Hi; here's a target-arm pullreq; nothing very exciting in here. thanks -- PMM The following changes since commit c0e80879c876cbe4cbde43a92403329bcedf2ba0: Merge tag 'pull-vfio-20251022' of https://github.com/legoater/qemu into staging (2025-10-22 08:01:21 -0500) are available in the Git repository at: https://gitlab.com/pm215/qemu.git tags/pull-target-arm-20251023 for you to fetch changes up to 33eff5c84d52e7186e0882ea5ee9ac5501c3deea: hw/net/rocker: Don't overflow in of_dpa_mask2prefix() (2025-10-23 14:13:38 +0100) ---------------------------------------------------------------- target-arm queue: * target/arm: Enable FEAT_AIE for -cpu max * target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode * target/arm: Implement SME2 support in gdbstub * hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0 * hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1 from kernel in cpuif reset * MAINTAINERS: Claim the Arm XML in gdb-xml * hw/net/rocker: Don't overflow in of_dpa_mask2prefix() ---------------------------------------------------------------- Peter Maydell (9): hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0 hw/intc/arm_gicv3_kvm: Drop DPRINTF macro target/arm: Fix reads of CNTFRQ_EL0 in linux-user mode hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1 from kernel in cpuif reset MAINTAINERS: Claim the Arm XML in gdb-xml target/arm: Implement SME2 support in gdbstub target/arm: Implement org.gnu.gdb.aarch64.tls XML feature in gdbstub tests/tcg/aarch64: Add test case for SME2 gdbstub registers hw/net/rocker: Don't overflow in of_dpa_mask2prefix() Richard Henderson (7): target/arm: Add isar feature test for FEAT_AIE target/arm: Implement MAIR2_ELx and AMAIR2_ELx target/arm: Add AIE to ARMVAParameters target/arm: Drop trivial assert vs attrindx target/arm: Use el local indexing mair_el target/arm: Honor param.aie in get_phys_addr_lpae target/arm: Enable FEAT_AIE for -cpu max MAINTAINERS | 2 + docs/system/arm/emulation.rst | 1 + configs/targets/aarch64-bsd-user.mak | 2 +- configs/targets/aarch64-linux-user.mak | 2 +- configs/targets/aarch64-softmmu.mak | 2 +- configs/targets/aarch64_be-linux-user.mak | 2 +- hw/intc/gicv3_internal.h | 1 + include/hw/intc/arm_gicv3_common.h | 3 + target/arm/cpregs.h | 2 + target/arm/cpu-features.h | 5 ++ target/arm/cpu.h | 6 +- target/arm/internals.h | 6 ++ hw/intc/arm_gicv3_dist.c | 9 +++ hw/intc/arm_gicv3_kvm.c | 62 +++++++++------- hw/net/rocker/rocker_of_dpa.c | 11 +-- target/arm/cpu.c | 3 + target/arm/gdbstub.c | 12 ++++ target/arm/gdbstub64.c | 115 ++++++++++++++++++++++++++++++ target/arm/helper.c | 94 +++++++++++++++++++++--- target/arm/ptw.c | 5 +- target/arm/tcg/cpu64.c | 1 + gdb-xml/aarch64-sme2.xml | 14 ++++ tests/tcg/aarch64/Makefile.target | 9 ++- tests/tcg/aarch64/gdbstub/test-sme2.py | 36 ++++++++++ 24 files changed, 350 insertions(+), 55 deletions(-) create mode 100644 gdb-xml/aarch64-sme2.xml create mode 100644 tests/tcg/aarch64/gdbstub/test-sme2.py The GIC distributor registers GICD_TYPER2 is present when the GICv4.1 is implemented, and RES0 otherwise. QEMU's TCG implementation is only GICv4.0, so this register is RES0. However, since it's reasonable for GICv4.1-aware software to read the register, expecting the zero for GICv3 and GICv4.0, implement the case to avoid it being logged as an invalid guest read. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> --- hw/intc/gicv3_internal.h | 1 + hw/intc/arm_gicv3_dist.c | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/gicv3_internal.h +++ b/hw/intc/gicv3_internal.h @@ -XXX,XX +XXX,XX @@ #define GICD_CTLR 0x0000 #define GICD_TYPER 0x0004 #define GICD_IIDR 0x0008 +#define GICD_TYPER2 0x000C #define GICD_STATUSR 0x0010 #define GICD_SETSPI_NSR 0x0040 #define GICD_CLRSPI_NSR 0x0048 diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/arm_gicv3_dist.c +++ b/hw/intc/arm_gicv3_dist.c @@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset, (0xf << 19) | itlinesnumber; return true; } + case GICD_TYPER2: + /* + * This register only exists for GICv4.1, which QEMU doesn't + * currently emulate. On GICv3 and GICv4 it's defined to be RES0. + * We implement as read-zero here to avoid tracing a bad-register-read + * if GICv4.1-aware software reads this ID register. + */ + *data = 0; + return true; case GICD_IIDR: /* We claim to be an ARM r0p0 with a zero ProductID. * This is the same as an r0p0 GIC-500. -- 2.43.0 We don't generally like DPRINTF debug macros, preferring tracepoints. In this case the macro is used in only three places (reset, realize, and in the unlikely event the host kernel doesn't have GICv3 register access support). These don't seem worth converting to tracepoints, so simply delete the macro and its uses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> --- hw/intc/arm_gicv3_kvm.c | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/arm_gicv3_kvm.c +++ b/hw/intc/arm_gicv3_kvm.c @@ -XXX,XX +XXX,XX @@ #include "target/arm/cpregs.h" -#ifdef DEBUG_GICV3_KVM -#define DPRINTF(fmt, ...) \ - do { fprintf(stderr, "kvm_gicv3: " fmt, ## __VA_ARGS__); } while (0) -#else -#define DPRINTF(fmt, ...) \ - do { } while (0) -#endif - #define TYPE_KVM_ARM_GICV3 "kvm-arm-gicv3" typedef struct KVMARMGICv3Class KVMARMGICv3Class; /* This is reusing the GICv3State typedef from ARM_GICV3_ITS_COMMON */ @@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_reset_hold(Object *obj, ResetType type) GICv3State *s = ARM_GICV3_COMMON(obj); KVMARMGICv3Class *kgc = KVM_ARM_GICV3_GET_CLASS(s); - DPRINTF("Reset\n"); - if (kgc->parent_phases.hold) { kgc->parent_phases.hold(obj, type); } if (s->migration_blocker) { - DPRINTF("Cannot put kernel gic state, no kernel interface\n"); return; } @@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp) Error *local_err = NULL; int i; - DPRINTF("kvm_arm_gicv3_realize\n"); - kgc->parent_realize(dev, &local_err); if (local_err) { error_propagate(errp, local_err); -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/cpu-features.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu-features.h +++ b/target/arm/cpu-features.h @@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_s2pie(const ARMISARegisters *id) return FIELD_EX64_IDREG(id, ID_AA64MMFR3, S2PIE) != 0; } +static inline bool isar_feature_aa64_aie(const ARMISARegisters *id) +{ + return FIELD_EX64_IDREG(id, ID_AA64MMFR3, AIE) != 0; +} + static inline bool isar_feature_aa64_mec(const ARMISARegisters *id) { return FIELD_EX64_IDREG(id, ID_AA64MMFR3, MEC) != 0; -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> Enable the SCR.AIEn bit in scr_write, and test it in aien_access. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/cpregs.h | 2 ++ target/arm/cpu.h | 5 +++- target/arm/cpu.c | 3 +++ target/arm/helper.c | 62 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 71 insertions(+), 1 deletion(-) diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpregs.h +++ b/target/arm/cpregs.h @@ -XXX,XX +XXX,XX @@ typedef enum FGTBit { DO_REV_BIT(HFGRTR, NTPIDR2_EL0), DO_REV_BIT(HFGRTR, NPIRE0_EL1), DO_REV_BIT(HFGRTR, NPIR_EL1), + DO_REV_BIT(HFGRTR, NMAIR2_EL1), + DO_REV_BIT(HFGRTR, NAMAIR2_EL1), /* Trap bits in HDFGRTR_EL2 / HDFGWTR_EL2, starting from bit 0. */ DO_BIT(HDFGRTR, DBGBCRN_EL1), diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState { uint64_t c9_pmuserenr; /* perf monitor user enable */ uint64_t c9_pmselr; /* perf monitor counter selection register */ uint64_t c9_pminten; /* perf monitor interrupt enables */ - union { /* Memory attribute redirection */ + /* Memory attribute redirection */ + union { struct { #if HOST_BIG_ENDIAN uint64_t _unused_mair_0; @@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState { }; uint64_t mair_el[4]; }; + uint64_t mair2_el[4]; union { /* vector base address register */ struct { uint64_t _unused_vbar; @@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask) #define SCR_TCR2EN (1ULL << 43) #define SCR_SCTLR2EN (1ULL << 44) #define SCR_PIEN (1ULL << 45) +#define SCR_AIEN (1ULL << 46) #define SCR_GPF (1ULL << 48) #define SCR_MECEN (1ULL << 49) #define SCR_NSE (1ULL << 62) diff --git a/target/arm/cpu.c b/target/arm/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -XXX,XX +XXX,XX @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el) cpu_isar_feature(aa64_s2pie, cpu)) { env->cp15.scr_el3 |= SCR_PIEN; } + if (cpu_isar_feature(aa64_aie, cpu)) { + env->cp15.scr_el3 |= SCR_AIEN; + } if (cpu_isar_feature(aa64_mec, cpu)) { env->cp15.scr_el3 |= SCR_MECEN; } diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) cpu_isar_feature(aa64_s2pie, cpu)) { valid_mask |= SCR_PIEN; } + if (cpu_isar_feature(aa64_aie, cpu)) { + valid_mask |= SCR_AIEN; + } if (cpu_isar_feature(aa64_mec, cpu)) { valid_mask |= SCR_MECEN; } @@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo s2pie_reginfo[] = { .fieldoffset = offsetof(CPUARMState, cp15.s2pir_el2) }, }; +static CPAccessResult aien_access(CPUARMState *env, const ARMCPRegInfo *ri, + bool isread) +{ + if (arm_feature(env, ARM_FEATURE_EL3) + && !(env->cp15.scr_el3 & SCR_AIEN) + && arm_current_el(env) < 3) { + return CP_ACCESS_TRAP_EL3; + } + return CP_ACCESS_OK; +} + +static CPAccessResult aien_el1_access(CPUARMState *env, const ARMCPRegInfo *ri, + bool isread) +{ + CPAccessResult ret = access_tvm_trvm(env, ri, isread); + if (ret == CP_ACCESS_OK) { + ret = aien_access(env, ri, isread); + } + return ret; +} + +static const ARMCPRegInfo aie_reginfo[] = { + { .name = "MAIR2_EL1", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1, + .access = PL1_RW, .accessfn = aien_el1_access, + .fgt = FGT_NMAIR2_EL1, .nv2_redirect_offset = 0x280 | NV2_REDIR_NV1, + .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 1, 1), + .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 1), + .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[1]) }, + { .name = "MAIR2_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 1, .opc2 = 1, + .access = PL2_RW, .accessfn = aien_access, + .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[2]) }, + { .name = "MAIR2_EL3", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 1, .opc2 = 1, + .access = PL3_RW, + .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[3]) }, + + { .name = "AMAIR2_EL1", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 3, .opc2 = 1, + .access = PL1_RW, .accessfn = aien_el1_access, + .fgt = FGT_NAMAIR2_EL1, .nv2_redirect_offset = 0x288 | NV2_REDIR_NV1, + .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 3, 1), + .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 3, 1), + .type = ARM_CP_CONST, .resetvalue = 0 }, + { .name = "AMAIR2_EL2", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1, + .access = PL2_RW, .accessfn = aien_access, + .type = ARM_CP_CONST, .resetvalue = 0 }, + { .name = "AMAIR2_EL3", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 1, + .access = PL3_RW, + .type = ARM_CP_CONST, .resetvalue = 0 }, +}; + void register_cp_regs_for_features(ARMCPU *cpu) { /* Register all the coprocessor registers based on feature bits */ @@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu) } } + if (cpu_isar_feature(aa64_aie, cpu)) { + define_arm_cp_regs(cpu, aie_reginfo); + } + if (cpu_isar_feature(any_predinv, cpu)) { define_arm_cp_regs(cpu, predinv_reginfo); } -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> Allow the bit to be set in TCR2; extract the bit in aa64_va_parameters. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/internals.h | 1 + target/arm/helper.c | 30 +++++++++++++++++++++--------- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters { bool hd : 1; ARMGranuleSize gran : 2; bool pie : 1; + bool aie : 1; } ARMVAParameters; /** diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void tcr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri, if (cpu_isar_feature(aa64_s1pie, cpu)) { valid_mask |= TCR2_PIE; } + if (cpu_isar_feature(aa64_aie, cpu)) { + valid_mask |= TCR2_AIE; + } value &= valid_mask; raw_write(env, ri, value); } @@ -XXX,XX +XXX,XX @@ static void tcr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri, if (cpu_isar_feature(aa64_s1pie, cpu)) { valid_mask |= TCR2_PIE; } - if (cpu_isar_feature(aa64_mec, env_archcpu(env))) { + if (cpu_isar_feature(aa64_aie, cpu)) { + valid_mask |= TCR2_AIE; + } + if (cpu_isar_feature(aa64_mec, cpu)) { valid_mask |= TCR2_AMEC0 | TCR2_AMEC1; } value &= valid_mask; @@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, { uint64_t tcr = regime_tcr(env, mmu_idx); bool epd, hpd, tsz_oob, ds, ha, hd, pie = false; + bool aie = false; int select, tsz, tbi, max_tsz, min_tsz, ps, sh; ARMGranuleSize gran; ARMCPU *cpu = env_archcpu(env); @@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, if (r_el == 3) { pie = (extract64(tcr, 35, 1) && cpu_isar_feature(aa64_s1pie, cpu)); - } else { - pie = ((env->cp15.tcr2_el[2] & TCR2_PIE) - && (!arm_feature(env, ARM_FEATURE_EL3) - || (env->cp15.scr_el3 & SCR_TCR2EN))); + aie = (extract64(tcr, 37, 1) + && cpu_isar_feature(aa64_aie, cpu)); + } else if (!arm_feature(env, ARM_FEATURE_EL3) + || (env->cp15.scr_el3 & SCR_TCR2EN)) { + pie = env->cp15.tcr2_el[2] & TCR2_PIE; + aie = env->cp15.tcr2_el[2] & TCR2_AIE; } } epd = false; @@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, epd = true; } - pie = ((env->cp15.tcr2_el[r_el] & TCR2_PIE) - && (!arm_feature(env, ARM_FEATURE_EL3) - || (env->cp15.scr_el3 & SCR_TCR2EN)) - && (r_el == 2 || (arm_hcrx_el2_eff(env) & HCRX_TCR2EN))); + if ((!arm_feature(env, ARM_FEATURE_EL3) + || (env->cp15.scr_el3 & SCR_TCR2EN)) + && (r_el == 2 || (arm_hcrx_el2_eff(env) & HCRX_TCR2EN))) { + pie = env->cp15.tcr2_el[r_el] & TCR2_PIE; + aie = env->cp15.tcr2_el[r_el] & TCR2_AIE; + } } hpd |= pie; @@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, .hd = ha && hd, .gran = gran, .pie = pie, + .aie = aie, }; } -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> We just extracted 3 bits; the <= 7 test is trivially true. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/ptw.c | 1 - 1 file changed, 1 deletion(-) diff --git a/target/arm/ptw.c b/target/arm/ptw.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, /* Index into MAIR registers for cache attributes */ attrindx = extract32(attrs, 2, 3); mair = env->cp15.mair_el[regime_el(mmu_idx)]; - assert(attrindx <= 7); result->cacheattrs.is_s2_format = false; result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> We already have regime_el() computed to a local. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/ptw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/ptw.c b/target/arm/ptw.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, /* Index into MAIR registers for cache attributes */ attrindx = extract32(attrs, 2, 3); - mair = env->cp15.mair_el[regime_el(mmu_idx)]; + mair = env->cp15.mair_el[el]; result->cacheattrs.is_s2_format = false; result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/ptw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/target/arm/ptw.c b/target/arm/ptw.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, /* Index into MAIR registers for cache attributes */ attrindx = extract32(attrs, 2, 3); - mair = env->cp15.mair_el[el]; + mair = (param.aie && extract64(attrs, 59, 1) + ? env->cp15.mair2_el[el] + : env->cp15.mair_el[el]); result->cacheattrs.is_s2_format = false; result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); -- 2.43.0 From: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251014195017.421681-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- docs/system/arm/emulation.rst | 1 + target/arm/tcg/cpu64.c | 1 + 2 files changed, 2 insertions(+) diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst index XXXXXXX..XXXXXXX 100644 --- a/docs/system/arm/emulation.rst +++ b/docs/system/arm/emulation.rst @@ -XXX,XX +XXX,XX @@ the following architecture extensions: - FEAT_AdvSIMD (Advanced SIMD Extension) - FEAT_AES (AESD and AESE instructions) - FEAT_AFP (Alternate floating-point behavior) +- FEAT_AIE (Memory Attribute Index Enhancement) - FEAT_Armv9_Crypto (Armv9 Cryptographic Extension) - FEAT_ASID16 (16 bit ASID) - FEAT_ATS1A (Address Translation operations that ignore stage 1 permissions) diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/tcg/cpu64.c +++ b/target/arm/tcg/cpu64.c @@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj) t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */ t = FIELD_DP64(t, ID_AA64MMFR3, S1PIE, 1); /* FEAT_S1PIE */ t = FIELD_DP64(t, ID_AA64MMFR3, S2PIE, 1); /* FEAT_S2PIE */ + t = FIELD_DP64(t, ID_AA64MMFR3, AIE, 1); /* FEAT_AIE */ SET_IDREG(isar, ID_AA64MMFR3, t); t = GET_IDREG(isar, ID_AA64ZFR0); -- 2.43.0 In commit bd8e9ddf6f6 ("target/arm: Refactor default generic timer frequency handling") we changed how we initialized the generic timer frequency as reported in the CNTFRQ_EL0 register. As part of that, we chanegd the linux-user version of the CNTFRQ_EL0 sysreg from having a constant value set at compile time through the .resetvalue field to having a reset value which we compute in a .resetfn. This accidentally broke the reading of CNTFRQ_EL0 in linux-user mode, because the cpreg is marked as ARM_CP_CONST, which means we translate it as a read of the compile-time constant value in the .resetvalue field. This is now zero, so userspace sees a 0 frequency value. Fix the bug by dropping the ARM_CP_CONST marking. This will cause us to translate the read as a load of the value from the CPU state struct cp15.c14_cntfrq field, which is where the real frequency value now lives. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3159 Fixes: bd8e9ddf6f6 ("target/arm: Refactor default generic timer frequency handling") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251013161040.216819-1-peter.maydell@linaro.org --- target/arm/helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri) static const ARMCPRegInfo generic_timer_cp_reginfo[] = { { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64, .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0, - .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */, + .access = PL0_R /* no PL1_RW in linux-user */, .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq), .resetfn = arm_gt_cntfrq_reset, }, -- 2.43.0 Currently in arm_gicv3_icc_reset() we read the kernel's value of ICC_CTLR_EL1 as part of resetting the CPU interface. This mostly works, but we're actually breaking an assumption the kernel makes that userspace only accesses the in-kernel GIC data when the VM is totally paused, which may not be the case if a single vCPU is being reset. The effect is that it's possible that the read attempt returns EBUSY. Avoid this by reading the kernel's value of the reset ICC_CTLR_EL1 once in device realize. This brings ICC_CTLR_EL1 into line with the other cpuif registers, where we assume we know what the kernel is resetting them to and just update QEMU's data structures in arm_gicv3_icc_reset(). Reviewed-by: Salil Mehta <salil.mehta@huawei.com> Tested-by: Salil Mehta <salil.mehta@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20251014102439.319915-1-peter.maydell@linaro.org --- include/hw/intc/arm_gicv3_common.h | 3 ++ hw/intc/arm_gicv3_kvm.c | 49 +++++++++++++++++++++--------- 2 files changed, 38 insertions(+), 14 deletions(-) diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/intc/arm_gicv3_common.h +++ b/include/hw/intc/arm_gicv3_common.h @@ -XXX,XX +XXX,XX @@ struct GICv3CPUState { uint64_t icc_igrpen[3]; uint64_t icc_ctlr_el3; + /* For KVM, cached copy of the kernel reset value of ICC_CTLR_EL1 */ + uint64_t kvm_reset_icc_ctlr_el1; + /* Virtualization control interface */ uint64_t ich_apr[3][4]; /* ich_apr[GICV3_G1][x] never used */ uint64_t ich_hcr_el2; diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/arm_gicv3_kvm.c +++ b/hw/intc/arm_gicv3_kvm.c @@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_get(GICv3State *s) static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri) { - GICv3State *s; - GICv3CPUState *c; + GICv3CPUState *c = (GICv3CPUState *)env->gicv3state; - c = (GICv3CPUState *)env->gicv3state; - s = c->gic; + /* + * This function is called when each vcpu resets. The kernel + * API for the GIC assumes that it is only to be used when the + * whole VM is paused, so if we attempt to read the kernel's + * reset values here we might get EBUSY failures. + * So instead we assume we know what the kernel's reset values + * are (mostly zeroes) and only update the QEMU state struct + * fields. The exception is that we do need to know the kernel's + * idea of the ICC_CTLR_EL1 reset value, so we cache that at + * device realize time. + * + * This makes these sysregs different from the usual CPU ones, + * which can be validly read and written when only the single + * vcpu they apply to is paused, and where (in target/arm code) + * we read the reset values out of the kernel on every reset. + */ c->icc_pmr_el1 = 0; /* @@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri) memset(c->icc_apr, 0, sizeof(c->icc_apr)); memset(c->icc_igrpen, 0, sizeof(c->icc_igrpen)); - if (s->migration_blocker) { - return; - } - - /* Initialize to actual HW supported configuration */ - kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS, - KVM_VGIC_ATTR(ICC_CTLR_EL1, c->gicr_typer), - &c->icc_ctlr_el1[GICV3_NS], false, &error_abort); - - c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS]; + c->icc_ctlr_el1[GICV3_NS] = c->kvm_reset_icc_ctlr_el1; + c->icc_ctlr_el1[GICV3_S] = c->kvm_reset_icc_ctlr_el1; } static void kvm_arm_gicv3_reset_hold(Object *obj, ResetType type) @@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp) kvm_arm_gicv3_notifier, MIG_MODE_CPR_TRANSFER); } + + /* + * Now we can read the kernel's initial value of ICC_CTLR_EL1, which + * we will need if a CPU interface is reset. If the kernel is ancient + * and doesn't support writing the GIC state then we don't need to + * care what reset does to QEMU's data structures. + */ + if (!s->migration_blocker) { + for (i = 0; i < s->num_cpu; i++) { + GICv3CPUState *c = &s->cpu[i]; + + kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS, + KVM_VGIC_ATTR(ICC_CTLR_EL1, c->gicr_typer), + &c->kvm_reset_icc_ctlr_el1, false, &error_abort); + } + } } static void kvm_arm_gicv3_class_init(ObjectClass *klass, const void *data) -- 2.43.0 Add F: entries to the Arm CPU section to claim the Arm related XML files in gdb-xml. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20251017154244.971608-1-peter.maydell@linaro.org --- MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: hw/cpu/a*mpcore.c F: include/hw/cpu/a*mpcore.h F: docs/system/target-arm.rst F: docs/system/arm/cpu-features.rst +F: gdb-xml/arm*.xml +F: gdb-xml/aarch64*.xml ARM SMMU M: Eric Auger <eric.auger@redhat.com> -- 2.43.0 For SME2, we need to expose the new ZT0 register in the gdbstub XML. gdb documents that the requirements are: > The ‘org.gnu.gdb.aarch64.sme2’ feature is optional. If present, > then the ‘org.gnu.gdb.aarch64.sme’ feature must also be present. > The ‘org.gnu.gdb.aarch64.sme2’ feature should contain the > following: > > - ZT0 is a register of 512 bits (64 bytes). It is defined as a > vector of bytes. Implement this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20251017153027.969016-2-peter.maydell@linaro.org --- configs/targets/aarch64-bsd-user.mak | 2 +- configs/targets/aarch64-linux-user.mak | 2 +- configs/targets/aarch64-softmmu.mak | 2 +- configs/targets/aarch64_be-linux-user.mak | 2 +- target/arm/internals.h | 2 + target/arm/gdbstub.c | 6 +++ target/arm/gdbstub64.c | 52 +++++++++++++++++++++++ gdb-xml/aarch64-sme2.xml | 14 ++++++ 8 files changed, 78 insertions(+), 4 deletions(-) create mode 100644 gdb-xml/aarch64-sme2.xml diff --git a/configs/targets/aarch64-bsd-user.mak b/configs/targets/aarch64-bsd-user.mak index XXXXXXX..XXXXXXX 100644 --- a/configs/targets/aarch64-bsd-user.mak +++ b/configs/targets/aarch64-bsd-user.mak @@ -XXX,XX +XXX,XX @@ TARGET_ARCH=aarch64 TARGET_BASE_ARCH=arm -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-sme2.xml TARGET_LONG_BITS=64 diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak index XXXXXXX..XXXXXXX 100644 --- a/configs/targets/aarch64-linux-user.mak +++ b/configs/targets/aarch64-linux-user.mak @@ -XXX,XX +XXX,XX @@ TARGET_ARCH=aarch64 TARGET_BASE_ARCH=arm -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml gdb-xml/aarch64-sme2.xml TARGET_HAS_BFLT=y CONFIG_SEMIHOSTING=y CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak index XXXXXXX..XXXXXXX 100644 --- a/configs/targets/aarch64-softmmu.mak +++ b/configs/targets/aarch64-softmmu.mak @@ -XXX,XX +XXX,XX @@ TARGET_ARCH=aarch64 TARGET_BASE_ARCH=arm TARGET_KVM_HAVE_GUEST_DEBUG=y -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-sme2.xml # needed by boot.c TARGET_NEED_FDT=y TARGET_LONG_BITS=64 diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak index XXXXXXX..XXXXXXX 100644 --- a/configs/targets/aarch64_be-linux-user.mak +++ b/configs/targets/aarch64_be-linux-user.mak @@ -XXX,XX +XXX,XX @@ TARGET_ARCH=aarch64 TARGET_BASE_ARCH=arm TARGET_BIG_ENDIAN=y -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml gdb-xml/aarch64-sme2.xml TARGET_HAS_BFLT=y CONFIG_SEMIHOSTING=y CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg); int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg); +int aarch64_gdb_get_sme2_reg(CPUState *cs, GByteArray *buf, int reg); +int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg); int aarch64_gdb_get_fpu_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_fpu_reg(CPUState *cs, uint8_t *buf, int reg); int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg); diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/gdbstub.c +++ b/target/arm/gdbstub.c @@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) arm_gen_dynamic_smereg_feature(cs, cs->gdb_num_regs); gdb_register_coprocessor(cs, aarch64_gdb_get_sme_reg, aarch64_gdb_set_sme_reg, sme_feature, 0); + if (isar_feature_aa64_sme2(&cpu->isar)) { + gdb_register_coprocessor(cs, aarch64_gdb_get_sme2_reg, + aarch64_gdb_set_sme2_reg, + gdb_find_static_feature("aarch64-sme2.xml"), + 0); + } } /* * Note that we report pauth information via the feature name diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/gdbstub64.c +++ b/target/arm/gdbstub64.c @@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg) return 0; } +int aarch64_gdb_get_sme2_reg(CPUState *cs, GByteArray *buf, int reg) +{ + ARMCPU *cpu = ARM_CPU(cs); + CPUARMState *env = &cpu->env; + int len = 0; + + switch (reg) { + case 0: /* ZT0 */ + for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i += 2) { + len += gdb_get_reg128(buf, env->za_state.zt0[i + 1], + env->za_state.zt0[i]); + } + return len; + default: + /* gdbstub asked for something out of range */ + qemu_log_mask(LOG_UNIMP, "%s: out of range register %d", __func__, reg); + break; + } + + return 0; +} + +int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg) +{ + ARMCPU *cpu = ARM_CPU(cs); + CPUARMState *env = &cpu->env; + int len = 0; + + switch (reg) { + case 0: /* ZT0 */ + for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i += 2) { + if (target_big_endian()) { + env->za_state.zt0[i + 1] = ldq_p(buf); + buf += 8; + env->za_state.zt0[i] = ldq_p(buf); + } else { + env->za_state.zt0[i] = ldq_p(buf); + buf += 8; + env->za_state.zt0[i + 1] = ldq_p(buf); + } + buf += 8; + len += 16; + } + return len; + default: + /* gdbstub asked for something out of range */ + break; + } + + return 0; +} + int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg) { ARMCPU *cpu = ARM_CPU(cs); diff --git a/gdb-xml/aarch64-sme2.xml b/gdb-xml/aarch64-sme2.xml new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/gdb-xml/aarch64-sme2.xml @@ -XXX,XX +XXX,XX @@ +<?xml version="1.0"?> +<!-- Copyright (C) 2025 Linaro Ltd. + + SPDX-License-Identifier: GPL-2.0-or-later + + This is the SME2 ZT0 register. Upstream GDB dynamically generates + the XML for this feature, but because the vector is always 64 bytes + in size we prefer to use static XML for it. + --> +<!DOCTYPE feature SYSTEM "gdb-target.dtd"> +<feature name="org.gnu.gdb.aarch64.sme2"> + <vector id="sme2_bv" type="uint8" count="64"/> + <reg name="zt0" bitsize="512" type="sme2_bv"/> +</feature> -- 2.43.0 GDB expects the TLS registers to be exposed via org.gnu.gdb.aarch64.tls, which will contain either just "tpidr", or else "tpidr" and "tpidr2". This will be important for SME in future, because the lazy state restoration scheme requires GDB to use the TPIDR2 information. GDB doesn't currently implement that, but we should provide the register via the XML so that we are ready when future GDB versions support it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20251017153027.969016-3-peter.maydell@linaro.org --- target/arm/cpu.h | 1 + target/arm/internals.h | 3 ++ target/arm/gdbstub.c | 6 ++++ target/arm/gdbstub64.c | 63 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 73 insertions(+) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ struct ArchCPU { DynamicGDBFeatureInfo dyn_smereg_feature; DynamicGDBFeatureInfo dyn_m_systemreg_feature; DynamicGDBFeatureInfo dyn_m_secextreg_feature; + DynamicGDBFeatureInfo dyn_tls_feature; /* Timers used by the generic (architected) timer */ QEMUTimer *gt_timer[NUM_GTIMERS]; diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env) GDBFeature *arm_gen_dynamic_svereg_feature(CPUState *cpu, int base_reg); GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cpu, int base_reg); +GDBFeature *arm_gen_dynamic_tls_feature(CPUState *cpu, int base_reg); int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg); int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg); @@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_pauth_reg(CPUState *cs, uint8_t *buf, int reg); int aarch64_gdb_get_tag_ctl_reg(CPUState *cs, GByteArray *buf, int reg); int aarch64_gdb_set_tag_ctl_reg(CPUState *cs, uint8_t *buf, int reg); +int aarch64_gdb_get_tls_reg(CPUState *cs, GByteArray *buf, int reg); +int aarch64_gdb_set_tls_reg(CPUState *cs, uint8_t *buf, int reg); void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp); void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp); void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp); diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/gdbstub.c +++ b/target/arm/gdbstub.c @@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu) 0); } #endif + + /* All AArch64 CPUs have at least TPIDR */ + gdb_register_coprocessor(cs, aarch64_gdb_get_tls_reg, + aarch64_gdb_set_tls_reg, + arm_gen_dynamic_tls_feature(cs, cs->gdb_num_regs), + 0); #endif } else { if (arm_feature(env, ARM_FEATURE_NEON)) { diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/gdbstub64.c +++ b/target/arm/gdbstub64.c @@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg) return 0; } +int aarch64_gdb_get_tls_reg(CPUState *cs, GByteArray *buf, int reg) +{ + ARMCPU *cpu = ARM_CPU(cs); + CPUARMState *env = &cpu->env; + + switch (reg) { + case 0: /* TPIDR_EL0 */ + return gdb_get_reg64(buf, env->cp15.tpidr_el[0]); + case 1: /* TPIDR2_EL0 */ + return gdb_get_reg64(buf, env->cp15.tpidr2_el0); + default: + /* gdbstub asked for something out of range */ + break; + } + + return 0; +} + +int aarch64_gdb_set_tls_reg(CPUState *cs, uint8_t *buf, int reg) +{ + ARMCPU *cpu = ARM_CPU(cs); + CPUARMState *env = &cpu->env; + + switch (reg) { + case 0: /* TPIDR_EL0 */ + env->cp15.tpidr_el[0] = ldq_p(buf); + return 8; + case 1: /* TPIDR2_EL0 */ + env->cp15.tpidr2_el0 = ldq_p(buf); + return 8; + default: + /* gdbstub asked for something out of range */ + break; + } + + return 0; +} + int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg) { ARMCPU *cpu = ARM_CPU(cs); @@ -XXX,XX +XXX,XX @@ GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cs, int base_reg) return &cpu->dyn_smereg_feature.desc; } +GDBFeature *arm_gen_dynamic_tls_feature(CPUState *cs, int base_reg) +{ + ARMCPU *cpu = ARM_CPU(cs); + GDBFeatureBuilder builder; + int reg = 0; + + gdb_feature_builder_init(&builder, &cpu->dyn_tls_feature.desc, + "org.gnu.gdb.aarch64.tls", "tls-registers.xml", + base_reg); + + /* + * This feature must always have "tpidr", and may also have "tpidr2" + * if the CPU has that register. + */ + gdb_feature_builder_append_reg(&builder, "tpidr", 64, + reg++, "data_ptr", NULL); + if (cpu_isar_feature(aa64_sme, cpu)) { + gdb_feature_builder_append_reg(&builder, "tpidr2", 64, + reg++, "data_ptr", NULL); + } + gdb_feature_builder_end(&builder); + + return &cpu->dyn_tls_feature.desc; +} + #ifdef CONFIG_USER_ONLY int aarch64_gdb_get_tag_ctl_reg(CPUState *cs, GByteArray *buf, int reg) { -- 2.43.0 Test the SME2 register exposure over gdbstub, in the same way we already do for SME. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20251017153027.969016-4-peter.maydell@linaro.org --- tests/tcg/aarch64/Makefile.target | 9 ++++++- tests/tcg/aarch64/gdbstub/test-sme2.py | 36 ++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 tests/tcg/aarch64/gdbstub/test-sme2.py diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/tests/tcg/aarch64/Makefile.target +++ b/tests/tcg/aarch64/Makefile.target @@ -XXX,XX +XXX,XX @@ run-gdbstub-sysregs-sme-tile-slice: sysregs "selected gdb ($(GDB)) does not support SME ZA tile slices") endif -EXTRA_RUNS += run-gdbstub-sysregs-sme run-gdbstub-sysregs-sme-tile-slice +run-gdbstub-sysregs-sme2: sysregs + $(call run-test, $@, $(GDB_SCRIPT) \ + --gdb $(GDB) \ + --qemu $(QEMU) --qargs "$(QEMU_OPTS)" \ + --bin $< --test $(AARCH64_SRC)/gdbstub/test-sme2.py, \ + gdbstub SME ZA tile slice support) + +EXTRA_RUNS += run-gdbstub-sysregs-sme run-gdbstub-sysregs-sme-tile-slice run-gdbstub-sysregs-sme2 endif diff --git a/tests/tcg/aarch64/gdbstub/test-sme2.py b/tests/tcg/aarch64/gdbstub/test-sme2.py new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/tcg/aarch64/gdbstub/test-sme2.py @@ -XXX,XX +XXX,XX @@ +# +# Copyright (C) 2025 Linaro Ltd. +# +# SPDX-License-Identifier: GPL-2.0-or-later + +# +# Test the SME2 registers are visible and changeable via gdbstub +# +# This is launched via tests/guest-debug/run-test.py +# + +import gdb +from test_gdbstub import main, report + + +def run_test(): + """Test reads and writes of the SME2 registers""" + frame = gdb.selected_frame() + rname = "zt0" + zt0 = frame.read_register(rname) + report(True, "Reading %s" % rname) + + # Writing to the ZT0 register, byte by byte. + for i in range(0, 64): + cmd = "set $zt0[%d] = 0x01" % (i) + gdb.execute(cmd) + report(True, "%s" % cmd) + + # Reading from the ZT0 register, byte by byte. + for i in range(0, 64): + reg = "$zt0[%d]" % (i) + v = gdb.parse_and_eval(reg) + report(str(v.type) == "uint8_t", "size of %s" % (reg)) + report(v == 0x1, "%s is 0x%x" % (reg, 0x1)) + +main(run_test, expected_arch="aarch64") -- 2.43.0 In of_dpa_mask2prefix() we do "(2 << i)" for a loop where i can go up to 31. At i == 31 we shift off the top end of an integer. This doesn't actually calculate the wrong value in practice, because we calculate 0 - 1 which is the 0xffffffff mask we wanted (and for QEMU shifting off the top of a signed integer is not UB); but it makes Coverity complain. We could fix this simply by using "2ULL" (where the "(2ULL << i) - 1" expression also evaluates to 0xffffffff for i == 31), but in fact this function is a slow looping implementation of counting the number of trailing zeroes in the (network-order) input mask: 0bxxxxxxxxx1 => 32 0bxxxxxxxx10 => 31 0bxxxxxxx100 => 30 ... 0bx100000000 => 2 0b1000000000 => 1 0b0000000000 => 0 Replace the implementation with 32 - ctz32(). Coverity: CID 1547602 Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20251016145407.781978-1-peter.maydell@linaro.org --- hw/net/rocker/rocker_of_dpa.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c index XXXXXXX..XXXXXXX 100644 --- a/hw/net/rocker/rocker_of_dpa.c +++ b/hw/net/rocker/rocker_of_dpa.c @@ -XXX,XX +XXX,XX @@ typedef struct of_dpa_group { static int of_dpa_mask2prefix(uint32_t mask) { - int i; - int count = 32; - - for (i = 0; i < 32; i++) { - if (!(ntohl(mask) & ((2 << i) - 1))) { - count--; - } - } - - return count; + return 32 - ctz32(ntohl(mask)); } #if defined(DEBUG_ROCKER) -- 2.43.0 v3->v4: Windows headers define an INT type which clashed with an enum value name in arm_gicv3_its.c... The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5: Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100) are available in the Git repository at: https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913-3 for you to fetch changes up to 28e987a7e7edaa3ca7feeac65edca26145df8814: hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 21:01:08 +0100) ---------------------------------------------------------------- target-arm queue: * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command line user-created devices are not plugged into them * Take an exception if PSTATE.IL is set * Support an emulated ITS in the virt board * Add support for kudo-bmc board * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM * cadence_uart: Fix clock handling issues that prevented u-boot from running ---------------------------------------------------------------- Bin Meng (6): hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase hw/char: cadence_uart: Disable transmit when input clock is disabled hw/char: cadence_uart: Move clock/reset check to uart_can_receive() hw/char: cadence_uart: Convert to memop_with_attrs() ops hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}() hw/char: cadence_uart: Log a guest error when device is unclocked or in reset Chris Rauer (1): hw/arm: Add support for kudo-bmc board. Marc Zyngier (1): hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM Peter Maydell (5): target/arm: Take an exception if PSTATE.IL is set qdev: Support marking individual buses as 'full' hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full' hw/arm/mps2.c: Mark internal-only I2C buses as 'full' Richard Henderson (1): target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn Shashi Mallela (9): hw/intc: GICv3 ITS initial framework hw/intc: GICv3 ITS register definitions added hw/intc: GICv3 ITS command queue framework hw/intc: GICv3 ITS Command processing hw/intc: GICv3 ITS Feature enablement hw/intc: GICv3 redistributor ITS processing tests/data/acpi/virt: Add IORT files for ITS hw/arm/virt: add ITS support in virt GIC tests/data/acpi/virt: Update IORT files for ITS docs/system/arm/nuvoton.rst | 1 + hw/intc/gicv3_internal.h | 188 ++++- include/hw/arm/virt.h | 2 + include/hw/intc/arm_gicv3_common.h | 13 + include/hw/intc/arm_gicv3_its_common.h | 32 +- include/hw/qdev-core.h | 24 + target/arm/cpu.h | 1 + target/arm/kvm_arm.h | 4 +- target/arm/syndrome.h | 5 + target/arm/translate.h | 2 + hw/arm/mps2-tz.c | 92 ++- hw/arm/mps2.c | 12 +- hw/arm/npcm7xx_boards.c | 34 + hw/arm/virt.c | 29 +- hw/char/cadence_uart.c | 61 +- hw/intc/arm_gicv3.c | 14 + hw/intc/arm_gicv3_common.c | 13 + hw/intc/arm_gicv3_cpuif.c | 7 +- hw/intc/arm_gicv3_dist.c | 5 +- hw/intc/arm_gicv3_its.c | 1322 ++++++++++++++++++++++++++++++++ hw/intc/arm_gicv3_its_common.c | 7 +- hw/intc/arm_gicv3_its_kvm.c | 2 +- hw/intc/arm_gicv3_redist.c | 153 +++- hw/misc/zynq_slcr.c | 31 +- softmmu/qdev-monitor.c | 7 +- target/arm/helper-a64.c | 1 + target/arm/helper.c | 8 + target/arm/kvm.c | 7 +- target/arm/translate-a64.c | 255 +++--- target/arm/translate.c | 21 + hw/intc/meson.build | 1 + tests/data/acpi/virt/IORT | Bin 0 -> 124 bytes tests/data/acpi/virt/IORT.memhp | Bin 0 -> 124 bytes tests/data/acpi/virt/IORT.numamem | Bin 0 -> 124 bytes tests/data/acpi/virt/IORT.pxb | Bin 0 -> 124 bytes 35 files changed, 2144 insertions(+), 210 deletions(-) create mode 100644 hw/intc/arm_gicv3_its.c create mode 100644 tests/data/acpi/virt/IORT create mode 100644 tests/data/acpi/virt/IORT.memhp create mode 100644 tests/data/acpi/virt/IORT.numamem create mode 100644 tests/data/acpi/virt/IORT.pxb