The following changes since commit 5767815218efd3cbfd409505ed824d5f356044ae:

Merge tag 'for_upstream' of https://git.kernel.org/pub/scm/virt/kvm/mst/qemu into staging (2024-02-14 15:45:52 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240215

for you to fetch changes up to f780e63fe731b058fe52d43653600d8729a1b5f2:

docs: Add documentation for the mps3-an536 board (2024-02-15 14:32:39 +0000)

* hw/arm/xilinx_zynq: Wire FIQ between CPU <> GIC

* linux-user/aarch64: Choose SYNC as the preferred MTE mode

* Fix some errors in SVE/SME handling of MTE tags

* hw/pci-host/raven.c: Mark raven_io_ops as implementing unaligned accesses

* hw/block/tc58128: Don't emit deprecation warning under qtest

* tests/qtest: Fix handling of npcm7xx and GMAC tests

* hw/arm/virt: Wire up non-secure EL2 virtual timer IRQ

* tests/qtest/npcm7xx_emc-test: Connect all NICs to a backend

* Don't assert on vmload/vmsave of M-profile CPUs

* hw/arm/smmuv3: add support for stage 1 access fault

* hw/arm/stellaris: QOM cleanups

* Use new CBAR encoding for all v8 CPUs, not all aarch64 CPUs

* Improve Cortex_R52 IMPDEF sysreg modelling

* Allow access to SPSR_hyp from hyp mode

* New board model mps3-an536 (Cortex-R52)

Luc Michel (1):

hw/arm/smmuv3: add support for stage 1 access fault

Nabih Estefan (1):

tests/qtest: Fix GMAC test to run on a machine in upstream QEMU

From: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/arm/xilinx_zynq.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c

--- a/hw/arm/xilinx_zynq.c

+++ b/hw/arm/xilinx_zynq.c

@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)

sysbus_mmio_map(busdev, 0, MPCORE_PERIPHBASE);

sysbus_connect_irq(busdev, 0,

qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));

+ sysbus_connect_irq(busdev, 1,

+ qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_FIQ));

for (n = 0; n < 64; n++) {

pic[n] = qdev_get_gpio_in(dev, n);

2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The field is encoded as [0-3], which is convenient for

indexing our array of function pointers, but the true

value is [1-4]. Adjust before calling do_mem_zpa.

Add an assert, and move the comment re passing ZT to

the helper back next to the relevant code.

Cc: qemu-stable@nongnu.org

Fixes: 206adacfb8d ("target/arm: Add mte helpers for sve scalar + int loads")

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Tested-by: Gustavo Romero <gustavo.romero@linaro.org>

Message-id: 20240207025210.8837-3-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/tcg/translate-sve.c | 16 ++++++++--------

1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c

--- a/target/arm/tcg/translate-sve.c

+++ b/target/arm/tcg/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

TCGv_ptr t_pg;

int desc = 0;

- /*

- * For e.g. LD4, there are not enough arguments to pass all 4

- * registers as pointers, so encode the regno into the data field.

- * For consistency, do this even for LD1.

- */

+ assert(mte_n >= 1 && mte_n <= 4);

if (s->mte_active[0]) {

int msz = dtype_msz(dtype);

@@ -XXX,XX +XXX,XX @@ static void do_mem_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

addr = clean_data_tbi(s, addr);

+ * For e.g. LD4, there are not enough arguments to pass all 4

+ * registers as pointers, so encode the regno into the data field.

+ * For consistency, do this even for LD1.

desc = simd_desc(vsz, vsz, zt | desc);

t_pg = tcg_temp_new_ptr();

@@ -XXX,XX +XXX,XX @@ static void do_ld_zpa(DisasContext *s, int zt, int pg,

* accessible via the instruction encoding.

*/

assert(fn != NULL);

- do_mem_zpa(s, zt, pg, addr, dtype, nreg, false, fn);

+ do_mem_zpa(s, zt, pg, addr, dtype, nreg + 1, false, fn);

static bool trans_LD_zprr(DisasContext *s, arg_rprr_load *a)

@@ -XXX,XX +XXX,XX @@ static void do_st_zpa(DisasContext *s, int zt, int pg, TCGv_i64 addr,

if (nreg == 0) {

/* ST1 */

fn = fn_single[s->mte_active[0]][be][msz][esz];

- nreg = 1;

} else {

/* ST2, ST3, ST4 -- msz == esz, enforced by encoding */

assert(msz == esz);

fn = fn_multiple[s->mte_active[0]][be][nreg - 1][msz];

}

assert(fn != NULL);

- do_mem_zpa(s, zt, pg, addr, msz_dtype(s, msz), nreg, true, fn);

+ do_mem_zpa(s, zt, pg, addr, msz_dtype(s, msz), nreg + 1, true, fn);

}

static bool trans_ST_zprr(DisasContext *s, arg_rprr_store *a)

2.34.1

The raven_io_ops MemoryRegionOps is the only one in the source tree

which sets .valid.unaligned to indicate that it should support

unaligned accesses and which does not also set .impl.unaligned to

indicate that its read and write functions can do the unaligned

handling themselves. This is a problem, because at the moment the

core memory system does not implement the support for handling

unaligned accesses by doing a series of aligned accesses and

combining them (system/memory.c:access_with_adjusted_size() has a

TODO comment noting this).

Fortunately raven_io_read() and raven_io_write() will correctly deal

with the case of being passed an unaligned address, so we can fix the

missing unaligned access support by setting .impl.unaligned in the

MemoryRegionOps struct.

Tested-by: Cédric Le Goater <clg@redhat.com>

Reviewed-by: Cédric Le Goater <clg@redhat.com>

Message-id: 20240112134640.1775041-1-peter.maydell@linaro.org

hw/pci-host/raven.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c

--- a/hw/pci-host/raven.c

+++ b/hw/pci-host/raven.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps raven_io_ops = {

.write = raven_io_write,

.endianness = DEVICE_LITTLE_ENDIAN,

.impl.max_access_size = 4,

+ .impl.unaligned = true,

.valid.unaligned = true,

};

2.34.1

Suppress the deprecation warning when we're running under qtest,

to avoid "make check" including warning messages in its output.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240206154151.155620-1-peter.maydell@linaro.org

hw/block/tc58128.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/block/tc58128.c b/hw/block/tc58128.c

--- a/hw/block/tc58128.c

+++ b/hw/block/tc58128.c

@@ -XXX,XX +XXX,XX @@ static sh7750_io_device tc58128 = {

int tc58128_init(struct SH7750State *s, const char *zone1, const char *zone2)

{

- warn_report_once("The TC58128 flash device is deprecated");

+ if (!qtest_enabled()) {

+ warn_report_once("The TC58128 flash device is deprecated");

+ }

init_dev(&tc58128_devs[0], zone1);

init_dev(&tc58128_devs[1], zone2);

return sh7750_register_io_device(s, &tc58128);

2.34.1

We deliberately don't include qtests_npcm7xx in qtests_aarch64,

because we already get the coverage of those tests via qtests_arm,

and we don't want to use extra CI minutes testing them twice.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20240206163043.315535-1-peter.maydell@linaro.org

tests/qtest/meson.build | 1 -

1 file changed, 1 deletion(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build

--- a/tests/qtest/meson.build

+++ b/tests/qtest/meson.build

@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \

(config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) + \

(config_all_accel.has_key('CONFIG_TCG') and \

config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \

- (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \

['arm-cpu-features',

'numa-test',

'boot-serial-test',

2.34.1

Armv8.1+ CPUs have the Virtual Host Extension (VHE) which adds a

non-secure EL2 virtual timer. We implemented the timer itself in the

CPU model, but never wired up its IRQ line to the GIC.

Wire up the IRQ line (this is always safe whether the CPU has the

interrupt or not, since it always creates the outbound IRQ line).

Report it to the guest via dtb and ACPI if the CPU has the feature.

The DTB binding is documented in the kernel's

Documentation/devicetree/bindings/timer/arm\,arch_timer.yaml

and the ACPI table entries are documented in the ACPI specification

version 6.3 or later.

Because the IRQ line ACPI binding is new in 6.3, we need to bump the

FADT table rev to show that we might be using 6.3 features.

Note that exposing this IRQ in the DTB will trigger a bug in EDK2

versions prior to edk2-stable202311, for users who use the virt board

with 'virtualization=on' to enable EL2 emulation and are booting an

EDK2 guest BIOS, if that EDK2 has assertions enabled. The effect is

that EDK2 will assert on bootup:

ASSERT [ArmTimerDxe] /home/kraxel/projects/qemu/roms/edk2/ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.c(72): PropSize == 36 || PropSize == 48

If you see that assertion you should do one of:

* update your EDK2 binaries to edk2-stable202311 or newer

* use the 'virt-8.2' versioned machine type

* not use 'virtualization=on'

(The versions shipped with QEMU itself have the fix.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

Message-id: 20240122143537.233498-3-peter.maydell@linaro.org

---

include/hw/arm/virt.h | 2 ++

hw/arm/virt-acpi-build.c | 20 ++++++++++----

hw/arm/virt.c | 60 ++++++++++++++++++++++++++++++++++------

3 files changed, 67 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {

/* Machines < 6.2 have no support for describing cpu topology to guest */

bool no_cpu_topology;

bool no_tcg_lpa2;

+ bool no_ns_el2_virt_timer_irq;

};

struct VirtMachineState {

@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {

PCIBus *bus;

char *oem_id;

char *oem_table_id;

+ bool ns_el2_virt_timer_irq;

};

#define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt-acpi-build.c

+++ b/hw/arm/virt-acpi-build.c

@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

}

/*

- * ACPI spec, Revision 5.1

- * 5.2.24 Generic Timer Description Table (GTDT)

+ * ACPI spec, Revision 6.5

+ * 5.2.25 Generic Timer Description Table (GTDT)

*/

static void

build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

uint32_t irqflags = vmc->claim_edge_triggered_timers ?

1 : /* Interrupt is Edge triggered */

0; /* Interrupt is Level triggered */

- AcpiTable table = { .sig = "GTDT", .rev = 2, .oem_id = vms->oem_id,

+ AcpiTable table = { .sig = "GTDT", .rev = 3, .oem_id = vms->oem_id,

.oem_table_id = vms->oem_table_id };

acpi_table_begin(&table, table_data);

@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

build_append_int_noprefix(table_data, 0, 4);

/* Platform Timer Offset */

build_append_int_noprefix(table_data, 0, 4);

-

+ if (vms->ns_el2_virt_timer_irq) {

+ /* Virtual EL2 Timer GSIV */

+ build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_VIRT_IRQ, 4);

+ /* Virtual EL2 Timer Flags */

+ build_append_int_noprefix(table_data, irqflags, 4);

+ } else {

+ build_append_int_noprefix(table_data, 0, 4);

+ build_append_int_noprefix(table_data, 0, 4);

+ }

acpi_table_end(linker, &table);

}

@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

static void build_fadt_rev6(GArray *table_data, BIOSLinker *linker,

VirtMachineState *vms, unsigned dsdt_tbl_offset)

{

- /* ACPI v6.0 */

+ /* ACPI v6.3 */

AcpiFadtData fadt = {

.rev = 6,

- .minor_ver = 0,

+ .minor_ver = 3,

.flags = 1 << ACPI_FADT_F_HW_REDUCED_ACPI,

.xdsdt_tbl_offset = &dsdt_tbl_offset,

};

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_randomness(MachineState *ms, const char *node)

qemu_fdt_setprop(ms->fdt, node, "rng-seed", seed.rng, sizeof(seed.rng));

}

+/*

+ * The CPU object always exposes the NS EL2 virt timer IRQ line,

+ * but we don't want to advertise it to the guest in the dtb or ACPI

+ * table unless it's really going to do something.

+ */

+static bool ns_el2_virt_timer_present(void)

+{

+ ARMCPU *cpu = ARM_CPU(qemu_get_cpu(0));

+ CPUARMState *env = &cpu->env;

+

+ return arm_feature(env, ARM_FEATURE_AARCH64) &&

+ arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu);

+}

+

static void create_fdt(VirtMachineState *vms)

{

MachineState *ms = MACHINE(vms);

@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)

"arm,armv7-timer");

}

qemu_fdt_setprop(ms->fdt, "/timer", "always-on", NULL, 0);

- qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

- GIC_FDT_IRQ_TYPE_PPI,

- INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);

+ if (vms->ns_el2_virt_timer_irq) {

+ qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_VIRT_IRQ), irqflags);

+ } else {

+ qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,

+ GIC_FDT_IRQ_TYPE_PPI,

+ INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);

+ }

}

static void fdt_add_cpu_nodes(const VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)

[GTIMER_VIRT] = ARCH_TIMER_VIRT_IRQ,

[GTIMER_HYP] = ARCH_TIMER_NS_EL2_IRQ,

[GTIMER_SEC] = ARCH_TIMER_S_EL1_IRQ,

+ [GTIMER_HYPVIRT] = ARCH_TIMER_NS_EL2_VIRT_IRQ,

};

for (unsigned irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {

@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)

qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);

object_unref(cpuobj);

}

+

+ /* Now we've created the CPUs we can see if they have the hypvirt timer */

+ vms->ns_el2_virt_timer_irq = ns_el2_virt_timer_present() &&

+ !vmc->no_ns_el2_virt_timer_irq;

+

fdt_add_timer_nodes(vms);

fdt_add_cpu_nodes(vms);

@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(9, 0)

static void virt_machine_8_2_options(MachineClass *mc)

{

+ VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));

+

virt_machine_9_0_options(mc);

compat_props_add(mc->compat_props, hw_compat_8_2, hw_compat_8_2_len);

+ /*

+ * Don't expose NS_EL2_VIRT timer IRQ in DTB on ACPI on 8.2 and

+ * earlier machines. (Exposing it tickles a bug in older EDK2

+ * guest BIOS binaries.)

+ */

+ vmc->no_ns_el2_virt_timer_irq = true;

}

DEFINE_VIRT_MACHINE(8, 2)

--

2.34.1

Update the virt golden reference files to say that the FACP is ACPI

v6.3, and the GTDT table is a revision 3 table with space for the

virtual EL2 timer.

Diffs from iasl:

@@ -XXX,XX +XXX,XX @@

/*

* Intel ACPI Component Architecture