The following changes since commit 55ef0b702bc2c90c3c4ed97f97676d8f139e5ca1:

Merge remote-tracking branch 'remotes/lvivier-gitlab/tags/linux-user-for-7.0-pull-request' into staging (2022-02-07 10:48:25 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220208

for you to fetch changes up to 4fd1ebb10593087d45d2f56f7f3d13447d24802c:

hw/sensor: Add lsm303dlhc magnetometer device (2022-02-08 10:56:29 +0000)

* Fix handling of SVE ZCR_LEN when using VHE

* xlnx-zynqmp: 'Or' the QSPI / QSPI DMA IRQs

* Don't ever enable PSCI when booting guest in EL3

* Adhere to SMCCC 1.3 section 5.2

* highbank: Fix issues with booting SMP

* midway: Fix issues booting at all

* boot: Drop existing dtb /psci node rather than retaining it

* versal-virt: Always call arm_load_kernel()

* force flag recalculation when messing with DAIF

* hw/timer/armv7m_systick: Update clock source before enabling timer

* hw/arm/smmuv3: Fix device reset

* hw/intc/arm_gicv3_its: refactorings and minor bug fixes

* hw/sensor: Add lsm303dlhc magnetometer device

Alex Bennée (1):

arm: force flag recalculation when messing with DAIF

hw/arm: versal-virt: Always call arm_load_kernel()

Eric Auger (1):

hw/arm/smmuv3: Fix device reset

From: Richard Henderson <richard.henderson@linaro.org>

Extract entire fields for ZEN and FPEN, rather than testing specific bits.

This makes it easier to follow the code versus the ARM spec.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/arm/helper.c | 36 +++++++++++++++++-------------------

1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)

uint64_t hcr_el2 = arm_hcr_el2_eff(env);

if (el <= 1 && (hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {

- bool disabled = false;

-

- /* The CPACR.ZEN controls traps to EL1:

- * 0, 2 : trap EL0 and EL1 accesses

- * 1 : trap only EL0 accesses

- * 3 : trap no accesses

- */

- if (!extract32(env->cp15.cpacr_el1, 16, 1)) {

- disabled = true;

- } else if (!extract32(env->cp15.cpacr_el1, 17, 1)) {

- disabled = el == 0;

- }

- if (disabled) {

+ /* Check CPACR.ZEN. */

+ switch (extract32(env->cp15.cpacr_el1, 16, 2)) {

+ case 1:

+ if (el != 0) {

+ break;

+ }

+ /* fall through */

+ case 0:

+ case 2:

/* route_to_el2 */

return hcr_el2 & HCR_TGE ? 2 : 1;

}

/* Check CPACR.FPEN. */

- if (!extract32(env->cp15.cpacr_el1, 20, 1)) {

- disabled = true;

- } else if (!extract32(env->cp15.cpacr_el1, 21, 1)) {

- disabled = el == 0;

- }

- if (disabled) {

+ switch (extract32(env->cp15.cpacr_el1, 20, 2)) {

+ case 1:

+ if (el != 0) {

+ break;

+ }

+ /* fall through */

+ case 0:

+ case 2:

return 0;

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When HCR_EL2.E2H is set, the format of CPTR_EL2 changes to

look more like CPACR_EL1, with ZEN and FPEN fields instead

of TZ and TFP fields.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20220127063428.30212-4-richard.henderson@linaro.org

target/arm/helper.c | 77 +++++++++++++++++++++++++++++++++++----------

1 file changed, 60 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)

- /* CPTR_EL2. Since TZ and TFP are positive,

- * they will be zero when EL2 is not present.

+ /*

+ * CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE).

*/

- if (el <= 2 && arm_is_el2_enabled(env)) {

- if (env->cp15.cptr_el[2] & CPTR_TZ) {

- return 2;

- }

- if (env->cp15.cptr_el[2] & CPTR_TFP) {

- return 0;

+ if (el <= 2) {

+ if (hcr_el2 & HCR_E2H) {

+ /* Check CPTR_EL2.ZEN. */

+ switch (extract32(env->cp15.cptr_el[2], 16, 2)) {

+ case 1:

+ if (el != 0 || !(hcr_el2 & HCR_TGE)) {

+ break;

+ }

+ /* fall through */

+ case 0:

+ case 2:

+ return 2;

+ }

+ /* Check CPTR_EL2.FPEN. */

+ switch (extract32(env->cp15.cptr_el[2], 20, 2)) {

+ case 1:

+ if (el == 2 || !(hcr_el2 & HCR_TGE)) {

+ break;

+ }

+ /* fall through */

+ case 0:

+ case 2:

+ return 0;

+ }

+ } else if (arm_is_el2_enabled(env)) {

+ if (env->cp15.cptr_el[2] & CPTR_TZ) {

+ return 2;

+ }

+ if (env->cp15.cptr_el[2] & CPTR_TFP) {

+ return 0;

+ }

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)

int fp_exception_el(CPUARMState *env, int cur_el)

{

#ifndef CONFIG_USER_ONLY

+ uint64_t hcr_el2;

/* CPACR and the CPTR registers don't exist before v6, so FP is

* always accessible

*/

@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)

return 0;

}

+ hcr_el2 = arm_hcr_el2_eff(env);

/* The CPACR controls traps to EL1, or PL1 if we're 32 bit:

* 0, 2 : trap EL0 and EL1/PL1 accesses

* 1 : trap only EL0 accesses

* 3 : trap no accesses

* This register is ignored if E2H+TGE are both set.

*/

- if ((arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {

+ if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {

int fpen = extract32(env->cp15.cpacr_el1, 20, 2);

switch (fpen) {

@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)

- /* For the CPTR registers we don't need to guard with an ARM_FEATURE

- * check because zero bits in the registers mean "don't trap".

+ /*

+ * CPTR_EL2 is present in v7VE or v8, and changes format

+ * with HCR_EL2.E2H (regardless of TGE).

*/

-

- /* CPTR_EL2 : present in v7VE or v8 */

- if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)

- && arm_is_el2_enabled(env)) {

- /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */

- return 2;

+ if (cur_el <= 2) {

+ if (hcr_el2 & HCR_E2H) {

+ /* Check CPTR_EL2.FPEN. */

+ switch (extract32(env->cp15.cptr_el[2], 20, 2)) {

+ case 1:

+ if (cur_el != 0 || !(hcr_el2 & HCR_TGE)) {

+ break;

+ }

+ /* fall through */

+ case 0:

+ case 2:

+ return 2;

+ }

+ } else if (arm_is_el2_enabled(env)) {

+ if (env->cp15.cptr_el[2] & CPTR_TFP) {

+ return 2;

+ }

/* CPTR_EL3 : present in v8 */

2.25.1

We want to allow the psci-conduit property to be set after realize,

because the parts of the code which are best placed to decide if it's

OK to enable QEMU's builtin PSCI emulation (the board code and the

arm_load_kernel() function are distant from the code which creates

and realizes CPUs (typically inside an SoC object's init and realize

method) and run afterwards.

Since the DEFINE_PROP_* macros don't have support for creating

properties which can be changed after realize, change the property to

be created with object_property_add_uint32_ptr(), which is what we

already use in this function for creating settable-after-realize

properties like init-svtor and init-nsvtor.

Note that it doesn't conceptually make sense to change the setting of

the property after the machine has been completely initialized,

beacuse this would mean that the behaviour of the machine when first

started would differ from its behaviour when the system is

subsequently reset. (It would also require the underlying state to

be migrated, which we don't do.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Tested-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20220127154639.2090164-2-peter.maydell@linaro.org

target/arm/cpu.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)

OBJ_PROP_FLAG_READWRITE);

}

+ /* Not DEFINE_PROP_UINT32: we want this to be settable after realize */

+ object_property_add_uint32_ptr(obj, "psci-conduit",

+ &cpu->psci_conduit,

+ OBJ_PROP_FLAG_READWRITE);

+

qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property);

if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {

@@ -XXX,XX +XXX,XX @@ static ObjectClass *arm_cpu_class_by_name(const char *cpu_model)

static Property arm_cpu_properties[] = {

- DEFINE_PROP_UINT32("psci-conduit", ARMCPU, psci_conduit, 0),

DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),

DEFINE_PROP_UINT64("mp-affinity", ARMCPU,

mp_affinity, ARM64_AFFINITY_INVALID),

2.25.1

Currently we expect board code to set the psci-conduit property on

CPUs and ensure that secondary CPUs are created with the

start-powered-off property set to false, if the board wishes to use

QEMU's builtin PSCI emulation. This worked OK for the virt board

where we first wanted to use it, because the virt board directly

creates its CPUs and is in a reasonable position to set those

properties. For other boards which model real hardware and use a

separate SoC object, however, it is more awkward. Most PSCI-using

boards just set the psci-conduit board unconditionally.

This was never strictly speaking correct (because you would not be

able to run EL3 guest firmware that itself provided the PSCI

interface, as the QEMU implementation would overrule it), but mostly

worked in practice because for non-PSCI SMC calls QEMU would emulate

the SMC instruction as normal (by trapping to guest EL3). However,

we would like to make our PSCI emulation follow the part of the SMCC

specification that mandates that SMC calls with unknown function

identifiers return a failure code, which means that all SMC calls

will be handled by the PSCI code and the "emulate as normal" path

will no longer be taken.

We tried to implement that in commit 9fcd15b9193e81

("arm: tcg: Adhere to SMCCC 1.3 section 5.2"), but this

regressed attempts to run EL3 guest code on the affected boards:

* mcimx6ul-evk, mcimx7d-sabre, orangepi, xlnx-zcu102

* for the case only of EL3 code loaded via -kernel (and

not via -bios or -pflash), virt and xlnx-versal-virt

so for the 7.0 release we reverted it (in commit 4825eaae4fdd56f).

This commit provides a mechanism that boards can use to arrange that

psci-conduit is set if running guest code at a low enough EL but not

if it would be running at the same EL that the conduit implies that

the QEMU PSCI implementation is using. (Later commits will convert

individual board models to use this mechanism.)

We do this by moving the setting of the psci-conduit and

start-powered-off properties to arm_load_kernel(). Boards which want

to potentially use emulated PSCI must set a psci_conduit field in the

arm_boot_info struct to the type of conduit they want to use (SMC or

HVC); arm_load_kernel() will then set the CPUs up accordingly if it

is not going to start the guest code at the same or higher EL as the

fake QEMU firmware would be at.

Board/SoC code which uses this mechanism should no longer set the CPU

psci-conduit property directly. It should only set the

start-powered-off property for secondaries if EL3 guest firmware

running bare metal expects that rather than the alternative "all CPUs

start executing the firmware at once".

Note that when calculating whether we are going to run guest

code at EL3, we ignore the setting of arm_boot_info::secure_board_setup,

which might cause us to run a stub bit of guest code at EL3 which

does some board-specific setup before dropping to EL2 or EL1 to

run the guest kernel. This is OK because only one board that

enables PSCI sets secure_board_setup (the highbank board), and

the stub code it writes will behave the same way whether the

one SMC call it makes is handled by "emulate the SMC" or by

"PSCI default returns an error code". So we can leave that stub

code in place until after we've changed the PSCI default behaviour;

at that point we will remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Tested-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20220127154639.2090164-4-peter.maydell@linaro.org

include/hw/arm/boot.h | 10 +++++++++

hw/arm/boot.c | 50 +++++++++++++++++++++++++++++++++++++++++++

2 files changed, 60 insertions(+)

diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h

--- a/include/hw/arm/boot.h

+++ b/include/hw/arm/boot.h

@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {

* the user it should implement this hook.

*/

void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);

+ /*

+ * If a board wants to use the QEMU emulated-firmware PSCI support,

+ * it should set this to QEMU_PSCI_CONDUIT_HVC or QEMU_PSCI_CONDUIT_SMC

+ * as appropriate. arm_load_kernel() will set the psci-conduit and

+ * start-powered-off properties on the CPUs accordingly.

+ * Note that if the guest image is started at the same exception level

+ * as the conduit specifies calls should go to (eg guest firmware booted

+ * to EL3) then PSCI will not be enabled.

+ */

+ int psci_conduit;

/* Used internally by arm_boot.c */

int is_linux;

hwaddr initrd_start;

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)

CPUState *cs;

AddressSpace *as = arm_boot_address_space(cpu, info);

+ int boot_el;

+ CPUARMState *env = &cpu->env;

/*

* CPU objects (unlike devices) are not automatically reset on system

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)

arm_setup_direct_kernel_boot(cpu, info);

}

+ /*

+ * Disable the PSCI conduit if it is set up to target the same

+ * or a lower EL than the one we're going to start the guest code in.

+ * This logic needs to agree with the code in do_cpu_reset() which

+ * decides whether we're going to boot the guest in the highest

+ * supported exception level or in a lower one.

+ */

+ /* Boot into highest supported EL ... */

+ if (arm_feature(env, ARM_FEATURE_EL3)) {

+ boot_el = 3;

+ } else if (arm_feature(env, ARM_FEATURE_EL2)) {

+ boot_el = 2;

+ } else {

+ boot_el = 1;

+ }

+ /* ...except that if we're booting Linux we adjust the EL we boot into */

+ if (info->is_linux && !info->secure_boot) {

+ boot_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;

+ if ((info->psci_conduit == QEMU_PSCI_CONDUIT_HVC && boot_el >= 2) ||

+ (info->psci_conduit == QEMU_PSCI_CONDUIT_SMC && boot_el == 3)) {

+ info->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;

+ if (info->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {

+ for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

+ Object *cpuobj = OBJECT(cs);

+ object_property_set_int(cpuobj, "psci-conduit", info->psci_conduit,

+ &error_abort);

+ /*

+ * Secondary CPUs start in PSCI powered-down state. Like the

+ * code in do_cpu_reset(), we assume first_cpu is the primary

+ * CPU.

+ */

+ if (cs != first_cpu) {

+ object_property_set_bool(cpuobj, "start-powered-off", true,

+ &error_abort);

+ }

+ /*

+ * arm_load_dtb() may add a PSCI node so it must be called after we have

+ * decided whether to enable PSCI and set the psci-conduit CPU properties.

+ */

if (!info->skip_dtb_autoload && have_dtb(info)) {

if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as, ms) < 0) {

exit(1);