* [PATCH 1/4] Revert "target/arm: Re-use arm_is_psci_call() in HVF"
2025-12-09 9:24 [PATCH 0/4] Final (for real this time) patches for arm - pre-PR Alex Bennée
@ 2025-12-09 9:24 ` Alex Bennée
2025-12-09 9:24 ` [PATCH 2/4] target/arm: ensure PSCI register updates are flushed Alex Bennée
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Alex Bennée @ 2025-12-09 9:24 UTC (permalink / raw)
To: qemu-devel
Cc: Mads Ynddal, Alexander Graf, qemu-arm, Peter Maydell,
Alex Bennée, Philippe Mathieu-Daudé, Christian Stussak
This breaks a pure HVF (--disable-tcg) build because the fallback stub
will always report false.
This reverts commit 4695daacc068cd0aa9a91c0063c4f2a9ec9b7ba1.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Christian Stussak <christian.stussak@imaginary.org>
---
target/arm/hvf/hvf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index de1e8fb8a05..70d34063df8 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1935,7 +1935,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
break;
case EC_AA64_HVC:
cpu_synchronize_state(cpu);
- if (arm_is_psci_call(arm_cpu, EXCP_HVC)) {
+ if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
/* Do NOT advance $pc for HVC */
if (!hvf_handle_psci_call(cpu)) {
trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
@@ -1949,7 +1949,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
break;
case EC_AA64_SMC:
cpu_synchronize_state(cpu);
- if (arm_is_psci_call(arm_cpu, EXCP_SMC)) {
+ if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) {
/* Secure Monitor Call exception, we need to advance $pc */
advance_pc = true;
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/4] target/arm: ensure PSCI register updates are flushed
2025-12-09 9:24 [PATCH 0/4] Final (for real this time) patches for arm - pre-PR Alex Bennée
2025-12-09 9:24 ` [PATCH 1/4] Revert "target/arm: Re-use arm_is_psci_call() in HVF" Alex Bennée
@ 2025-12-09 9:24 ` Alex Bennée
2025-12-09 12:40 ` Philippe Mathieu-Daudé
2025-12-09 9:24 ` [PATCH 3/4] target/arm: make HV_EXIT_REASON_CANCELED leave hvf_arch_vcpu_exec Alex Bennée
2025-12-09 9:24 ` [PATCH 4/4] target/arm: handle unaligned PC during tlb probe Alex Bennée
3 siblings, 1 reply; 6+ messages in thread
From: Alex Bennée @ 2025-12-09 9:24 UTC (permalink / raw)
To: qemu-devel
Cc: Mads Ynddal, Alexander Graf, qemu-arm, Peter Maydell,
Alex Bennée, Christian Stussak
When we handle a host call we report state back to the caller via
registers. Set vcpu_dirty to indicate QEMU is currently the reference
and hoist the flush_cpu_state() and make the call unconditional.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3228
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Christian Stussak <christian.stussak@imaginary.org>
---
v2
- Fixes->Resolves
---
target/arm/hvf/hvf.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 70d34063df8..8e2940217a6 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1942,6 +1942,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
/* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
env->xregs[0] = -1;
}
+ cpu->vcpu_dirty = true;
} else {
trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
@@ -1958,6 +1959,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
/* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
env->xregs[0] = -1;
}
+ cpu->vcpu_dirty = true;
} else {
trace_hvf_unknown_smc(env->xregs[0]);
hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
@@ -1980,10 +1982,12 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
error_report("0x%llx: unhandled exception ec=0x%x", env->pc, ec);
}
+ /* flush any changed cpu state back to HVF */
+ flush_cpu_state(cpu);
+
if (advance_pc) {
uint64_t pc;
- flush_cpu_state(cpu);
r = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_PC, &pc);
assert_hvf_ok(r);
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 3/4] target/arm: make HV_EXIT_REASON_CANCELED leave hvf_arch_vcpu_exec
2025-12-09 9:24 [PATCH 0/4] Final (for real this time) patches for arm - pre-PR Alex Bennée
2025-12-09 9:24 ` [PATCH 1/4] Revert "target/arm: Re-use arm_is_psci_call() in HVF" Alex Bennée
2025-12-09 9:24 ` [PATCH 2/4] target/arm: ensure PSCI register updates are flushed Alex Bennée
@ 2025-12-09 9:24 ` Alex Bennée
2025-12-09 9:24 ` [PATCH 4/4] target/arm: handle unaligned PC during tlb probe Alex Bennée
3 siblings, 0 replies; 6+ messages in thread
From: Alex Bennée @ 2025-12-09 9:24 UTC (permalink / raw)
To: qemu-devel
Cc: Mads Ynddal, Alexander Graf, qemu-arm, Peter Maydell,
Alex Bennée, Philippe Mathieu-Daudé
Without this we can spin tightly in the main HVF dispatch loop and
never release the lock long enough. As a result the HMP never gets to
run and shutting down the system deadlocks.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3228
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
v2
- expanded commit summary and contents
- added Resolves link
---
target/arm/hvf/hvf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8e2940217a6..8288b605299 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2020,6 +2020,7 @@ static int hvf_handle_vmexit(CPUState *cpu, hv_vcpu_exit_t *exit)
break;
case HV_EXIT_REASON_CANCELED:
/* we got kicked, no exit to process */
+ ret = -1;
break;
default:
g_assert_not_reached();
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 4/4] target/arm: handle unaligned PC during tlb probe
2025-12-09 9:24 [PATCH 0/4] Final (for real this time) patches for arm - pre-PR Alex Bennée
` (2 preceding siblings ...)
2025-12-09 9:24 ` [PATCH 3/4] target/arm: make HV_EXIT_REASON_CANCELED leave hvf_arch_vcpu_exec Alex Bennée
@ 2025-12-09 9:24 ` Alex Bennée
3 siblings, 0 replies; 6+ messages in thread
From: Alex Bennée @ 2025-12-09 9:24 UTC (permalink / raw)
To: qemu-devel
Cc: Mads Ynddal, Alexander Graf, qemu-arm, Peter Maydell,
Alex Bennée, Jessica Clarke, Richard Henderson
PC alignment faults have priority over instruction aborts and we have
code to deal with this in the translation front-ends. However during
tb_lookup we can see a potentially faulting probe which doesn't get a
MemOp set. If the page isn't available this results in
EC_INSNABORT (0x20) instead of EC_PCALIGNMENT (0x22).
As there is no easy way to set the appropriate MemOp in the
instruction fetch probe path lets just detect it in
arm_cpu_tlb_fill_align() ahead of the main alignment check. We also
teach arm_deliver_fault to deliver the right syndrome for
MMU_INST_FETCH alignment issues.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3233
Tested-by: Jessica Clarke <jrtc27@jrtc27.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251204203540.1381896-1-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
v2
- Fixes -> Resolves
---
target/arm/tcg/tlb_helper.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index f1983a5732e..5c689d3b69f 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -250,7 +250,11 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
if (access_type == MMU_INST_FETCH) {
- syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
+ if (fi->type == ARMFault_Alignment) {
+ syn = syn_pcalignment();
+ } else {
+ syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
+ }
exc = EXCP_PREFETCH_ABORT;
} else {
bool gcs = regime_is_gcs(core_to_arm_mmu_idx(env, mmu_idx));
@@ -346,11 +350,18 @@ bool arm_cpu_tlb_fill_align(CPUState *cs, CPUTLBEntryFull *out, vaddr address,
}
/*
- * Per R_XCHFJ, alignment fault not due to memory type has
- * highest precedence. Otherwise, walk the page table and
- * and collect the page description.
+ * PC alignment faults should be dealt with at translation time
+ * but we also need to catch them while being probed.
+ *
+ * Then per R_XCHFJ, alignment fault not due to memory type take
+ * precedence. Otherwise, walk the page table and and collect the
+ * page description.
+ *
*/
- if (address & ((1 << memop_alignment_bits(memop)) - 1)) {
+ if (access_type == MMU_INST_FETCH && !cpu->env.thumb &&
+ (address & 3)) {
+ fi->type = ARMFault_Alignment;
+ } else if (address & ((1 << memop_alignment_bits(memop)) - 1)) {
fi->type = ARMFault_Alignment;
} else if (!get_phys_addr(&cpu->env, address, access_type, memop,
core_to_arm_mmu_idx(&cpu->env, mmu_idx),
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread