The spec for m68k semihosting is documented in the libgloss

sources. Add a comment with the URL for it, as we already

have for nios2 semihosting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20230801154451.3505492-1-peter.maydell@linaro.org

---

target/m68k/m68k-semi.c | 4 ++++

1 file changed, 4 insertions(+)

diff --git a/target/m68k/m68k-semi.c b/target/m68k/m68k-semi.c

index XXXXXXX..XXXXXXX 100644

--- a/target/m68k/m68k-semi.c

+++ b/target/m68k/m68k-semi.c

@@ -XXX,XX +XXX,XX @@

*

* You should have received a copy of the GNU General Public License

* along with this program; if not, see <http://www.gnu.org/licenses/>.

+ *

+ * The semihosting protocol implemented here is described in the

+ * libgloss sources:

+ * https://sourceware.org/git/?p=newlib-cygwin.git;a=blob;f=libgloss/m68k/m68k-semi.txt;hb=HEAD

*/

#include "qemu/osdep.h"

--

2.34.1

The loads-and-stores documentation includes git grep regexes to find

occurrences of the various functions. Some of these regexes have

errors, typically failing to escape the '?', '(' and ')' when they

should be metacharacters (since these are POSIX basic REs). We also

weren't consistent about whether to have a ':' on the end of the

line introducing the list of regexes in each section.

Fix the errors.

The following shell rune will complain about any REs in the

file which don't have any matches in the codebase:

for re in $(sed -ne 's/ - ``\(\\<.*\)``/\1/p' docs/devel/loads-stores.rst); do git grep -q "$re" || echo "no matches for re $re"; done

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20230904161703.3996734-1-peter.maydell@linaro.org

---

docs/devel/loads-stores.rst | 40 ++++++++++++++++++-------------------

1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/devel/loads-stores.rst

+++ b/docs/devel/loads-stores.rst

@@ -XXX,XX +XXX,XX @@ which stores ``val`` to ``ptr`` as an ``{endian}`` order value

of size ``sz`` bytes.

-Regexes for git grep

+Regexes for git grep:

- ``\<ld[us]\?[bwlq]\(_[hbl]e\)\?_p\>``

- ``\<st[bwlq]\(_[hbl]e\)\?_p\>``

- ``\<st24\(_[hbl]e\)\?_p\>``

- - ``\<ldn_\([hbl]e\)?_p\>``

- - ``\<stn_\([hbl]e\)?_p\>``

+ - ``\<ldn_\([hbl]e\)\?_p\>``

+ - ``\<stn_\([hbl]e\)\?_p\>``

``cpu_{ld,st}*_mmu``

~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_mmu(env, ptr, val, oi, retaddr)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[bwlq](_[bl]e)\?_mmu\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_mmu\>``

+ - ``\<cpu_ld[bwlq]\(_[bl]e\)\?_mmu\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_mmu\>``

``cpu_{ld,st}*_mmuidx_ra``

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_mmuidx_ra(env, ptr, val, mmuidx, retaddr)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_mmuidx_ra\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_mmuidx_ra\>``

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_mmuidx_ra\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_mmuidx_ra\>``

``cpu_{ld,st}*_data_ra``

~~~~~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_data_ra(env, ptr, val, ra)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_data_ra\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_data_ra\>``

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_data_ra\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_data_ra\>``

``cpu_{ld,st}*_data``

~~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_data(env, ptr, val)``

- ``_be`` : big endian

- ``_le`` : little endian

-Regexes for git grep

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_data\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_data\+\>``

+Regexes for git grep:

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_data\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_data\+\>``

``cpu_ld*_code``

~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ swap: ``translator_ld{sign}{size}_swap(env, ptr, swap)``

- ``l`` : 32 bits

- ``q`` : 64 bits

-Regexes for git grep

+Regexes for git grep:

- ``\<translator_ld[us]\?[bwlq]\(_swap\)\?\>``

``helper_{ld,st}*_mmu``

@@ -XXX,XX +XXX,XX @@ store: ``helper_{size}_mmu(env, addr, val, opindex, retaddr)``

- ``l`` : 32 bits

- ``q`` : 64 bits

-Regexes for git grep

+Regexes for git grep:

- ``\<helper_ld[us]\?[bwlq]_mmu\>``

- ``\<helper_st[bwlq]_mmu\>``

@@ -XXX,XX +XXX,XX @@ succeeded using a MemTxResult return code.

The ``_{endian}`` suffix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<address_space_\(read\|write\|rw\)\>``

- ``\<address_space_ldu\?[bwql]\(_[lb]e\)\?\>``

- ``\<address_space_st[bwql]\(_[lb]e\)\?\>``

@@ -XXX,XX +XXX,XX @@ Note that portions of the write which attempt to write data to a

device will be silently ignored -- only real RAM and ROM will

be written to.

-Regexes for git grep

+Regexes for git grep:

- ``address_space_write_rom``

``{ld,st}*_phys``

@@ -XXX,XX +XXX,XX @@ device doing the access has no way to report such an error.

The ``_{endian}_`` infix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_phys\>``

- ``\<st[bwlq]\(_[bl]e\)\?_phys\>``

@@ -XXX,XX +XXX,XX @@ For new code they are better avoided:

``cpu_physical_memory_rw``

-Regexes for git grep

+Regexes for git grep:

- ``\<cpu_physical_memory_\(read\|write\|rw\)\>``

``cpu_memory_rw_debug``

@@ -XXX,XX +XXX,XX @@ make sure our existing code is doing things correctly.

``dma_memory_rw``

-Regexes for git grep

+Regexes for git grep:

- ``\<dma_memory_\(read\|write\|rw\)\>``

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_dma\>``

- ``\<st[bwlq]\(_[bl]e\)\?_dma\>``

@@ -XXX,XX +XXX,XX @@ correct address space for that device.

The ``_{endian}_`` infix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<pci_dma_\(read\|write\|rw\)\>``

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_pci_dma\>``

- ``\<st[bwlq]\(_[bl]e\)\?_pci_dma\>``

--

2.34.1

From: Fabian Vogt <fvogt@suse.de>

Just like d7ef5e16a17c sets SCR_EL3.HXEn for FEAT_HCX, this commit

handles SCR_EL3.FGTEn for FEAT_FGT:

When we direct boot a kernel on a CPU which emulates EL3, we need to

set up the EL3 system registers as the Linux kernel documentation

specifies:

https://www.kernel.org/doc/Documentation/arm64/booting.rst

> For CPUs with the Fine Grained Traps (FEAT_FGT) extension present:

> - If EL3 is present and the kernel is entered at EL2:

> - SCR_EL3.FGTEn (bit 27) must be initialised to 0b1.

Cc: qemu-stable@nongnu.org

Signed-off-by: Fabian Vogt <fvogt@suse.de>

Message-id: 4831384.GXAFRqVoOG@linux-e202.suse.de

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/boot.c | 4 ++++

1 file changed, 4 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)

if (cpu_isar_feature(aa64_hcx, cpu)) {

env->cp15.scr_el3 |= SCR_HXEN;

}

+ if (cpu_isar_feature(aa64_fgt, cpu)) {

+ env->cp15.scr_el3 |= SCR_FGTEN;

+ }

+

/* AArch64 kernels never boot in secure mode */

assert(!info->secure_boot);

/* This hook is only supported for AArch32 currently:

--

2.34.1

Some of the names we use for CPU features in linux-user's dummy

/proc/cpuinfo don't match the strings in the real kernel in

arch/arm64/kernel/cpuinfo.c. Specifically, the SME related

features have an underscore in the HWCAP_FOO define name,

but (like the SVE ones) they do not have an underscore in the

string in cpuinfo. Correct the errors.

Fixes: a55b9e7226708 ("linux-user: Emulate /proc/cpuinfo on aarch64 and arm")

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

linux-user/elfload.c | 14 +++++++-------

1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ const char *elf_hwcap2_str(uint32_t bit)

[__builtin_ctz(ARM_HWCAP2_A64_RPRES )] = "rpres",

[__builtin_ctz(ARM_HWCAP2_A64_MTE3 )] = "mte3",

[__builtin_ctz(ARM_HWCAP2_A64_SME )] = "sme",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_I16I64 )] = "sme_i16i64",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_F64F64 )] = "sme_f64f64",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_I8I32 )] = "sme_i8i32",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_F16F32 )] = "sme_f16f32",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32 )] = "sme_b16f32",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32 )] = "sme_f32f32",

- [__builtin_ctz(ARM_HWCAP2_A64_SME_FA64 )] = "sme_fa64",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_I16I64 )] = "smei16i64",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_F64F64 )] = "smef64f64",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_I8I32 )] = "smei8i32",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_F16F32 )] = "smef16f32",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32 )] = "smeb16f32",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32 )] = "smef32f32",

+ [__builtin_ctz(ARM_HWCAP2_A64_SME_FA64 )] = "smefa64",

};

return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

--

2.34.1

Our lists of Arm 32 and 64 bit hwcap values have lagged behind

the Linux kernel. Update them to include all the bits defined

as of upstream Linux git commit a48fa7efaf1161c1 (in the middle

of the kernel 6.6 dev cycle).

For 64-bit, we don't yet implement any of the features reported via

these hwcap bits. For 32-bit we do in fact already implement them

all; we'll add the code to set them in a subsequent commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

linux-user/elfload.c | 44 ++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 44 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ enum

ARM_HWCAP_ARM_VFPD32 = 1 << 19,

ARM_HWCAP_ARM_LPAE = 1 << 20,

ARM_HWCAP_ARM_EVTSTRM = 1 << 21,

+ ARM_HWCAP_ARM_FPHP = 1 << 22,

+ ARM_HWCAP_ARM_ASIMDHP = 1 << 23,

+ ARM_HWCAP_ARM_ASIMDDP = 1 << 24,

+ ARM_HWCAP_ARM_ASIMDFHM = 1 << 25,

+ ARM_HWCAP_ARM_ASIMDBF16 = 1 << 26,

+ ARM_HWCAP_ARM_I8MM = 1 << 27,

};

enum {

@@ -XXX,XX +XXX,XX @@ enum {

ARM_HWCAP2_ARM_SHA1 = 1 << 2,

ARM_HWCAP2_ARM_SHA2 = 1 << 3,

ARM_HWCAP2_ARM_CRC32 = 1 << 4,

+ ARM_HWCAP2_ARM_SB = 1 << 5,

+ ARM_HWCAP2_ARM_SSBS = 1 << 6,

};

/* The commpage only exists for 32 bit kernels */

@@ -XXX,XX +XXX,XX @@ const char *elf_hwcap_str(uint32_t bit)

[__builtin_ctz(ARM_HWCAP_ARM_VFPD32 )] = "vfpd32",

[__builtin_ctz(ARM_HWCAP_ARM_LPAE )] = "lpae",

[__builtin_ctz(ARM_HWCAP_ARM_EVTSTRM )] = "evtstrm",

+ [__builtin_ctz(ARM_HWCAP_ARM_FPHP )] = "fphp",

+ [__builtin_ctz(ARM_HWCAP_ARM_ASIMDHP )] = "asimdhp",

+ [__builtin_ctz(ARM_HWCAP_ARM_ASIMDDP )] = "asimddp",

+ [__builtin_ctz(ARM_HWCAP_ARM_ASIMDFHM )] = "asimdfhm",

+ [__builtin_ctz(ARM_HWCAP_ARM_ASIMDBF16)] = "asimdbf16",

+ [__builtin_ctz(ARM_HWCAP_ARM_I8MM )] = "i8mm",

};

return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

@@ -XXX,XX +XXX,XX @@ const char *elf_hwcap2_str(uint32_t bit)

[__builtin_ctz(ARM_HWCAP2_ARM_SHA1 )] = "sha1",

[__builtin_ctz(ARM_HWCAP2_ARM_SHA2 )] = "sha2",

[__builtin_ctz(ARM_HWCAP2_ARM_CRC32)] = "crc32",

+ [__builtin_ctz(ARM_HWCAP2_ARM_SB )] = "sb",

+ [__builtin_ctz(ARM_HWCAP2_ARM_SSBS )] = "ssbs",

};

return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

@@ -XXX,XX +XXX,XX @@ enum {

ARM_HWCAP2_A64_SME_B16F32 = 1 << 28,

ARM_HWCAP2_A64_SME_F32F32 = 1 << 29,

ARM_HWCAP2_A64_SME_FA64 = 1 << 30,

+ ARM_HWCAP2_A64_WFXT = 1ULL << 31,

+ ARM_HWCAP2_A64_EBF16 = 1ULL << 32,

+ ARM_HWCAP2_A64_SVE_EBF16 = 1ULL << 33,

+ ARM_HWCAP2_A64_CSSC = 1ULL << 34,

+ ARM_HWCAP2_A64_RPRFM = 1ULL << 35,

+ ARM_HWCAP2_A64_SVE2P1 = 1ULL << 36,

+ ARM_HWCAP2_A64_SME2 = 1ULL << 37,

+ ARM_HWCAP2_A64_SME2P1 = 1ULL << 38,

+ ARM_HWCAP2_A64_SME_I16I32 = 1ULL << 39,

+ ARM_HWCAP2_A64_SME_BI32I32 = 1ULL << 40,

+ ARM_HWCAP2_A64_SME_B16B16 = 1ULL << 41,

+ ARM_HWCAP2_A64_SME_F16F16 = 1ULL << 42,

+ ARM_HWCAP2_A64_MOPS = 1ULL << 43,

+ ARM_HWCAP2_A64_HBC = 1ULL << 44,

};

#define ELF_HWCAP get_elf_hwcap()

@@ -XXX,XX +XXX,XX @@ const char *elf_hwcap2_str(uint32_t bit)

[__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32 )] = "smeb16f32",

[__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32 )] = "smef32f32",

[__builtin_ctz(ARM_HWCAP2_A64_SME_FA64 )] = "smefa64",

+ [__builtin_ctz(ARM_HWCAP2_A64_WFXT )] = "wfxt",

+ [__builtin_ctzll(ARM_HWCAP2_A64_EBF16 )] = "ebf16",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SVE_EBF16 )] = "sveebf16",

+ [__builtin_ctzll(ARM_HWCAP2_A64_CSSC )] = "cssc",

+ [__builtin_ctzll(ARM_HWCAP2_A64_RPRFM )] = "rprfm",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SVE2P1 )] = "sve2p1",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME2 )] = "sme2",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME2P1 )] = "sme2p1",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME_I16I32 )] = "smei16i32",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME_BI32I32)] = "smebi32i32",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME_B16B16 )] = "smeb16b16",

+ [__builtin_ctzll(ARM_HWCAP2_A64_SME_F16F16 )] = "smef16f16",

+ [__builtin_ctzll(ARM_HWCAP2_A64_MOPS )] = "mops",

+ [__builtin_ctzll(ARM_HWCAP2_A64_HBC )] = "hbc",

};

return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

--

2.34.1

Add the code to report the arm32 hwcaps we were previously missing:

ss, ssbs, fphp, asimdhp, asimddp, asimdfhm, asimdbf16, i8mm

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

linux-user/elfload.c | 12 ++++++++++++

1 file changed, 12 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ uint32_t get_elf_hwcap(void)

}

}

GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);

+ /*

+ * MVFR1.FPHP and .SIMDHP must be in sync, and QEMU uses the same

+ * isar_feature function for both. The kernel reports them as two hwcaps.

+ */

+ GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_FPHP);

+ GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_ASIMDHP);

+ GET_FEATURE_ID(aa32_dp, ARM_HWCAP_ARM_ASIMDDP);

+ GET_FEATURE_ID(aa32_fhm, ARM_HWCAP_ARM_ASIMDFHM);

+ GET_FEATURE_ID(aa32_bf16, ARM_HWCAP_ARM_ASIMDBF16);

+ GET_FEATURE_ID(aa32_i8mm, ARM_HWCAP_ARM_I8MM);

return hwcaps;

}

@@ -XXX,XX +XXX,XX @@ uint32_t get_elf_hwcap2(void)

GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);

GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);

GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);

+ GET_FEATURE_ID(aa32_sb, ARM_HWCAP2_ARM_SB);

+ GET_FEATURE_ID(aa32_ssbs, ARM_HWCAP2_ARM_SSBS);

return hwcaps;

}

--

2.34.1

Update our AArch64 ID register field definitions from the 2023-06

system register XML release:

https://developer.arm.com/documentation/ddi0601/2023-06/

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

target/arm/cpu.h | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR0, SHA1, 8, 4)

FIELD(ID_AA64ISAR0, SHA2, 12, 4)

FIELD(ID_AA64ISAR0, CRC32, 16, 4)

FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)

+FIELD(ID_AA64ISAR0, TME, 24, 4)

FIELD(ID_AA64ISAR0, RDM, 28, 4)

FIELD(ID_AA64ISAR0, SHA3, 32, 4)

FIELD(ID_AA64ISAR0, SM3, 36, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR2, APA3, 12, 4)

FIELD(ID_AA64ISAR2, MOPS, 16, 4)

FIELD(ID_AA64ISAR2, BC, 20, 4)

FIELD(ID_AA64ISAR2, PAC_FRAC, 24, 4)

+FIELD(ID_AA64ISAR2, CLRBHB, 28, 4)

+FIELD(ID_AA64ISAR2, SYSREG_128, 32, 4)

+FIELD(ID_AA64ISAR2, SYSINSTR_128, 36, 4)

+FIELD(ID_AA64ISAR2, PRFMSLC, 40, 4)

+FIELD(ID_AA64ISAR2, RPRFM, 48, 4)

+FIELD(ID_AA64ISAR2, CSSC, 52, 4)

+FIELD(ID_AA64ISAR2, ATS1A, 60, 4)

FIELD(ID_AA64PFR0, EL0, 0, 4)

FIELD(ID_AA64PFR0, EL1, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR1, SME, 24, 4)

FIELD(ID_AA64PFR1, RNDR_TRAP, 28, 4)

FIELD(ID_AA64PFR1, CSV2_FRAC, 32, 4)

FIELD(ID_AA64PFR1, NMI, 36, 4)

+FIELD(ID_AA64PFR1, MTE_FRAC, 40, 4)

+FIELD(ID_AA64PFR1, GCS, 44, 4)

+FIELD(ID_AA64PFR1, THE, 48, 4)

+FIELD(ID_AA64PFR1, MTEX, 52, 4)

+FIELD(ID_AA64PFR1, DF2, 56, 4)

+FIELD(ID_AA64PFR1, PFAR, 60, 4)

FIELD(ID_AA64MMFR0, PARANGE, 0, 4)

FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR1, AFP, 44, 4)

FIELD(ID_AA64MMFR1, NTLBPA, 48, 4)

FIELD(ID_AA64MMFR1, TIDCP1, 52, 4)

FIELD(ID_AA64MMFR1, CMOW, 56, 4)

+FIELD(ID_AA64MMFR1, ECBHB, 60, 4)

FIELD(ID_AA64MMFR2, CNP, 0, 4)

FIELD(ID_AA64MMFR2, UAO, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)

FIELD(ID_AA64DFR0, TRACEVER, 4, 4)

FIELD(ID_AA64DFR0, PMUVER, 8, 4)

FIELD(ID_AA64DFR0, BRPS, 12, 4)

+FIELD(ID_AA64DFR0, PMSS, 16, 4)

FIELD(ID_AA64DFR0, WRPS, 20, 4)

+FIELD(ID_AA64DFR0, SEBEP, 24, 4)

FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)

FIELD(ID_AA64DFR0, PMSVER, 32, 4)

FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)

FIELD(ID_AA64DFR0, TRACEBUFFER, 44, 4)

FIELD(ID_AA64DFR0, MTPMU, 48, 4)

FIELD(ID_AA64DFR0, BRBE, 52, 4)

+FIELD(ID_AA64DFR0, EXTTRCBUFF, 56, 4)

FIELD(ID_AA64DFR0, HPMN0, 60, 4)

FIELD(ID_AA64ZFR0, SVEVER, 0, 4)

FIELD(ID_AA64ZFR0, AES, 4, 4)

FIELD(ID_AA64ZFR0, BITPERM, 16, 4)

FIELD(ID_AA64ZFR0, BFLOAT16, 20, 4)

+FIELD(ID_AA64ZFR0, B16B16, 24, 4)

FIELD(ID_AA64ZFR0, SHA3, 32, 4)

FIELD(ID_AA64ZFR0, SM4, 40, 4)

FIELD(ID_AA64ZFR0, I8MM, 44, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ZFR0, F32MM, 52, 4)

FIELD(ID_AA64ZFR0, F64MM, 56, 4)

FIELD(ID_AA64SMFR0, F32F32, 32, 1)

+FIELD(ID_AA64SMFR0, BI32I32, 33, 1)

FIELD(ID_AA64SMFR0, B16F32, 34, 1)

FIELD(ID_AA64SMFR0, F16F32, 35, 1)

FIELD(ID_AA64SMFR0, I8I32, 36, 4)

+FIELD(ID_AA64SMFR0, F16F16, 42, 1)

+FIELD(ID_AA64SMFR0, B16B16, 43, 1)

+FIELD(ID_AA64SMFR0, I16I32, 44, 4)

FIELD(ID_AA64SMFR0, F64F64, 48, 1)

FIELD(ID_AA64SMFR0, I16I64, 52, 4)

FIELD(ID_AA64SMFR0, SMEVER, 56, 4)

--

2.34.1

For user-only mode we reveal a subset of the AArch64 ID registers

to the guest, to emulate the kernel's trap-and-emulate-ID-regs

handling. Update the feature bit masks to match upstream kernel

commit a48fa7efaf1161c1c.

None of these features are yet implemented by QEMU, so this

doesn't yet have a behavioural change, but implementation of

FEAT_MOPS and FEAT_HBC is imminent.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

target/arm/helper.c | 11 ++++++++++-

tests/tcg/aarch64/sysregs.c | 4 ++--

2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

R_ID_AA64ZFR0_F64MM_MASK },

{ .name = "ID_AA64SMFR0_EL1",

.exported_bits = R_ID_AA64SMFR0_F32F32_MASK |

+ R_ID_AA64SMFR0_BI32I32_MASK |

R_ID_AA64SMFR0_B16F32_MASK |

R_ID_AA64SMFR0_F16F32_MASK |

R_ID_AA64SMFR0_I8I32_MASK |

+ R_ID_AA64SMFR0_F16F16_MASK |

+ R_ID_AA64SMFR0_B16B16_MASK |

+ R_ID_AA64SMFR0_I16I32_MASK |

R_ID_AA64SMFR0_F64F64_MASK |

R_ID_AA64SMFR0_I16I64_MASK |

+ R_ID_AA64SMFR0_SMEVER_MASK |

R_ID_AA64SMFR0_FA64_MASK },

{ .name = "ID_AA64MMFR0_EL1",

.exported_bits = R_ID_AA64MMFR0_ECV_MASK,

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

.exported_bits = R_ID_AA64ISAR2_WFXT_MASK |

R_ID_AA64ISAR2_RPRES_MASK |

R_ID_AA64ISAR2_GPA3_MASK |

- R_ID_AA64ISAR2_APA3_MASK },

+ R_ID_AA64ISAR2_APA3_MASK |

+ R_ID_AA64ISAR2_MOPS_MASK |

+ R_ID_AA64ISAR2_BC_MASK |

+ R_ID_AA64ISAR2_RPRFM_MASK |

+ R_ID_AA64ISAR2_CSSC_MASK },

{ .name = "ID_AA64ISAR*_EL1_RESERVED",

.is_glob = true },

};

diff --git a/tests/tcg/aarch64/sysregs.c b/tests/tcg/aarch64/sysregs.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/sysregs.c

+++ b/tests/tcg/aarch64/sysregs.c

@@ -XXX,XX +XXX,XX @@ int main(void)

*/

get_cpu_reg_check_mask(id_aa64isar0_el1, _m(f0ff,ffff,f0ff,fff0));

get_cpu_reg_check_mask(id_aa64isar1_el1, _m(00ff,f0ff,ffff,ffff));

- get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(0000,0000,0000,ffff));

+ get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(00ff,0000,00ff,ffff));

/* TGran4 & TGran64 as pegged to -1 */

get_cpu_reg_check_mask(id_aa64mmfr0_el1, _m(f000,0000,ff00,0000));

get_cpu_reg_check_mask(id_aa64mmfr1_el1, _m(0000,f000,0000,0000));

@@ -XXX,XX +XXX,XX @@ int main(void)

get_cpu_reg_check_mask(id_aa64dfr0_el1, _m(0000,0000,0000,0006));

get_cpu_reg_check_zero(id_aa64dfr1_el1);

get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1, _m(0ff0,ff0f,00ff,00ff));

- get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(80f1,00fd,0000,0000));

+ get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(8ff1,fcff,0000,0000));

get_cpu_reg_check_zero(id_aa64afr0_el1);

get_cpu_reg_check_zero(id_aa64afr1_el1);

--

2.34.1

FEAT_HBC (Hinted conditional branches) provides a new instruction

BC.cond, which behaves exactly like the existing B.cond except

that it provides a hint to the branch predictor about the

likely behaviour of the branch.

Since QEMU does not implement branch prediction, we can treat

this identically to B.cond.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

docs/system/arm/emulation.rst | 1 +

target/arm/cpu.h | 5 +++++

target/arm/tcg/a64.decode | 3 ++-

linux-user/elfload.c | 1 +

target/arm/tcg/cpu64.c | 4 ++++

target/arm/tcg/translate-a64.c | 4 ++++

6 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/emulation.rst

+++ b/docs/system/arm/emulation.rst

@@ -XXX,XX +XXX,XX @@ the following architecture extensions:

- FEAT_FlagM2 (Enhancements to flag manipulation instructions)

- FEAT_GTG (Guest translation granule size)

- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)

+- FEAT_HBC (Hinted conditional branches)

- FEAT_HCX (Support for the HCRX_EL2 register)

- FEAT_HPDS (Hierarchical permission disables)

- FEAT_HPDS2 (Translation table page-based hardware attributes)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_i8mm(const ARMISARegisters *id)

return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, I8MM) != 0;

}

+static inline bool isar_feature_aa64_hbc(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, BC) != 0;

+}

+

static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)

{

return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 1;

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/a64.decode

+++ b/target/arm/tcg/a64.decode

@@ -XXX,XX +XXX,XX @@ CBZ sf:1 011010 nz:1 ................... rt:5 &cbz imm=%imm19

TBZ . 011011 nz:1 ..... .............. rt:5 &tbz imm=%imm14 bitpos=%imm31_19

-B_cond 0101010 0 ................... 0 cond:4 imm=%imm19

+# B.cond and BC.cond

+B_cond 0101010 0 ................... c:1 cond:4 imm=%imm19

BR 1101011 0000 11111 000000 rn:5 00000 &r

BLR 1101011 0001 11111 000000 rn:5 00000 &r

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ uint32_t get_elf_hwcap2(void)

GET_FEATURE_ID(aa64_sme_f64f64, ARM_HWCAP2_A64_SME_F64F64);

GET_FEATURE_ID(aa64_sme_i16i64, ARM_HWCAP2_A64_SME_I16I64);

GET_FEATURE_ID(aa64_sme_fa64, ARM_HWCAP2_A64_SME_FA64);

+ GET_FEATURE_ID(aa64_hbc, ARM_HWCAP2_A64_HBC);

return hwcaps;

}

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/cpu64.c

+++ b/target/arm/tcg/cpu64.c

@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1); /* FEAT_I8MM */

cpu->isar.id_aa64isar1 = t;

+ t = cpu->isar.id_aa64isar2;

+ t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1); /* FEAT_HBC */

+ cpu->isar.id_aa64isar2 = t;

+

t = cpu->isar.id_aa64pfr0;

t = FIELD_DP64(t, ID_AA64PFR0, FP, 1); /* FEAT_FP16 */

t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1); /* FEAT_FP16 */

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/translate-a64.c

+++ b/target/arm/tcg/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static bool trans_TBZ(DisasContext *s, arg_tbz *a)

static bool trans_B_cond(DisasContext *s, arg_B_cond *a)

{

+ /* BC.cond is only present with FEAT_HBC */

+ if (a->c && !dc_isar_feature(aa64_hbc, s)) {

+ return false;

+ }

reset_btype(s);

if (a->cond < 0x0e) {

/* genuinely conditional branches */

--

2.34.1

The allocation_tag_mem() function takes an argument tag_size,

but it never uses it. Remove the argument. In mte_probe_int()

in particular this also lets us delete the code computing

the value we were passing in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

---

target/arm/tcg/mte_helper.c | 42 +++++++++++++------------------------

1 file changed, 14 insertions(+), 28 deletions(-)

diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/mte_helper.c

+++ b/target/arm/tcg/mte_helper.c

@@ -XXX,XX +XXX,XX @@ static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)

* @ptr_access: the access to use for the virtual address

* @ptr_size: the number of bytes in the normal memory access

* @tag_access: the access to use for the tag memory

- * @tag_size: the number of bytes in the tag memory access

* @ra: the return address for exception handling

*

* Our tag memory is formatted as a sequence of little-endian nibbles.

@@ -XXX,XX +XXX,XX @@ static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)

* a pointer to the corresponding tag byte. Exit with exception if the

* virtual address is not accessible for @ptr_access.

*

- * The @ptr_size and @tag_size values may not have an obvious relation

- * due to the alignment of @ptr, and the number of tag checks required.

- *

* If there is no tag storage corresponding to @ptr, return NULL.

*/

static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,

uint64_t ptr, MMUAccessType ptr_access,

int ptr_size, MMUAccessType tag_access,

- int tag_size, uintptr_t ra)

+ uintptr_t ra)

{

#ifdef CONFIG_USER_ONLY

uint64_t clean_ptr = useronly_clean_ptr(ptr);

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(ldg)(CPUARMState *env, uint64_t ptr, uint64_t xt)

/* Trap if accessing an invalid page. */

mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD, 1,

- MMU_DATA_LOAD, 1, GETPC());

+ MMU_DATA_LOAD, GETPC());

/* Load if page supports tags. */

if (mem) {

@@ -XXX,XX +XXX,XX @@ static inline void do_stg(CPUARMState *env, uint64_t ptr, uint64_t xt,

/* Trap if accessing an invalid page. */

mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE, TAG_GRANULE,

- MMU_DATA_STORE, 1, ra);

+ MMU_DATA_STORE, ra);

/* Store if page supports tags. */

if (mem) {

@@ -XXX,XX +XXX,XX @@ static inline void do_st2g(CPUARMState *env, uint64_t ptr, uint64_t xt,

if (ptr & TAG_GRANULE) {

/* Two stores unaligned mod TAG_GRANULE*2 -- modify two bytes. */

mem1 = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,

- TAG_GRANULE, MMU_DATA_STORE, 1, ra);

+ TAG_GRANULE, MMU_DATA_STORE, ra);

mem2 = allocation_tag_mem(env, mmu_idx, ptr + TAG_GRANULE,

MMU_DATA_STORE, TAG_GRANULE,

- MMU_DATA_STORE, 1, ra);

+ MMU_DATA_STORE, ra);

/* Store if page(s) support tags. */

if (mem1) {

@@ -XXX,XX +XXX,XX @@ static inline void do_st2g(CPUARMState *env, uint64_t ptr, uint64_t xt,

} else {

/* Two stores aligned mod TAG_GRANULE*2 -- modify one byte. */

mem1 = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,

- 2 * TAG_GRANULE, MMU_DATA_STORE, 1, ra);

+ 2 * TAG_GRANULE, MMU_DATA_STORE, ra);

if (mem1) {

tag |= tag << 4;

qatomic_set(mem1, tag);

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)

/* Trap if accessing an invalid page. */

tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD,

- gm_bs_bytes, MMU_DATA_LOAD,

- gm_bs_bytes / (2 * TAG_GRANULE), ra);

+ gm_bs_bytes, MMU_DATA_LOAD, ra);

/* The tag is squashed to zero if the page does not support tags. */

if (!tag_mem) {

@@ -XXX,XX +XXX,XX @@ void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)

/* Trap if accessing an invalid page. */

tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,

- gm_bs_bytes, MMU_DATA_LOAD,

- gm_bs_bytes / (2 * TAG_GRANULE), ra);

+ gm_bs_bytes, MMU_DATA_LOAD, ra);

/*

* Tag store only happens if the page support tags,

@@ -XXX,XX +XXX,XX @@ void HELPER(stzgm_tags)(CPUARMState *env, uint64_t ptr, uint64_t val)

ptr &= -dcz_bytes;

mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE, dcz_bytes,

- MMU_DATA_STORE, tag_bytes, ra);

+ MMU_DATA_STORE, ra);

if (mem) {

int tag_pair = (val & 0xf) * 0x11;

memset(mem, tag_pair, tag_bytes);

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

int mmu_idx, ptr_tag, bit55;

uint64_t ptr_last, prev_page, next_page;

uint64_t tag_first, tag_last;

- uint64_t tag_byte_first, tag_byte_last;

- uint32_t sizem1, tag_count, tag_size, n, c;

+ uint32_t sizem1, tag_count, n, c;

uint8_t *mem1, *mem2;

MMUAccessType type;

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

tag_last = QEMU_ALIGN_DOWN(ptr_last, TAG_GRANULE);

tag_count = ((tag_last - tag_first) / TAG_GRANULE) + 1;

- /* Round the bounds to twice the tag granule, and compute the bytes. */

- tag_byte_first = QEMU_ALIGN_DOWN(ptr, 2 * TAG_GRANULE);

- tag_byte_last = QEMU_ALIGN_DOWN(ptr_last, 2 * TAG_GRANULE);

-

/* Locate the page boundaries. */

prev_page = ptr & TARGET_PAGE_MASK;

next_page = prev_page + TARGET_PAGE_SIZE;

if (likely(tag_last - prev_page < TARGET_PAGE_SIZE)) {

/* Memory access stays on one page. */

- tag_size = ((tag_byte_last - tag_byte_first) / (2 * TAG_GRANULE)) + 1;

mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, sizem1 + 1,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

if (!mem1) {

return 1;

}

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

n = checkN(mem1, ptr & TAG_GRANULE, ptr_tag, tag_count);

} else {

/* Memory access crosses to next page. */

- tag_size = (next_page - tag_byte_first) / (2 * TAG_GRANULE);

mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, next_page - ptr,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

- tag_size = ((tag_byte_last - next_page) / (2 * TAG_GRANULE)) + 1;

mem2 = allocation_tag_mem(env, mmu_idx, next_page, type,

ptr_last - next_page + 1,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

/*

* Perform all of the comparisons.

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(mte_check_zva)(CPUARMState *env, uint32_t desc, uint64_t ptr)

mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);

(void) probe_write(env, ptr, 1, mmu_idx, ra);

mem = allocation_tag_mem(env, mmu_idx, align_ptr, MMU_DATA_STORE,

- dcz_bytes, MMU_DATA_LOAD, tag_bytes, ra);

+ dcz_bytes, MMU_DATA_LOAD, ra);

if (!mem) {

goto done;

}

--

2.34.1

The LDRT/STRT "unprivileged load/store" instructions behave like

normal ones if executed at EL0. We handle this correctly for

the load/store semantics, but get the MTE checking wrong.

We always look at s->mte_active[is_unpriv] to see whether we should

be doing MTE checks, but in hflags.c when we set the TB flags that

will be used to fill the mte_active[] array we only set the

MTE0_ACTIVE bit if UNPRIV is true (i.e. we are not at EL0).

This means that a LDRT at EL0 will see s->mte_active[1] as 0,

and will not do MTE checks even when MTE is enabled.

To avoid the translate-time code having to do an explicit check on

s->unpriv to see if it is OK to index into the mte_active[] array,

duplicate MTE_ACTIVE into MTE0_ACTIVE when UNPRIV is false.

(This isn't a very serious bug because generally nobody executes

LDRT/STRT at EL0, because they have no use there.)

Cc: qemu-stable@nongnu.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-2-peter.maydell@linaro.org

---

target/arm/tcg/hflags.c | 9 +++++++++

1 file changed, 9 insertions(+)

diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/hflags.c

+++ b/target/arm/tcg/hflags.c

@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,

&& !(env->pstate & PSTATE_TCO)

&& (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {

DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);

+ if (!EX_TBFLAG_A64(flags, UNPRIV)) {

+ /*

+ * In non-unpriv contexts (eg EL0), unpriv load/stores

+ * act like normal ones; duplicate the MTE info to

+ * avoid translate-a64.c having to check UNPRIV to see

+ * whether it is OK to index into MTE_ACTIVE[].

+ */

+ DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);

+ }

}

}

/* And again for unprivileged accesses, if required. */

--

2.34.1

FEAT_MOPS defines a handful of new enable bits:

* HCRX_EL2.MSCEn, SCTLR_EL1.MSCEn, SCTLR_EL2.MSCen:

define whether the new insns should UNDEF or not

* HCRX_EL2.MCE2: defines whether memops exceptions from

EL1 should be taken to EL1 or EL2

Since we don't sanitise what bits can be written for the SCTLR

registers, we only need to handle the new bits in HCRX_EL2, and

define SCTLR_MSCEN for the new SCTLR bit value.

The precedence of "HCRX bits acts as 0 if SCR_EL3.HXEn is 0" versus

"bit acts as 1 if EL2 disabled" is not clear from the register

definition text, but it is clear in the CheckMOPSEnabled()

pseudocode(), so we follow that. We'll have to check whether other

bits we need to implement in future follow the same logic or not.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-3-peter.maydell@linaro.org

---

target/arm/cpu.h | 6 ++++++

target/arm/helper.c | 28 +++++++++++++++++++++-------

2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);

#define SCTLR_EnIB (1U << 30) /* v8.3, AArch64 only */

#define SCTLR_EnIA (1U << 31) /* v8.3, AArch64 only */

#define SCTLR_DSSBS_32 (1U << 31) /* v8.5, AArch32 only */

+#define SCTLR_MSCEN (1ULL << 33) /* FEAT_MOPS */

#define SCTLR_BT0 (1ULL << 35) /* v8.5-BTI */

#define SCTLR_BT1 (1ULL << 36) /* v8.5-BTI */

#define SCTLR_ITFSB (1ULL << 37) /* v8.5-MemTag */

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)

return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;

}

+static inline bool isar_feature_aa64_mops(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, MOPS);

+}

+

/*

* Feature tests for "does this exist in either 32-bit or 64-bit?"

*/

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

uint64_t valid_mask = 0;

- /* No features adding bits to HCRX are implemented. */

+ /* FEAT_MOPS adds MSCEn and MCE2 */

+ if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {

+ valid_mask |= HCRX_MSCEN | HCRX_MCE2;

+ }

/* Clear RES0 bits. */

env->cp15.hcrx_el2 = value & valid_mask;

@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcrx_el2_eff(CPUARMState *env)

{

/*

* The bits in this register behave as 0 for all purposes other than

- * direct reads of the register if:

- * - EL2 is not enabled in the current security state,

- * - SCR_EL3.HXEn is 0.

+ * direct reads of the register if SCR_EL3.HXEn is 0.

+ * If EL2 is not enabled in the current security state, then the

+ * bit may behave as if 0, or as if 1, depending on the bit.

+ * For the moment, we treat the EL2-disabled case as taking

+ * priority over the HXEn-disabled case. This is true for the only

+ * bit for a feature which we implement where the answer is different

+ * for the two cases (MSCEn for FEAT_MOPS).

+ * This may need to be revisited for future bits.

*/

- if (!arm_is_el2_enabled(env)

- || (arm_feature(env, ARM_FEATURE_EL3)

- && !(env->cp15.scr_el3 & SCR_HXEN))) {

+ if (!arm_is_el2_enabled(env)) {

+ uint64_t hcrx = 0;

+ if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {

+ /* MSCEn behaves as 1 if EL2 is not enabled */

+ hcrx |= HCRX_MSCEN;

+ }

+ return hcrx;

+ }

+ if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {

return 0;

}

return env->cp15.hcrx_el2;

--

2.34.1

In every place that we call the get_a64_user_mem_index() function

we do it like this:

memidx = a->unpriv ? get_a64_user_mem_index(s) : get_mem_index(s);

Refactor so the caller passes in the bool that says whether they

want the 'unpriv' or 'normal' mem_index rather than having to

do the ?: themselves.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20230912140434.1333369-4-peter.maydell@linaro.org

---

target/arm/tcg/translate-a64.c | 20 ++++++++++++++------

1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/translate-a64.c

+++ b/target/arm/tcg/translate-a64.c

@@ -XXX,XX +XXX,XX @@ void a64_translate_init(void)

}

/*

- * Return the core mmu_idx to use for A64 "unprivileged load/store" insns

+ * Return the core mmu_idx to use for A64 load/store insns which

+ * have a "unprivileged load/store" variant. Those insns access

+ * EL0 if executed from an EL which has control over EL0 (usually

+ * EL1) but behave like normal loads and stores if executed from

+ * elsewhere (eg EL3).

+ *

+ * @unpriv : true for the unprivileged encoding; false for the

+ * normal encoding (in which case we will return the same

+ * thing as get_mem_index().

*/

-static int get_a64_user_mem_index(DisasContext *s)

+static int get_a64_user_mem_index(DisasContext *s, bool unpriv)

{

/*

* If AccType_UNPRIV is not used, the insn uses AccType_NORMAL,

@@ -XXX,XX +XXX,XX @@ static int get_a64_user_mem_index(DisasContext *s)

*/

ARMMMUIdx useridx = s->mmu_idx;

- if (s->unpriv) {

+ if (unpriv && s->unpriv) {

/*

* We have pre-computed the condition for AccType_UNPRIV.

* Therefore we should never get here with a mmu_idx for

@@ -XXX,XX +XXX,XX @@ static void op_addr_ldst_imm_pre(DisasContext *s, arg_ldst_imm *a,

if (!a->p) {

tcg_gen_addi_i64(*dirty_addr, *dirty_addr, offset);

}

- memidx = a->unpriv ? get_a64_user_mem_index(s) : get_mem_index(s);

+ memidx = get_a64_user_mem_index(s, a->unpriv);

*clean_addr = gen_mte_check1_mmuidx(s, *dirty_addr, is_store,

a->w || a->rn != 31,

mop, a->unpriv, memidx);

@@ -XXX,XX +XXX,XX @@ static bool trans_STR_i(DisasContext *s, arg_ldst_imm *a)

{

bool iss_sf, iss_valid = !a->w;

TCGv_i64 clean_addr, dirty_addr, tcg_rt;

- int memidx = a->unpriv ? get_a64_user_mem_index(s) : get_mem_index(s);

+ int memidx = get_a64_user_mem_index(s, a->unpriv);

MemOp mop = finalize_memop(s, a->sz + a->sign * MO_SIGN);

op_addr_ldst_imm_pre(s, a, &clean_addr, &dirty_addr, a->imm, true, mop);

@@ -XXX,XX +XXX,XX @@ static bool trans_LDR_i(DisasContext *s, arg_ldst_imm *a)

{

bool iss_sf, iss_valid = !a->w;

TCGv_i64 clean_addr, dirty_addr, tcg_rt;

- int memidx = a->unpriv ? get_a64_user_mem_index(s) : get_mem_index(s);

+ int memidx = get_a64_user_mem_index(s, a->unpriv);

MemOp mop = finalize_memop(s, a->sz + a->sign * MO_SIGN);

op_addr_ldst_imm_pre(s, a, &clean_addr, &dirty_addr, a->imm, false, mop);

--

2.34.1

The FEAT_MOPS memory operations can raise a Memory Copy or Memory Set

exception if a copy or set instruction is executed when the CPU

register state is not correct for that instruction. Define the

usual syn_* function that constructs the syndrome register value

for these exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-5-peter.maydell@linaro.org

---

target/arm/syndrome.h | 12 ++++++++++++

1 file changed, 12 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/syndrome.h

+++ b/target/arm/syndrome.h

@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {

EC_DATAABORT = 0x24,

EC_DATAABORT_SAME_EL = 0x25,

EC_SPALIGNMENT = 0x26,

+ EC_MOP = 0x27,

EC_AA32_FPTRAP = 0x28,

EC_AA64_FPTRAP = 0x2c,

EC_SERROR = 0x2f,

@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_serror(uint32_t extra)

return (EC_SERROR << ARM_EL_EC_SHIFT) | ARM_EL_IL | extra;

}

+static inline uint32_t syn_mop(bool is_set, bool is_setg, int options,

+ bool epilogue, bool wrong_option, bool option_a,

+ int destreg, int srcreg, int sizereg)

+{

+ return (EC_MOP << ARM_EL_EC_SHIFT) | ARM_EL_IL |

+ (is_set << 24) | (is_setg << 23) | (options << 19) |

+ (epilogue << 18) | (wrong_option << 17) | (option_a << 16) |

+ (destreg << 10) | (srcreg << 5) | sizereg;

+}

+

+

#endif /* TARGET_ARM_SYNDROME_H */

--

2.34.1

For the FEAT_MOPS operations, the existing allocation_tag_mem()

function almost does what we want, but it will take a watchpoint

exception even for an ra == 0 probe request, and it requires that the

caller guarantee that the memory is accessible. For FEAT_MOPS we

want a function that will not take any kind of exception, and will

return NULL for the not-accessible case.

Rename allocation_tag_mem() to allocation_tag_mem_probe() and add an

extra 'probe' argument that lets us distinguish these cases;

allocation_tag_mem() is now a wrapper that always passes 'false'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-6-peter.maydell@linaro.org

---

target/arm/tcg/mte_helper.c | 48 ++++++++++++++++++++++++++++---------

1 file changed, 37 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/mte_helper.c