target-arm queue for 3.1: mostly bug fixes, but the "turn on

EL2 support for Cortex-A7 and -A15" is technically enabling

of a new feature... I think this is OK since we're only at rc1,

and it's easy to revert that feature bit flip if necessary.

The following changes since commit 5704c36d25ee84e7129722cb0db53df9faefe943:

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging (2018-11-12 15:55:40 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181112

for you to fetch changes up to 1a4c1a6dbf60aebddd07753f1013ea896c06ad29:

target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature (2018-11-12 16:52:29 +0000)

target/arm queue:

* Remove no-longer-needed workaround for small SAU regions for v8M

* Remove antique TODO comment

* MAINTAINERS: Add an entry for the 'collie' machine

* hw/arm/sysbus-fdt: Only call match_fn callback if the type matches

* Fix infinite recursion in tlbi_aa64_vmalle1_write()

* ARM KVM: fix various bugs in handling of guest debugging

* Correctly implement handling of HCR_EL2.{VI, VF}

* Hyp mode R14 is shared with User and System

* Give Cortex-A15 and -A7 the EL2 feature

Alex Bennée (6):

target/arm64: properly handle DBGVR RESS bits

target/arm64: hold BQL when calling do_interrupt()

target/arm64: kvm debug set target_el when passing exception to guest

tests/guest-debug: fix scoping of failcount

arm: use symbolic MDCR_TDE in arm_debug_target_el

arm: fix aa64_generate_debug_exceptions to work with EL2

Eric Auger (1):

hw/arm/sysbus-fdt: Only call match_fn callback if the type matches

Peter Maydell (7):

target/arm: Remove workaround for small SAU regions

target/arm: Remove antique TODO comment

Revert "target/arm: Implement HCR.VI and VF"

target/arm: Track the state of our irq lines from the GIC explicitly

target/arm: Correctly implement handling of HCR_EL2.{VI, VF}

target/arm: Hyp mode R14 is shared with User and System

target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature

Richard Henderson (1):

target/arm: Fix typo in tlbi_aa64_vmalle1_write

Thomas Huth (1):

MAINTAINERS: Add an entry for the 'collie' machine

target/arm/cpu.h | 44 +++++++++++------

target/arm/internals.h | 34 +++++++++++++

hw/arm/sysbus-fdt.c | 12 +++--

target/arm/cpu.c | 66 ++++++++++++++++++++++++-

target/arm/helper.c | 101 +++++++++++++-------------------------

target/arm/kvm32.c | 4 +-

target/arm/kvm64.c | 20 +++++++-

target/arm/machine.c | 51 +++++++++++++++++++

target/arm/op_helper.c | 4 +-

MAINTAINERS | 7 +++

tests/guest-debug/test-gdbstub.py | 1 +

11 files changed, 248 insertions(+), 96 deletions(-)

From: Alex Bennée <alex.bennee@linaro.org>

You should declare you are using a global version of a variable before

you attempt to modify it in a function.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20181109152119.9242-5-alex.bennee@linaro.org

tests/guest-debug/test-gdbstub.py | 1 +

diff --git a/tests/guest-debug/test-gdbstub.py b/tests/guest-debug/test-gdbstub.py

--- a/tests/guest-debug/test-gdbstub.py

+++ b/tests/guest-debug/test-gdbstub.py

@@ -XXX,XX +XXX,XX @@ def report(cond, msg):

print ("PASS: %s" % (msg))

else:

print ("FAIL: %s" % (msg))

+ global failcount

failcount += 1

2.19.1

Hyp mode is an exception to the general rule that each AArch32

mode has its own r13, r14 and SPSR -- it has a banked r13 and

SPSR but shares its r14 with User and System mode. We were

incorrectly implementing it as banked, which meant that on

entry to Hyp mode r14 was 0 rather than the USR/SYS r14.

We provide a new function r14_bank_number() which is like

the existing bank_number() but provides the index into

env->banked_r14[]; bank_number() provides the index to use

for env->banked_r13[] and env->banked_cpsr[].

All the points in the code that were using bank_number()

to index into env->banked_r14[] are updated for consintency:

* switch_mode() -- this is the only place where we fix

an actual bug

* aarch64_sync_32_to_64() and aarch64_sync_64_to_32():

no behavioural change as we already special-cased Hyp R14

* kvm32.c: no behavioural change since the guest can't ever

be in Hyp mode, but conceptually the right thing to do

* msr_banked()/mrs_banked(): we can never get to the case

that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,

so no behavioural change

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20181109173553.22341-2-peter.maydell@linaro.org

---

target/arm/internals.h | 16 ++++++++++++++++

target/arm/helper.c | 29 +++++++++++++++--------------

target/arm/kvm32.c | 4 ++--

target/arm/op_helper.c | 4 ++--

4 files changed, 35 insertions(+), 18 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ static inline int bank_number(int mode)

g_assert_not_reached();

+/**

+ * r14_bank_number: Map CPU mode onto register bank for r14

+ *

+ * Given an AArch32 CPU mode, return the index into the saved register

+ * banks to use for the R14 (LR) in that mode. This is the same as

+ * bank_number(), except for the special case of Hyp mode, where

+ * R14 is shared with USR and SYS, unlike its R13 and SPSR.

+ * This should be used as the index into env->banked_r14[], and

+ * bank_number() used for the index into env->banked_r13[] and

+ * env->banked_spsr[].

+ */

+static inline int r14_bank_number(int mode)

+{

+ return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);

+}

+

void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);

void arm_translate_init(void);

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void switch_mode(CPUARMState *env, int mode)

i = bank_number(old_mode);

env->banked_r13[i] = env->regs[13];

- env->banked_r14[i] = env->regs[14];

env->banked_spsr[i] = env->spsr;

i = bank_number(mode);

env->regs[13] = env->banked_r13[i];

- env->regs[14] = env->banked_r14[i];

env->spsr = env->banked_spsr[i];

+

+ env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];

+ env->regs[14] = env->banked_r14[r14_bank_number(mode)];

/* Physical Interrupt Target EL Lookup Table

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

if (mode == ARM_CPU_MODE_HYP) {

env->xregs[14] = env->regs[14];

} else {

- env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];

+ env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

env->xregs[16] = env->regs[14];

env->xregs[17] = env->regs[13];

} else {

- env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];

+ env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];

env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

env->xregs[18] = env->regs[14];

env->xregs[19] = env->regs[13];

} else {

- env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];

+ env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];

env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

env->xregs[20] = env->regs[14];

env->xregs[21] = env->regs[13];

} else {

- env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];

+ env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];

env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

env->xregs[22] = env->regs[14];

env->xregs[23] = env->regs[13];

} else {

- env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];

+ env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];

env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)

env->xregs[i] = env->fiq_regs[i - 24];

}

env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];

- env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];

+ env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];

}

env->pc = env->regs[15];

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

if (mode == ARM_CPU_MODE_HYP) {

env->regs[14] = env->xregs[14];

} else {

- env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];

}

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

env->regs[14] = env->xregs[16];

env->regs[13] = env->xregs[17];

} else {

- env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];

env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

env->regs[14] = env->xregs[18];

env->regs[13] = env->xregs[19];

} else {

- env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];

env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

env->regs[14] = env->xregs[20];

env->regs[13] = env->xregs[21];

} else {

- env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];

env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

env->regs[14] = env->xregs[22];

env->regs[13] = env->xregs[23];

} else {

- env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];

env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];

}

@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)

env->fiq_regs[i - 24] = env->xregs[i];

}

env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];

- env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];

+ env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];

}

env->regs[15] = env->pc;

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm32.c

+++ b/target/arm/kvm32.c

@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)

memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));

}

env->banked_r13[bn] = env->regs[13];

- env->banked_r14[bn] = env->regs[14];

env->banked_spsr[bn] = env->spsr;

+ env->banked_r14[r14_bank_number(mode)] = env->regs[14];

/* Now we can safely copy stuff down to the kernel */

for (i = 0; i < ARRAY_SIZE(regs); i++) {

@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)

memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));

}

env->regs[13] = env->banked_r13[bn];

- env->regs[14] = env->banked_r14[bn];

env->spsr = env->banked_spsr[bn];

+ env->regs[14] = env->banked_r14[r14_bank_number(mode)];

/* VFP registers */

r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,

env->banked_r13[bank_number(tgtmode)] = value;

break;

case 14:

- env->banked_r14[bank_number(tgtmode)] = value;

+ env->banked_r14[r14_bank_number(tgtmode)] = value;

break;

case 8 ... 12:

switch (tgtmode) {

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)

case 13:

return env->banked_r13[bank_number(tgtmode)];

case 14:

- return env->banked_r14[bank_number(tgtmode)];

+ return env->banked_r14[r14_bank_number(tgtmode)];

case 8 ... 12:

switch (tgtmode) {

case ARM_CPU_MODE_USR:

2.19.1

Before we supported direct execution from MMIO regions, we

implemented workarounds in commit 720424359917887c926a33d2

which let us avoid doing so, even if the SAU or MPU region

was less than page-sized.

Once we implemented execute-from-MMIO, we removed part

of those workarounds in commit d4b6275df320cee76; but

we forgot the one in get_phys_addr_pmsav8() which

suppressed use of small SAU regions in executable regions.

Remove that workaround now.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20181106163801.14474-1-peter.maydell@linaro.org

target/arm/helper.c | 12 ------------

1 file changed, 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,

ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,

txattrs, prot, &mpu_is_subpage, fi, NULL);

- /*

- * TODO: this is a temporary hack to ignore the fact that the SAU region

- * is smaller than a page if this is an executable region. We never

- * supported small MPU regions, but we did (accidentally) allow small

- * SAU regions, and if we now made small SAU regions not be executable

- * then this would break previously working guest code. We can't

- * remove this until/unless we implement support for execution from

- * small regions.

- */

- if (*prot & PAGE_EXEC) {

- sattrs.subpage = false;

- }

*page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;

return ret;

}

2.19.1

The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented

it properly we can enable the feature bit.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20181109173553.22341-3-peter.maydell@linaro.org

target/arm/cpu.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);

set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);

set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);

+ set_feature(&cpu->env, ARM_FEATURE_EL2);

set_feature(&cpu->env, ARM_FEATURE_EL3);

cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A7;

cpu->midr = 0x410fc075;

@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);

set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);

set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);

+ set_feature(&cpu->env, ARM_FEATURE_EL2);

set_feature(&cpu->env, ARM_FEATURE_EL3);

cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A15;

cpu->midr = 0x412fc0f1;

2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

This would cause an infinite recursion or loop.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20181110121711.15257-1-richard.henderson@linaro.org

target/arm/helper.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,

CPUState *cs = ENV_GET_CPU(env);

if (tlb_force_broadcast(env)) {

- tlbi_aa64_vmalle1_write(env, NULL, value);

+ tlbi_aa64_vmalle1is_write(env, NULL, value);

return;

}

2.19.1

From: Alex Bennée <alex.bennee@linaro.org>

Fix the assertion failure when running interrupts.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20181109152119.9242-3-alex.bennee@linaro.org

target/arm/kvm64.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c

--- a/target/arm/kvm64.c

+++ b/target/arm/kvm64.c

@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)

cs->exception_index = EXCP_BKPT;

env->exception.syndrome = debug_exit->hsr;

env->exception.vaddress = debug_exit->far;

+ qemu_mutex_lock_iothread();

cc->do_interrupt(cs);

+ qemu_mutex_unlock_iothread();

return false;

2.19.1

Remove a TODO comment about implementing the vectored interrupt

controller. We have had an implementation of that for a decade;

it's in hw/intc/pl190.c.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20181106164118.16184-1-peter.maydell@linaro.org

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

target/arm/helper.c | 1 -

1 file changed, 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)

return;

}

- /* TODO: Vectored interrupt controller. */

switch (cs->exception_index) {

case EXCP_UDEF:

new_mode = ARM_CPU_MODE_UND;

2.19.1

This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.

The implementation of HCR.VI and VF in that commit is not

correct -- they do not track the overall "is there a pending

VIRQ or VFIQ" status, but whether there is a pending interrupt

due to "this mechanism", ie the hypervisor having set the VI/VF

bits. The overall pending state for VIRQ and VFIQ is effectively

the logical OR of the inbound lines from the GIC with the

VI and VF bits. Commit 8a0fc3a29fc231 would result in pending

VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.

As a preliminary to implementing the HCR.VI/VF feature properly,

revert the broken one entirely.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20181109134731.11605-2-peter.maydell@linaro.org

target/arm/helper.c | 47 ++++-----------------------------------------

1 file changed, 4 insertions(+), 43 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {

static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

{

ARMCPU *cpu = arm_env_get_cpu(env);

- CPUState *cs = ENV_GET_CPU(env);

uint64_t valid_mask = HCR_MASK;

if (arm_feature(env, ARM_FEATURE_EL3)) {

@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

/* Clear RES0 bits. */

value &= valid_mask;

- /*

- * VI and VF are kept in cs->interrupt_request. Modifying that

- * requires that we have the iothread lock, which is done by

- * marking the reginfo structs as ARM_CP_IO.

- * Note that if a write to HCR pends a VIRQ or VFIQ it is never

- * possible for it to be taken immediately, because VIRQ and

- * VFIQ are masked unless running at EL0 or EL1, and HCR

- * can only be written at EL2.

- */

- g_assert(qemu_mutex_iothread_locked());

- if (value & HCR_VI) {

- cs->interrupt_request |= CPU_INTERRUPT_VIRQ;

- } else {

- cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;

- }

- if (value & HCR_VF) {

- cs->interrupt_request |= CPU_INTERRUPT_VFIQ;

- } else {

- cs->interrupt_request &= ~CPU_INTERRUPT_VFIQ;

- }

- value &= ~(HCR_VI | HCR_VF);

-

/* These bits change the MMU setup:

* HCR_VM enables stage 2 translation

* HCR_PTW forbids certain page-table setups

@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,

hcr_write(env, NULL, value);

2.19.1

Currently we track the state of the four irq lines from the GIC

only via the cs->interrupt_request or KVM irq state. That means

that we assume that an interrupt is asserted if and only if the

external line is set. This assumption is incorrect for VIRQ

and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion

of VIRQ and VFIQ separately from the state of the external line.

To handle this, start tracking the state of the external lines

explicitly in a CPU state struct field, as is common practice

for devices.

The complicated part of this is dealing with inbound migration

from an older QEMU which didn't have this state. We assume in

that case that the older QEMU did not implement the HCR_EL2.{VI,VF}

bits as generating interrupts, and so the line state matches

the current state in cs->interrupt_request. (This is not quite

true between commit 8a0fc3a29fc2315325400c7 and its revert, but

that commit is broken and never made it into any released QEMU

version.)

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20181109134731.11605-3-peter.maydell@linaro.org

target/arm/cpu.h | 3 +++

target/arm/cpu.c | 16 ++++++++++++++

target/arm/machine.c | 51 ++++++++++++++++++++++++++++++++++++++++++++

3 files changed, 70 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint64_t esr;

} serror;

+ /* State of our input IRQ/FIQ/VIRQ/VFIQ lines */

+ uint32_t irq_line_state;

/* Thumb-2 EE state. */

uint32_t teecr;

uint32_t teehbr;

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)

[ARM_CPU_VFIQ] = CPU_INTERRUPT_VFIQ

};

+ if (level) {

+ env->irq_line_state |= mask[irq];

+ } else {

+ env->irq_line_state &= ~mask[irq];

+ }

+

switch (irq) {

case ARM_CPU_VIRQ:

case ARM_CPU_VFIQ:

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)

ARMCPU *cpu = opaque;

CPUState *cs = CPU(cpu);

int kvm_irq = KVM_ARM_IRQ_TYPE_CPU << KVM_ARM_IRQ_TYPE_SHIFT;

+ uint32_t linestate_bit;

switch (irq) {

case ARM_CPU_IRQ:

kvm_irq |= KVM_ARM_IRQ_CPU_IRQ;

+ linestate_bit = CPU_INTERRUPT_HARD;

break;

case ARM_CPU_FIQ:

kvm_irq |= KVM_ARM_IRQ_CPU_FIQ;

+ linestate_bit = CPU_INTERRUPT_FIQ;

break;

default:

g_assert_not_reached();

}

+

+ if (level) {

+ env->irq_line_state |= linestate_bit;

+ } else {

+ env->irq_line_state &= ~linestate_bit;

+ }

+

kvm_irq |= cs->cpu_index << KVM_ARM_IRQ_VCPU_SHIFT;

kvm_set_irq(kvm_state, kvm_irq, level ? 1 : 0);

#endif

diff --git a/target/arm/machine.c b/target/arm/machine.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/machine.c

+++ b/target/arm/machine.c

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_serror = {

}

};

+static bool irq_line_state_needed(void *opaque)

+{

+ return true;

+static const VMStateDescription vmstate_irq_line_state = {

+ .name = "cpu/irq-line-state",

+ .needed = irq_line_state_needed,

+ VMSTATE_UINT32(env.irq_line_state, ARMCPU),

static bool m_needed(void *opaque)

{

ARMCPU *cpu = opaque;

@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)

return 0;

}

+static int cpu_pre_load(void *opaque)

+{

+ ARMCPU *cpu = opaque;

+ CPUARMState *env = &cpu->env;

+

+ /*

+ * Pre-initialize irq_line_state to a value that's never valid as

+ * real data, so cpu_post_load() can tell whether we've seen the

+ * irq-line-state subsection in the incoming migration state.

+ */

+ env->irq_line_state = UINT32_MAX;

+

+ return 0;

+}

+

static int cpu_post_load(void *opaque, int version_id)

{

ARMCPU *cpu = opaque;

+ CPUARMState *env = &cpu->env;