpu->isar.id_aa64mmfr2 = t;

+ t = cpu->isar.id_aa64mmfr3;

+ t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */

+ cpu->isar.id_aa64mmfr3 = t;

+

t = cpu->isar.id_aa64zfr0;

t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);

t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2); /* FEAT_SVE_PMULL128 */

--

2.34.1

The Linux kernel 5.10.16 binary for sunxi has been removed from

apt.armbian.com. This means that the avocado tests for these machines

will be skipped (status CANCEL) if the old binary isn't present in

the avocado cache.

Update to 6.6.16, in the same way we did in commit e384db41d8661

when we moved to 5.10.16 in 2021.

Cc: qemu-stable@nongnu.org

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2284

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>

Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Message-id: 20240415151845.1564201-1-peter.maydell@linaro.org

---

tests/avocado/boot_linux_console.py | 70 ++++++++++++++---------------

tests/avocado/replay_kernel.py | 8 ++--

2 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py

index XXXXXXX..XXXXXXX 100644

--- a/tests/avocado/boot_linux_console.py

+++ b/tests/avocado/boot_linux_console.py

@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):

:avocado: tags=accel:tcg

"""

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

initrd_url = ('https://github.com/groeck/linux-build-test/raw/'

'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'

@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_sata(self):

:avocado: tags=accel:tcg

"""

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'

'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'

@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u(self):

:avocado: tags=machine:bpim2u

:avocado: tags=accel:tcg

"""

- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'

- 'linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ deb_url = ('https://apt.armbian.com/pool/main/l/'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = ('/usr/lib/linux-image-current-sunxi/'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'

'sun8i-r40-bananapi-m2-ultra.dtb')

dtb_path = self.extract_from_deb(deb_path, dtb_path)

@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u_initrd(self):

:avocado: tags=accel:tcg

:avocado: tags=machine:bpim2u

"""

- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'

- 'linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ deb_url = ('https://apt.armbian.com/pool/main/l/'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = ('/usr/lib/linux-image-current-sunxi/'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'

'sun8i-r40-bananapi-m2-ultra.dtb')

dtb_path = self.extract_from_deb(deb_path, dtb_path)

initrd_url = ('https://github.com/groeck/linux-build-test/raw/'

@@ -XXX,XX +XXX,XX @@ def test_arm_bpim2u_gmac(self):

"""

self.require_netdev('user')

- deb_url = ('https://apt.armbian.com/pool/main/l/linux-5.10.16-sunxi/'

- 'linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ deb_url = ('https://apt.armbian.com/pool/main/l/'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = ('/usr/lib/linux-image-current-sunxi/'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = ('/usr/lib/linux-image-6.6.16-current-sunxi/'

'sun8i-r40-bananapi-m2-ultra.dtb')

dtb_path = self.extract_from_deb(deb_path, dtb_path)

rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'

@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi(self):

:avocado: tags=accel:tcg

"""

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

self.vm.set_console()

@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_initrd(self):

:avocado: tags=machine:orangepi-pc

"""

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

initrd_url = ('https://github.com/groeck/linux-build-test/raw/'

'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'

@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_sd(self):

self.require_netdev('user')

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun8i-h3-orangepi-pc.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun8i-h3-orangepi-pc.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'

'buildroot-baseline/20221116.0/armel/rootfs.ext2.xz')

diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py

index XXXXXXX..XXXXXXX 100644

--- a/tests/avocado/replay_kernel.py

+++ b/tests/avocado/replay_kernel.py

@@ -XXX,XX +XXX,XX @@ def test_arm_cubieboard_initrd(self):

:avocado: tags=machine:cubieboard

"""

deb_url = ('https://apt.armbian.com/pool/main/l/'

- 'linux-5.10.16-sunxi/linux-image-current-sunxi_21.02.2_armhf.deb')

- deb_hash = '9fa84beda245cabf0b4fa84cf6eaa7738ead1da0'

+ 'linux-6.6.16/linux-image-current-sunxi_24.2.1_armhf__6.6.16-Seb3e-D6b4a-P2359-Ce96bHfe66-HK01ba-V014b-B067e-R448a.deb')

+ deb_hash = 'f7c3c8c5432f765445dc6e7eab02f3bbe668256b'

deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)

kernel_path = self.extract_from_deb(deb_path,

- '/boot/vmlinuz-5.10.16-sunxi')

- dtb_path = '/usr/lib/linux-image-current-sunxi/sun4i-a10-cubieboard.dtb'

+ '/boot/vmlinuz-6.6.16-current-sunxi')

+ dtb_path = '/usr/lib/linux-image-6.6.16-current-sunxi/sun4i-a10-cubieboard.dtb'

dtb_path = self.extract_from_deb(deb_path, dtb_path)

initrd_url = ('https://github.com/groeck/linux-build-test/raw/'

'2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'

--

2.34.1

The generic timer frequency is settable by board code via a QOM

property "cntfrq", but otherwise defaults to 62.5MHz. The way this

is done includes some complication resulting from how this was

originally a fixed value with no QOM property. Clean it up:

* always set cpu->gt_cntfrq_hz to some sensible value, whether

the CPU has the generic timer or not, and whether it's system

or user-only emulation

* this means we can always use gt_cntfrq_hz, and never need

the old GTIMER_SCALE define

* set the default value in exactly one place, in the realize fn

The aim here is to pave the way for handling the ARMv8.6 requirement

that the generic timer frequency is always 1GHz. We're going to do

that by having old CPU types keep their legacy-in-QEMU behaviour and

having the default for any new CPU types be a 1GHz rather han 62.5MHz

cntfrq, so we want the point where the default is decided to be in

one place, and in code, not in a DEFINE_PROP_UINT64() initializer.

This commit should have no behavioural changes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20240426122913.3427983-2-peter.maydell@linaro.org

---

target/arm/internals.h | 7 ++++---

target/arm/cpu.c | 31 +++++++++++++++++--------------

target/arm/helper.c | 16 ++++++++--------

3 files changed, 29 insertions(+), 25 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)

|| excp == EXCP_SEMIHOST;

}

-/* Scale factor for generic timers, ie number of ns per tick.

- * This gives a 62.5MHz timer.

+/*

+ * Default frequency for the generic timer, in Hz.

+ * This is 62.5MHz, which gives a 16 ns tick period.

*/

-#define GTIMER_SCALE 16

+#define GTIMER_DEFAULT_HZ 62500000

/* Bit definitions for the v7M CONTROL register */

FIELD(V7M_CONTROL, NPRIV, 0, 1)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)

}

}

+/*

+ * 0 means "unset, use the default value". That default might vary depending

+ * on the CPU type, and is set in the realize fn.

+ */

static Property arm_cpu_gt_cntfrq_property =

- DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,

- NANOSECONDS_PER_SECOND / GTIMER_SCALE);

+ DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz, 0);

static Property arm_cpu_reset_cbar_property =

DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

return;

}

+ if (!cpu->gt_cntfrq_hz) {

+ /*

+ * 0 means "the board didn't set a value, use the default".

+ * The default value of the generic timer frequency (as seen in

+ * CNTFRQ_EL0) is 62.5MHz, which corresponds to a period of 16ns.

+ * This is what you get (a) for a CONFIG_USER_ONLY CPU (b) if the

+ * board doesn't set it.

+ */

+ cpu->gt_cntfrq_hz = GTIMER_DEFAULT_HZ;

+ }

+

#ifndef CONFIG_USER_ONLY

/* The NVIC and M-profile CPU are two halves of a single piece of

* hardware; trying to use one without the other is a command line

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

}

{

- uint64_t scale;

-

- if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {

- if (!cpu->gt_cntfrq_hz) {

- error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",

- cpu->gt_cntfrq_hz);

- return;

- }

- scale = gt_cntfrq_period_ns(cpu);

- } else {

- scale = GTIMER_SCALE;

- }

+ uint64_t scale = gt_cntfrq_period_ns(cpu);

cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,

arm_gt_ptimer_cb, cpu);

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {

.resetvalue = 0 },

};

+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)

+{

+ ARMCPU *cpu = env_archcpu(env);

+

+ cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;

+}

+

#ifndef CONFIG_USER_ONLY

static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ void arm_gt_hvtimer_cb(void *opaque)

gt_recalc_timer(cpu, GTIMER_HYPVIRT);

}

-static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)

-{

- ARMCPU *cpu = env_archcpu(env);

-

- cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;

-}

-

static const ARMCPRegInfo generic_timer_cp_reginfo[] = {

/*

* Note that CNTFRQ is purely reads-as-written for the benefit

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {

.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,

.type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,

.fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),

- .resetvalue = NANOSECONDS_PER_SECOND / GTIMER_SCALE,

+ .resetfn = arm_gt_cntfrq_reset,

},

{ .name = "CNTVCT_EL0", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 2,

--

2.34.1

Currently QEMU CPUs always run with a generic timer counter frequency

of 62.5MHz, but ARMv8.6 CPUs will run at 1GHz. For older versions of

the TF-A firmware that sbsa-ref runs, the frequency of the generic

timer is hardcoded into the firmware, and so if the CPU actually has

a different frequency then timers in the guest will be set

incorrectly.

The default frequency used by the 'max' CPU is about to change, so

make the sbsa-ref board force the CPU frequency to the value which

the firmware expects.

Newer versions of TF-A will read the frequency from the CPU's

CNTFRQ_EL0 register:

https://github.com/ARM-software/arm-trusted-firmware/commit/4c77fac98dac0bebc63798aae9101ac865b87148

so in the longer term we could make this board use the 1GHz

frequency. We will need to make sure we update the binaries used

by our avocado test

Aarch64SbsarefMachine.test_sbsaref_alpine_linux_max_pauth_impdef

before we can do that.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Message-id: 20240426122913.3427983-3-peter.maydell@linaro.org

---

hw/arm/sbsa-ref.c | 15 +++++++++++++++

1 file changed, 15 insertions(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@

#define NUM_SMMU_IRQS 4

#define NUM_SATA_PORTS 6

+/*

+ * Generic timer frequency in Hz (which drives both the CPU generic timers

+ * and the SBSA watchdog-timer). Older versions of the TF-A firmware

+ * typically used with sbsa-ref (including the binaries in our Avocado test

+ * Aarch64SbsarefMachine.test_sbsaref_alpine_linux_max_pauth_impdef

+ * assume it is this value.

+ *

+ * TODO: this value is not architecturally correct for an Armv8.6 or

+ * better CPU, so we should move to 1GHz once the TF-A fix above has

+ * made it into a release and into our Avocado test.

+ */

+#define SBSA_GTIMER_HZ 62500000

+

enum {

SBSA_FLASH,

SBSA_MEM,

@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)

&error_abort);

}

+ object_property_set_int(cpuobj, "cntfrq", SBSA_GTIMER_HZ, &error_abort);

+

object_property_set_link(cpuobj, "memory", OBJECT(sysmem),

&error_abort);

--

2.34.1

Currently the sbsa_gdwt watchdog device hardcodes its frequency at

62.5MHz. In real hardware, this watchdog is supposed to be driven

from the system counter, which also drives the CPU generic timers.

Newer CPU types (in particular from Armv8.6) should have a CPU

generic timer frequency of 1GHz, so we can't leave the watchdog

on the old QEMU default of 62.5GHz.

Make the frequency a QOM property so it can be set by the board,

and have our only board that uses this device set that frequency

to the same value it sets the CPU frequency.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240426122913.3427983-4-peter.maydell@linaro.org

---

include/hw/watchdog/sbsa_gwdt.h | 3 +--

hw/arm/sbsa-ref.c | 1 +

hw/watchdog/sbsa_gwdt.c | 15 ++++++++++++++-

3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/include/hw/watchdog/sbsa_gwdt.h b/include/hw/watchdog/sbsa_gwdt.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/watchdog/sbsa_gwdt.h

+++ b/include/hw/watchdog/sbsa_gwdt.h

@@ -XXX,XX +XXX,XX @@

#define SBSA_GWDT_RMMIO_SIZE 0x1000

#define SBSA_GWDT_CMMIO_SIZE 0x1000

-#define SBSA_TIMER_FREQ 62500000 /* Hz */

-

typedef struct SBSA_GWDTState {

/* <private> */

SysBusDevice parent_obj;

@@ -XXX,XX +XXX,XX @@ typedef struct SBSA_GWDTState {

qemu_irq irq;

QEMUTimer *timer;

+ uint64_t freq;

uint32_t id;

uint32_t wcs;

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static void create_wdt(const SBSAMachineState *sms)

SysBusDevice *s = SYS_BUS_DEVICE(dev);

int irq = sbsa_ref_irqmap[SBSA_GWDT_WS0];

+ qdev_prop_set_uint64(dev, "clock-frequency", SBSA_GTIMER_HZ);

sysbus_realize_and_unref(s, &error_fatal);

sysbus_mmio_map(s, 0, rbase);

sysbus_mmio_map(s, 1, cbase);

diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/watchdog/sbsa_gwdt.c

+++ b/hw/watchdog/sbsa_gwdt.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "sysemu/reset.h"

#include "sysemu/watchdog.h"

+#include "hw/qdev-properties.h"

#include "hw/watchdog/sbsa_gwdt.h"

#include "qemu/timer.h"

#include "migration/vmstate.h"

@@ -XXX,XX +XXX,XX @@ static void sbsa_gwdt_update_timer(SBSA_GWDTState *s, WdtRefreshType rtype)

timeout = s->woru;

timeout <<= 32;

timeout |= s->worl;

- timeout = muldiv64(timeout, NANOSECONDS_PER_SECOND, SBSA_TIMER_FREQ);

+ timeout = muldiv64(timeout, NANOSECONDS_PER_SECOND, s->freq);

timeout += qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);

if ((rtype == EXPLICIT_REFRESH) || ((rtype == TIMEOUT_REFRESH) &&

@@ -XXX,XX +XXX,XX @@ static void wdt_sbsa_gwdt_realize(DeviceState *dev, Error **errp)

dev);

}

+static Property wdt_sbsa_gwdt_props[] = {

+ /*

+ * Timer frequency in Hz. This must match the frequency used by

+ * the CPU's generic timer. Default 62.5Hz matches QEMU's legacy

+ * CPU timer frequency default.

+ */

+ DEFINE_PROP_UINT64("clock-frequency", struct SBSA_GWDTState, freq,

+ 62500000),

+ DEFINE_PROP_END_OF_LIST(),

+};

+

static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, void *data)

{

DeviceClass *dc = DEVICE_CLASS(klass);

@@ -XXX,XX +XXX,XX @@ static void wdt_sbsa_gwdt_class_init(ObjectClass *klass, void *data)

set_bit(DEVICE_CATEGORY_WATCHDOG, dc->categories);

dc->vmsd = &vmstate_sbsa_gwdt;

dc->desc = "SBSA-compliant generic watchdog device";

+ device_class_set_props(dc, wdt_sbsa_gwdt_props);

}

static const TypeInfo wdt_sbsa_gwdt_info = {

--

2.34.1