aboutsummaryrefslogtreecommitdiff
path: root/target/arm
AgeCommit message (Collapse)AuthorFilesLines
32 hourstarget/arm: Added support for SME register exposure to GDBVacha Bhavsar4-1/+132
The QEMU GDB stub does not expose the ZA storage SME register to GDB via the remote serial protocol, which can be a useful functionality to debug SME code. To provide this functionality for AArch64 targets, this patch registers the SME register set with the GDB stub. To do so, this patch implements the aarch64_gdb_get_sme_reg() and aarch64_gdb_set_sme_reg() functions to specify how to get and set the SME registers, and the arm_gen_dynamic_smereg_feature() function to generate the target description in XML format to indicate the target architecture supports SME. Finally, this patch includes a dyn_smereg_feature structure to hold this GDB XML description of the SME registers for each CPU. Note that according to the GDB documentation the ZA register is defined as a vector of bytes; however the target description xml retrieved when using gdb natively on a host with SME capabilities represents the ZA register as a vector of vectors of bytes, so this is a GDB documentation error. We follow GDB's own gdbstub implementation and represent the ZA register as a vector of vectors of bytes as is done by GDB here: https://github.com/bminor/binutils-gdb/blob/5cce2b7006daa7073b98e3d1a3b176199d1381d7/gdb/features/aarch64-sme.c#L50 Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com> Message-id: 20250909161012.2561593-3-vacha.bhavsar@oss.qualcomm.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> [PMM: fixed minor checkpatch nits] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hoursarm/kvm: report registers we failed to setCornelia Huck1-0/+86
If we fail migration because of a mismatch of some registers between source and destination, the error message is not very informative: qemu-system-aarch64: error while loading state for instance 0x0 ofdevice 'cpu' qemu-system-aarch64: Failed to put registers after init: Invalid argument At least try to give the user a hint which registers had a problem, even if they cannot really do anything about it right now. Sample output: Could not set register op0:3 op1:0 crn:0 crm:0 op2:0 to c00fac31 (is 413fd0c1) We could be even more helpful once we support writable ID registers, at which point the user might actually be able to configure something that is migratable. Suggested-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Sebastian Ott <sebott@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com> Message-id: 20250911154159.158046-1-cohuck@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Drop ARM_FEATURE_IWMMXT handlingPeter Maydell3-48/+0
We have now removed all the CPU types which had the Intel XScale extensions indicated via ARM_FEATURE_IWMMXT, so this feature bit is never set. Remove all the code that can only be reached when using this flag. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250828140422.3271703-6-peter.maydell@linaro.org
32 hourstarget/arm: Drop ARM_FEATURE_XSCALE handlingPeter Maydell5-80/+3
We have now removed all the CPU types which had the Intel XScale extensions indicated via ARM_FEATURE_XSCALE, so this feature bit is never set. Remove all the code that can only be reached when using this flag. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250828140422.3271703-5-peter.maydell@linaro.org
32 hourstarget/arm: Remove iwmmxt helper functionsPeter Maydell3-769/+0
Remove the iwmmxt helper functions which are no longer called now that we have removed the associated translate.c handling. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250828140422.3271703-4-peter.maydell@linaro.org
32 hourstarget/arm: Remove XScale and iWMMXt translate.c codePeter Maydell4-1339/+7
Remove all the translator code that is accessible only via ARM_FEATURE_XSCALE or ARM_FEATURE_IWMMXT. This includes the xscale-only cp15_cpar TB flags and cpu_{V0,V1,M0} TCG temps. The no-longer-used helper functions will be removed in a separate commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250828140422.3271703-3-peter.maydell@linaro.org
32 hourstarget/arm: Remove deprecated pxa CPU familyPeter Maydell1-163/+0
In 10.0 we deprecated the pxa CPU family (pxa250, pxa255, pxa260 pxa261, pxa262, pxa270-a0, pxa270-a1, pxa270, pxa270-b0, pxa270-b1, pxa270-c0, pxa270-c5). Now we have released 10.1 we can remove them. This commit removes only the top level CPU definitions and updates the documentation. Removing the CPUs means that there is now a lot of dead iwMMXt code, which we will delete in subsequent commits. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250828140422.3271703-2-peter.maydell@linaro.org
32 hourstarget/arm: Implement FEAT_ATS1ARichard Henderson4-0/+51
Implement FEAT_ATS1A and enable for -cpu max. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-13-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Remove outdated comment for ZCR_EL12Richard Henderson1-5/+0
The comment about not being included in the summary table has been out of date for quite a while. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-12-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Fill in HFG[RWI]TR_EL2 bits for Arm v9.5Richard Henderson1-2/+26
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-11-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Add prot_check parameter to do_ats_writeRichard Henderson1-8/+8
Separate protection check from access type, in preparation for skipping the protection check altogether. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-10-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Skip AF and DB updates for AccessType_ATRichard Henderson1-1/+14
We are required to skip DB update for AT instructions, and we are allowed to skip AF updates. Choose to skip both. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-9-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Introduce get_phys_addr_for_atRichard Henderson3-28/+24
Rename get_phys_addr_with_space_nogpc for its only caller, do_ats_write. Drop the MemOp memop argument as it doesn't make sense in the new context. Replace the access_type parameter with prot_check. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Skip permission check from arm_cpu_get_phys_page_attrs_debugRichard Henderson1-1/+1
Do not require read permission when translating addresses for debugging purposes. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Add in_prot_check to S1TranslateRichard Henderson1-5/+14
Separate the access_type from the protection check. Save the trouble of modifying all helper functions by passing the new data in the control structure. Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32 hourstarget/arm: Add prot_check parameter to pmsav8_mpu_lookupRichard Henderson3-9/+11
Separate the access_type from the protection check. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250830054128.448363-5-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-31Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingRichard Henderson3-22/+22
* hw/i386: split isapc from PCI boards * cpu-exec, accel: remove BQL usage for interrupt_request != 0 * memory, hpet, pmtimer: introduce BQL-free PIO/MMIO # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmixiO4UHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMTowf9EmIcSgFXrP8QR/rVQ+Z8+csR4md7 # QDzQwoDHaP9F/J728AoT/nDwwlfiHRbcH8AQbzzMrsmMnqhaWCFWD5snGelzPJAo # BPaOa4eYvwgssW1apfxGgzae71B3Hbx/sMYHdRcUvBnvS6cKEcOcgK8pANuZGzGQ # uRquCMvk14WhnQV/NFqr2PmtmxXjdDNefdi1RfpaPDEt4VZsh4B3afU+I+L4LvIQ # NOPh0PbDk+BLRt2fRPgdwF6KqS5ajPEzKnBlS0uxSXKxpLOLM/2SNDOGDDVUrAwV # ILrnchZrpxHsHwBCjaBhKZDTTQUcH0HUrZhRJbUPsg5feHRs3KoaFJjmCQ== # =RMLB # -----END PGP SIGNATURE----- # gpg: Signature made Fri 29 Aug 2025 09:03:10 PM AEST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown] # gpg: WARNING: The key's User ID is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (28 commits) tcg: move interrupt caching and single step masking closer to user kvm: i386: irqchip: take BQL only if there is an interrupt hpet: make main counter read lock-less hpet: move out main counter read into a separate block hpet: switch to fine-grained device locking acpi: mark PMTIMER as unlocked memory: reintroduce BQL-free fine-grained PIO/MMIO add cpu_test_interrupt()/cpu_set_interrupt() helpers and use them tree wide user-exec: ensure interrupt_request is not used hw/i386/isapc.c: replace rom_memory with system_memory hw/i386/pc_piix.c: replace rom_memory with pci_memory hw/i386/pc_piix.c: remove unused headers after isapc machine split hw/i386: move isapc machine to separate isapc.c file hw/i386/pc_piix.c: assume pcmc->pci_enabled is always true in pc_init1() hw/i386/pc_piix.c: always initialise ISA IDE drives in pc_init_isa() hw/i386/pc_piix.c: remove pc_system_flash_cleanup_unused() from pc_init_isa() hw/i386/pc_piix.c: hardcode hole64_size to 0 in pc_init_isa() hw/i386/pc_piix.c: simplify RAM size logic in pc_init_isa() hw/i386/pc_piix.c: remove nvdimm initialisation from pc_init_isa() hw/i386/pc_piix.c: remove SGX initialisation from pc_init_isa() ... Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2025-08-30target/arm: Enable FEAT_LSE128 for -cpu maxRichard Henderson1-1/+1
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250815122653.701782-8-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement FEAT_LSE128Richard Henderson3-0/+61
This feature contains the LDCLRP, LDSETP, and SWPP instructions. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250815122653.701782-7-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Rename isar_feature_aa64_atomicsRichard Henderson2-13/+13
This is FEAT_LSE -- rename the predicate to match. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250830045006.380393-1-richard.henderson@linaro.org Message-id: 20250815122653.701782-6-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Correct condition of aa64_atomics feature functionPeter Maydell1-1/+1
The ARMv8.1-Atomics feature (renamed FEAT_LSE in more modern versions of the Arm ARM) has always ben indicated by ID_AA64ISAR0.ATOMIC being 0b0010 or greater; 0b0001 is a reserved unused value. We were incorrectly checking for != 0; this had no harmful effects because all the CPUs set their value for this field to either 0 (for not having the feature) or 2 (if they do have it), but it's better to match what the architecture specifies here. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250819145659.2165160-1-peter.maydell@linaro.org
2025-08-30target/arm: Enable FEAT_CSSC for -cpu maxRichard Henderson1-0/+1
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-7-richard.henderson@linaro.org [PMM: rebased to handle linux-user elfload.c refactor] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement CTZ, CNT, ABSPeter Maydell2-0/+35
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-6-richard.henderson@linaro.org [PMM: fix tcg_rd/tcg_rn mixup] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Split out gen_wrap2_i32 helperRichard Henderson1-10/+15
Wrapper to extract the low 32 bits, perform an operation, and zero-extend back to 64 bits. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-5-richard.henderson@linaro.org [PMM: fixed wrong output-reg argument in callsites; add comment] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement MIN/MAX (register)Richard Henderson2-0/+27
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-4-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement MIN/MAX (immediate)Richard Henderson2-0/+54
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-3-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Add feature predicate for FEAT_CSSCRichard Henderson1-0/+5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250803014019.416797-2-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Trap PMCR when MDCR_EL2.TPMCR is setSmail AIDER1-8/+26
Trap PMCR_EL0 or PMCR accesses to EL2 when MDCR_EL2.TPMCR is set. Similar to MDCR_EL2.TPM, MDCR_EL2.TPMCR allows trapping EL0 and EL1 accesses to the PMCR register to EL2. Cc: qemu-stable@nongnu.org Signed-off-by: Smail AIDER <smail.aider@huawei.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250811112143.1577055-2-smail.aider@huawei.com Message-Id: <20250722131925.2119169-1-smail.aider@huawei.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement FEAT_TCR2 and enable with -cpu maxGustavo Romero6-0/+101
Add FEAT_TCR2, which introduces the TCR2_EL1 and TCR2_EL2 registers. These registers are extensions of the TCR_ELx registers and provide top-level control of the EL10 and EL20 translation regimes. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250727074202.83141-5-richard.henderson@linaro.org Message-ID: <20250711140828.1714666-5-gustavo.romero@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> [rth: Remove FEAT_MEC code; handle SCR and HCRX enable bits.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Implement FEAT_SCTLR2 and enable with -cpu maxGustavo Romero6-8/+118
Add FEAT_SCTLR2, which introduces the SCTLR2_EL1, SCTLR2_EL2, and SCTLR2_EL3 registers. These registers are extensions of the SCTLR_ELx ones. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250727074202.83141-4-richard.henderson@linaro.org Message-ID: <20250711140828.1714666-4-gustavo.romero@linaro.org> [rth: Remove FEAT_MEC code; handle SCR and HCRX enable bits.] Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-30target/arm: Clean up of register field definitionsGustavo Romero2-9/+7
Clean up the definitions of NSW and NSA fields in the VTCR register. These two fields are already defined properly using FIELD() so they are actually duplications. Also, define the NSW and NSA fields in the VSTCR register using FIELD() and remove their definitions based on VTCR fields. Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org> Message-id: 20250725014755.2122579-1-gustavo.romero@linaro.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-29add cpu_test_interrupt()/cpu_set_interrupt() helpers and use them tree wideIgor Mammedov3-22/+22
The helpers form load-acquire/store-release pair and ensure that appropriate barriers are in place in case checks happen outside of BQL. Use them to replace open-coded checkers/setters across the code, to make sure that barriers are not missed. Helpers also make code a bit more readable. Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com> Link: https://lore.kernel.org/r/20250821155603.2422553-1-imammedo@redhat.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-08-01target/arm: Fix handling of setting SVE registers from gdbVacha Bhavsar1-5/+12
The code to handle setting SVE registers via the gdbstub is broken: * it sets each pair of elements in the zregs[].d[] array in the wrong order for the most common (little endian) case: the least significant 64-bit value comes first * it makes no attempt to handle target_endian() * it does a simple copy out of the (target endian) gdbstub buffer into the (host endan) zregs data structure, which is wrong on big endian hosts Fix all these problems: * use ldq_p() to read from the gdbstub buffer * check target_big_endian() to see if we need to handle the 128-bit values the opposite way around Cc: qemu-stable@nongnu.org Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com> Message-id: 20250722173736.2332529-3-vacha.bhavsar@oss.qualcomm.com [PMM: adjusted commit message, fixed spacing] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-01target/arm: Fix big-endian handling of NEON gdb remote debuggingVacha Bhavsar1-2/+16
In the code for allowing the gdbstub to set the value of an AArch64 FP/SIMD register, we weren't accounting for target_big_endian() being true. This meant that for aarch64_be-linux-user we would set the two halves of the FP register the wrong way around. The much more common case of a little-endian guest is not affected; nor are big-endian hosts. Correct the handling of this case. Cc: qemu-stable@nongnu.org Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com> Message-id: 20250722173736.2332529-2-vacha.bhavsar@oss.qualcomm.com [PMM: added comment, expanded commit message, fixed missing space] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-08-01target/arm: Reinstate bogus AArch32 DBGDTRTX register for migration compatPeter Maydell1-0/+29
In commit 655659a74a we fixed some bugs in the encoding of the Debug Communications Channel registers, including that we were incorrectly exposing an AArch32 register at p14, 3, c0, c5, 0. Unfortunately removing a register is a break of forwards migration compatibility for TCG, because we will fail the migration if the source QEMU passes us a cpreg which the destination QEMU does not have. We don't have a mechanism for saying "it's OK to ignore this sysreg in the inbound data", so for the 10.1 release reinstate the incorrect AArch32 register. (We probably have had other cases in the past of breaking migration compatibility like this, but we didn't notice because we didn't test and in any case not that many people care about TCG migration compatibility. KVM migration compat is not affected because for KVM we treat the kernel as the source of truth for what system registers are present.) Fixes: 655659a74a36b ("target/arm: Correct encoding of Debug Communications Channel registers") Reported-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250731134338.250203-1-peter.maydell@linaro.org
2025-07-31target/arm: add support for 64-bit PMCCNTR in AArch32 modeAlex Richardson1-5/+24
In the PMUv3, a new AArch32 64-bit (MCRR/MRRC) accessor for the PMCCNTR was added. In QEMU we forgot to implement this, so only provide the 32-bit accessor. Since we have a 64-bit PMCCNTR sysreg for AArch64, adding the 64-bit AArch32 version is easy. We add the PMCCNTR to the v8_cp_reginfo because PMUv3 was added in the ARMv8 architecture. This is consistent with how we handle the existing PMCCNTR support, where we always implement it for all v7 CPUs. This is arguably something we should clean up so it is gated on ARM_FEATURE_PMU and/or an ID register check for the relevant PMU version, but we should do that as its own tidyup rather than being inconsistent between this PMCCNTR accessor and the others. Since the register name is the same as the 32-bit PMCCNTR, we set ARM_CP_NO_GDB on the 32-bit one to avoid generating an invalid GDB XML. See https://developer.arm.com/documentation/ddi0601/2024-06/AArch32-Registers/PMCCNTR--Performance-Monitors-Cycle-Count-Register?lang=en Note for potential backporting: * this code in cpregs-pmu.c will be in helper.c on stable branches that don't have commit ae2086426d37 Cc: qemu-stable@nongnu.org Signed-off-by: Alex Richardson <alexrichardson@google.com> Message-id: 20250725170136.145116-1-alexrichardson@google.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-25target/arm: hvf: stubbing reads to LORC_EL1Mohamed Mediouni1-0/+4
Linux zeroes LORC_EL1 on boot at EL2, without further interaction with FEAT_LOR afterwards. Stub out LORC_EL1 accesses as FEAT_LOR is a mandatory extension on Armv8.1+. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-25target/arm: Fix LD1W, LD1D to 128-bit elementsPeter Maydell1-2/+2
In our implementation of the SVE2p1 contiguous load to 128-bit element insns such as LD1D (scalar plus scalar, single register), we got the order of the arguments to the DO_LD1_2() macro wrong. Here the first argument is the element size and the second is the memory size, and the element size is always the same size or larger than the memory size. For the 128-bit versions, we want to load either 32-bit or 64-bit values from memory and extend them to the 128-bit vector element, but were trying to load 128 bit values and then stuff them into 32-bit or 64-bit vector elements. Correct the macro ordering. Fixes: fc5f060bcb7b ("target/arm: Implement {LD1, ST1}{W, D} (128-bit element) for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250723165458.3509150-7-peter.maydell@linaro.org
2025-07-25target/arm: Pass correct esize to sve_st1_z() for LD1Q, ST1QPeter Maydell1-4/+32
Our implementation of the helper functions for the LD1Q and ST1Q insns reused the existing DO_LD1_ZPZ_D and DO_ST1_ZPZ_D macros. This passes the wrong esize (8, not 16) to sve_ldl_z(). Create new macros DO_LD1_ZPZ_Q and DO_ST1_ZPZ_Q which pass the correct esize, and use them for the LD1Q and ST1Q helpers. Fixes: d2aa9a804ee ("target/arm: Implement LD1Q, ST1Q for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250723165458.3509150-6-peter.maydell@linaro.org
2025-07-25target/arm: LD1Q, ST1Q are vector + scalar, not scalar + vectorPeter Maydell2-20/+57
Unlike the "LD1D (scalar + vector)" etc instructions, LD1Q is vector + scalar. This means that: * the vector and the scalar register are in opposite fields in the encoding * 31 in the scalar register field is XZR, not XSP The same applies for ST1Q. This means we can't reuse the trans_LD1_zprz() and trans_ST1_zprz() functions for LD1Q and ST1Q. Split them out to use their own trans functions. Note that the change made here to sve.decode requires the decodetree bugfix "decodetree: Infer argument set before inferring format" to avoid a spurious compile-time error about "dtype". Fixes: d2aa9a804ee678f ("target/arm: Implement LD1Q, ST1Q for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250723165458.3509150-5-peter.maydell@linaro.org
2025-07-25target/arm: Pack mtedesc into upper 32 bits of descriptorRichard Henderson4-51/+25
Instead of trying to pack mtedesc into the upper 17 bits of a 32-bit gvec descriptor, pass the gvec descriptor in the lower 32 bits and the mte descriptor in the upper 32 bits of a 64-bit operand. This fixes two bugs: (1) in gen_sve_ldr() and gen_sve_str() call gen_mte_checkN() with a length value which is the SVE vector length and can be up to 256 bytes. We don't assert there that it fits in the descriptor, so we would just fail to do the MTE checks on the right length of memory if the VL is more than 32 bytes (2) the new-in-SVE2p1 insns LD3Q, LD4Q, ST3Q, ST4Q also involve transfers of more than 32 bytes of memory. In this case we would assert at translate time. (Note for potential backporting: this commit depends on the previous "target/arm: Expand the descriptor for SME/SVE memory ops to i64".) Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250723165458.3509150-3-peter.maydell@linaro.org [PMM: expand commit message to clarify that we are fixing bugs here] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-25target/arm: Expand the descriptor for SME/SVE memory ops to i64Richard Henderson7-827/+828
We have run out of room attempting to pack both the gvec descriptor and the mte descriptor into 32 bits. Here, change nothing except the parameter type, which affects all declarations, the function typedefs, and the type used with tcg expansion. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20250723165458.3509150-2-peter.maydell@linaro.org
2025-07-21hvf: arm: Emulate ICC_RPR_EL1 accesses properlyZenghui Yu1-0/+2
Commit a2260983c655 ("hvf: arm: Add support for GICv3") added GICv3 support by implementing emulation for a few system registers. ICC_RPR_EL1 was defined but not plugged in the sysreg handlers (for no good reason). Fix it. Fixes: a2260983c655 ("hvf: arm: Add support for GICv3") Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250714160139.10404-3-zenghui.yu@linux.dev Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21hvf: arm: Add permission check in GIC sysreg handlersZenghui Yu1-0/+6
Quoting Peter Maydell: " hvf_sysreg_read_cp() and hvf_sysreg_write_cp() do not check the .access field of the ARMCPRegInfo to ensure that they forbid writes to registers that are marked with a .access field that says they're read-only (and ditto reads to write-only registers). " Before we add more registers in GIC sysreg handlers, let's get it correct by adding the .access checks to hvf_sysreg_read_cp() and hvf_sysreg_write_cp(). With that, a sysreg access with invalid permission will result in an UNDEFINED exception. Suggested-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev> Message-id: 20250714160139.10404-2-zenghui.yu@linux.dev Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2025-07-21target/arm: Make LD1Q decode and trans fn agree about a->uPeter Maydell1-1/+1
For the LD1Q instruction (gather load of quadwords) we use the LD1_zprz pattern with MO_128 elements. At this element size there is no signed vs unsigned distinction, and we only set the 'u' bit in the arg_LD1_zprz struct because we share the code and decode struct with smaller element sizes. However, we set u=0 in the decode pattern line but then accidentally asserted that it was 1 in the trans function. Since our usual convention is that the "default" is unsigned and we only mark operations as signed when they really do need to extend, change the decode pattern line to set u=1 to match the assert. Fixes: d2aa9a804ee6 ("target/arm: Implement LD1Q, ST1Q for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-11-peter.maydell@linaro.org
2025-07-21target/arm: Honour FPCR.AH=1 default NaN value in FMAXNMQV, FMINNMQVPeter Maydell1-12/+17
The FMAXNMQV and FMINNMQV insns use the default NaN as their identity value for inactive source vector elements. We open-coded this in sve_helper.c, hoping to avoid a function call. However, this fails to account for FPCR.AH=1 changing the default NaN value to set the sign bit. Use a call to floatN_default_nan() to obtain this value. Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-10-peter.maydell@linaro.org
2025-07-21target/arm: Don't nest H() macro calls in SVE DO_REDUCEPeter Maydell1-1/+1
In the part of the SVE DO_REDUCE macro used by the SVE2p1 FMAXQV, FMINQV, etc insns, we incorrectly applied the H() macro twice when calculating an offset to add to the vn pointer. This has no effect on little-endian hosts but on big-endian hosts the two invocations will cancel each other out and we will access the wrong part of the array. The "s * 16" part of the expression is already aligned, so we only need to use the H macro on the "e". Correct the macro usage. Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-9-peter.maydell@linaro.org
2025-07-21target/arm: Correct sense of FPCR.AH test for FMAXQV and FMINQVPeter Maydell1-2/+2
When we implemented the FMAXQV and FMINQV insns we accidentally inverted the sense of the FPCR.AH test, so we gave the AH=1 behaviour when FPCR.AH was zero, and vice-versa. (The difference is limited to handling of negative zero and NaN inputs.) Fixes: 1de7ecfc12d05 ("target/arm: Implement FADDQV, F{MIN, MAX}{NM}QV for SVE2p1") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20250718173032.2498900-8-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMLA, BFMLS (indexed)Peter Maydell2-9/+18
FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in the SVE floating-point multiply-add (indexed) insn group. Implement these. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-7-peter.maydell@linaro.org
2025-07-21target/arm: Add BFMLA, BFMLS (vectors)Peter Maydell3-6/+98
FEAT_SVE_B16B16 adds bfloat16 versions of the FMLA and FMLS insns in the "SVE floating-point multiply-accumulate writing addend" group, encoded as sz=0b00. Fixes: 7b1613a1020d2942 ("target/arm: Enable FEAT_SME2p1 on -cpu max") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20250718173032.2498900-6-peter.maydell@linaro.org
generated by cgit v1.1 at 2025-09-18 00:04:52 +0000