One last arm pullreq before I stop work for the end of the year...

The following changes since commit 8e5943260a8f765216674ee87ce8588cc4e7463e:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-12-20 12:46:10 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191220

for you to fetch changes up to c8fa6079eb35888587f1be27c1590da4edcc5098:

arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on() (2019-12-20 14:03:00 +0000)

* Support emulating the generic timers at frequencies other than 62.5MHz

* Various fixes for SMMUv3 emulation bugs

* Improve assert error message for hflags mismatches

* arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()

Andrew Jeffery (4):

target/arm: Remove redundant scaling of nexttick

target/arm: Abstract the generic timer frequency

target/arm: Prepare generic timer for per-platform CNTFRQ

ast2600: Configure CNTFRQ at 1125MHz

Niek Linnenbank (1):

arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()

target/arm: Display helpful message when hflags mismatch

Simon Veith (6):

hw/arm/smmuv3: Apply address mask to linear strtab base address

hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value

hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE

hw/arm/smmuv3: Align stream table base address to table size

hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro

hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position

hw/arm/smmuv3-internal.h | 6 ++---

target/arm/cpu.h | 5 ++++

hw/arm/aspeed_ast2600.c | 3 +++

hw/arm/smmuv3.c | 28 +++++++++++++++-----

target/arm/arm-powerctl.c | 3 +++

target/arm/cpu.c | 65 +++++++++++++++++++++++++++++++++++++++++------

target/arm/helper.c | 42 +++++++++++++++++++++++-------

7 files changed, 125 insertions(+), 27 deletions(-)

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Instead of crashing in a confuse way, give some hint to the user

about why we aborted. He might report the issue without having

to use a debugger.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20191209134552.27733-1-philmd@redhat.com

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>

target/arm/helper.c | 18 +++++++++++++++---

1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)

env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);

}

+static inline void assert_hflags_rebuild_correctly(CPUARMState *env)

+{

+#ifdef CONFIG_DEBUG_TCG

+ uint32_t env_flags_current = env->hflags;

+ uint32_t env_flags_rebuilt = rebuild_hflags_internal(env);

+

+ if (unlikely(env_flags_current != env_flags_rebuilt)) {

+ fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n",

+ env_flags_current, env_flags_rebuilt);

+ abort();

+ }

+#endif

+}

+

void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

target_ulong *cs_base, uint32_t *pflags)

{

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

uint32_t pstate_for_ss;

*cs_base = 0;

-#ifdef CONFIG_DEBUG_TCG

- assert(flags == rebuild_hflags_internal(env));

-#endif

+ assert_hflags_rebuild_correctly(env);

if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {

*pc = env->pc;

From: Niek Linnenbank <nieklinnenbank@gmail.com>

After setting CP15 bits in arm_set_cpu_on() the cached hflags must

be rebuild to reflect the changed processor state. Without rebuilding,

the cached hflags would be inconsistent until the next call to

arm_rebuild_hflags(). When QEMU is compiled with debugging enabled

(--enable-debug), this problem is captured shortly after the first

call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:

qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:

Assertion `flags == rebuild_hflags_internal(env)' failed.

Fixes: 0c7f8c43daf65

Cc: qemu-stable@nongnu.org

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

target/arm/arm-powerctl.c | 3 +++

1 file changed, 3 insertions(+)

diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c

--- a/target/arm/arm-powerctl.c

+++ b/target/arm/arm-powerctl.c

@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,

target_cpu->env.regs[0] = info->context_id;

}

+ /* CP15 update requires rebuilding hflags */

+ arm_rebuild_hflags(&target_cpu->env);

+

/* Start the new CPU at the requested address */

cpu_set_pc(target_cpu_state, info->entry);

From: Andrew Jeffery <andrew@aj.id.au>

The corner-case codepath was adjusting nexttick such that overflow

wouldn't occur when timer_mod() scaled the value back up. Remove a use

of GTIMER_SCALE and avoid unnecessary operations by calling

timer_mod_ns() directly.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: f8c680720e3abe55476e6d9cb604ad27fdbeb2e0.1576215453.git-series.andrew@aj.id.au

target/arm/helper.c | 5 +++--

1 file changed, 3 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)

* timer expires we will reset the timer for any remaining period.

*/

if (nexttick > INT64_MAX / GTIMER_SCALE) {

- nexttick = INT64_MAX / GTIMER_SCALE;

+ timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);

+ } else {

+ timer_mod(cpu->gt_timer[timeridx], nexttick);

- timer_mod(cpu->gt_timer[timeridx], nexttick);

trace_arm_gt_recalc(timeridx, irqstate, nexttick);

} else {

/* Timer disabled: ISTATUS and timer output always clear */

From: Simon Veith <sveith@amazon.de>

The smmuv3_record_event() function that generates the F_STE_FETCH error

uses the EVT_SET_ADDR macro to record the fetch address, placing it in

32-bit words 4 and 5.

The correct position for this address is in words 6 and 7, per the

SMMUv3 Architecture Specification.

Update the function to use the EVT_SET_ADDR2 macro instead, which is the

macro intended for writing to these words.

ref. ARM IHI 0070C, section 7.3.4.

Signed-off-by: Simon Veith <sveith@amazon.de>

Acked-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1576509312-13083-7-git-send-email-sveith@amazon.de

Cc: Eric Auger <eric.auger@redhat.com>

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

Acked-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/smmuv3.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)

case SMMU_EVT_F_STE_FETCH:

EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);

EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);

- EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);

+ EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);

break;

case SMMU_EVT_C_BAD_STE:

EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);

From: Simon Veith <sveith@amazon.de>

The bit offsets in the EVT_SET_ADDR2 macro do not match those specified

in the ARM SMMUv3 Architecture Specification. In all events that use

this macro, e.g. F_WALK_EABT, the faulting fetch address or IPA actually

occupies the 32-bit words 6 and 7 in the event record contiguously, with

the upper and lower unused bits clear due to alignment or maximum

supported address bits. How many bits are clear depends on the

individual event type.

Update the macro to write to the correct words in the event record so

that guest drivers can obtain accurate address information on events.

ref. ARM IHI 0070C, sections 7.3.12 through 7.3.16.

Signed-off-by: Simon Veith <sveith@amazon.de>

Acked-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1576509312-13083-6-git-send-email-sveith@amazon.de

Cc: Eric Auger <eric.auger@redhat.com>

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

Acked-by: Eric Auger <eric.auger@redhat.com>

hw/arm/smmuv3-internal.h | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h

--- a/hw/arm/smmuv3-internal.h

+++ b/hw/arm/smmuv3-internal.h

@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {

} while (0)

#define EVT_SET_ADDR2(x, addr) \

do { \

- (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16); \

- (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\

+ (x)->word[7] = (uint32_t)(addr >> 32); \

+ (x)->word[6] = (uint32_t)(addr & 0xffffffff); \

} while (0)

void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);

From: Simon Veith <sveith@amazon.de>

Per the specification, and as observed in hardware, the SMMUv3 aligns

the SMMU_STRTAB_BASE address to the size of the table by masking out the

respective least significant bits in the ADDR field.

Apply this masking logic to our smmu_find_ste() lookup function per the

specification.

ref. ARM IHI 0070C, section 6.3.23.

Signed-off-by: Simon Veith <sveith@amazon.de>

Acked-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1576509312-13083-5-git-send-email-sveith@amazon.de

Cc: Eric Auger <eric.auger@redhat.com>

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

hw/arm/smmuv3.c | 18 ++++++++++++++----

1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ bad_ste:

static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,

SMMUEventInfo *event)

{

- dma_addr_t addr;

+ dma_addr_t addr, strtab_base;

uint32_t log2size;

+ int strtab_size_shift;

int ret;

trace_smmuv3_find_ste(sid, s->features, s->sid_split);

@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,

}

if (s->features & SMMU_FEATURE_2LVL_STE) {

int l1_ste_offset, l2_ste_offset, max_l2_ste, span;

- dma_addr_t strtab_base, l1ptr, l2ptr;

+ dma_addr_t l1ptr, l2ptr;

STEDesc l1std;

- strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;

+ /*

+ * Align strtab base address to table size. For this purpose, assume it

+ * is not bounded by SMMU_IDR1_SIDSIZE.

+ */

+ strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);

+ strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &

+ ~MAKE_64BIT_MASK(0, strtab_size_shift);

l1_ste_offset = sid >> s->sid_split;

l2_ste_offset = sid & ((1 << s->sid_split) - 1);

l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));

@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,

}

addr = l2ptr + l2_ste_offset * sizeof(*ste);

} else {

- addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);

+ strtab_size_shift = log2size + 5;

+ strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &

+ ~MAKE_64BIT_MASK(0, strtab_size_shift);

+ addr = strtab_base + sid * sizeof(*ste);

}

if (smmu_get_ste(s, addr, ste, event)) {

From: Simon Veith <sveith@amazon.de>

When checking whether a stream ID is in range of the stream table, we

have so far been only checking it against our implementation limit

(SMMU_IDR1_SIDSIZE). However, the guest can program the

STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this

limit.

Check the stream ID against this limit as well to match the hardware

behavior of raising C_BAD_STREAMID events in case the limit is exceeded.

Also, ensure that we do not go one entry beyond the end of the table by

checking that its index is strictly smaller than the table size.

ref. ARM IHI 0070C, section 6.3.24.

Signed-off-by: Simon Veith <sveith@amazon.de>

Acked-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1576509312-13083-4-git-send-email-sveith@amazon.de

Cc: Eric Auger <eric.auger@redhat.com>

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

hw/arm/smmuv3.c | 8 ++++++--

1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,

SMMUEventInfo *event)

dma_addr_t addr;

+ uint32_t log2size;

int ret;

trace_smmuv3_find_ste(sid, s->features, s->sid_split);

- /* Check SID range */

- if (sid > (1 << SMMU_IDR1_SIDSIZE)) {

+ log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);

+ * Check SID range against both guest-configured and implementation limits

+ if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {

event->type = SMMU_EVT_C_BAD_STREAMID;

return -EINVAL;

}