2021-06-17 17:03:28 +03:00
|
|
|
A-profile CPU architecture support
|
|
|
|
|
==================================
|
|
|
|
|
|
|
|
|
|
QEMU's TCG emulation includes support for the Armv5, Armv6, Armv7 and
|
|
|
|
|
Armv8 versions of the A-profile architecture. It also has support for
|
|
|
|
|
the following architecture extensions:
|
|
|
|
|
|
|
|
|
|
- FEAT_AA32BF16 (AArch32 BFloat16 instructions)
|
|
|
|
|
- FEAT_AA32HPD (AArch32 hierarchical permission disables)
|
|
|
|
|
- FEAT_AA32I8MM (AArch32 Int8 matrix multiplication instructions)
|
|
|
|
|
- FEAT_AES (AESD and AESE instructions)
|
target/arm: Advertise support for FEAT_BBM level 2
The description in the Arm ARM of the requirements of FEAT_BBM is
admirably clear on the guarantees it provides software, but slightly
more obscure on what that means for implementations. The description
of the equivalent SMMU feature in the SMMU specification (IHI0070D.b
section 3.21.1) is perhaps a bit more detailed and includes some
example valid implementation choices. (The SMMU version of this
feature is slightly tighter than the CPU version: the CPU is permitted
to raise TLB Conflict aborts in some situations that the SMMU may
not. This doesn't matter for QEMU because we don't want to do TLB
Conflict aborts anyway.)
The informal summary of FEAT_BBM is that it is about permitting an OS
to switch a range of memory between "covered by a huge page" and
"covered by a sequence of normal pages" without having to engage in
the 'break-before-make' dance that has traditionally been
necessary. The 'break-before-make' sequence is:
* replace the old translation table entry with an invalid entry
* execute a DSB insn
* execute a broadcast TLB invalidate insn
* execute a DSB insn
* write the new translation table entry
* execute a DSB insn
The point of this is to ensure that no TLB can simultaneously contain
TLB entries for the old and the new entry, which would traditionally
be UNPREDICTABLE (allowing the CPU to generate a TLB Conflict fault
or to use a random mishmash of values from the old and the new
entry). FEAT_BBM level 2 says "for the specific case where the only
thing that changed is the size of the block, the TLB is guaranteed
not to do weird things even if there are multiple entries for an
address", which means that software can now do:
* replace old translation table entry with new entry
* DSB
* broadcast TLB invalidate
* DSB
As the SMMU spec notes, valid ways to do this include:
* if there are multiple entries in the TLB for an address,
choose one of them and use it, ignoring the others
* if there are multiple entries in the TLB for an address,
throw them all out and do a page table walk to get a new one
QEMU's page table walk implementation for Arm CPUs already meets the
requirements for FEAT_BBM level 2. When we cache an entry in our TCG
TLB, we do so only for the specific (non-huge) page that the address
is in, and there is no way for the TLB data structure to ever have
more than one TLB entry for that page. (We handle huge pages only in
that we track what part of the address space is covered by huge pages
so that a TLB invalidate operation for an address in a huge page
results in an invalidation of the whole TLB.) We ignore the Contiguous
bit in page table entries, so we don't have to do anything for the
parts of FEAT_BBM that deal with changis to the Contiguous bit.
FEAT_BBM level 2 also requires that the nT bit in block descriptors
must be ignored; since commit 39a1fd25287f5dece5 we do this.
It's therefore safe for QEMU to advertise FEAT_BBM level 2 by
setting ID_AA64MMFR2_EL1.BBM to 2.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220426160422.2353158-3-peter.maydell@linaro.org
2022-04-26 19:04:21 +03:00
|
|
|
- FEAT_BBM at level 2 (Translation table break-before-make levels)
|
2021-06-17 17:03:28 +03:00
|
|
|
- FEAT_BF16 (AArch64 BFloat16 instructions)
|
|
|
|
|
- FEAT_BTI (Branch Target Identification)
|
|
|
|
|
- FEAT_DIT (Data Independent Timing instructions)
|
|
|
|
|
- FEAT_DPB (DC CVAP instruction)
|
|
|
|
|
- FEAT_DotProd (Advanced SIMD dot product instructions)
|
|
|
|
|
- FEAT_FCMA (Floating-point complex number instructions)
|
|
|
|
|
- FEAT_FHM (Floating-point half-precision multiplication instructions)
|
|
|
|
|
- FEAT_FP16 (Half-precision floating-point data processing)
|
|
|
|
|
- FEAT_FRINTTS (Floating-point to integer instructions)
|
|
|
|
|
- FEAT_FlagM (Flag manipulation instructions v2)
|
|
|
|
|
- FEAT_FlagM2 (Enhancements to flag manipulation instructions)
|
|
|
|
|
- FEAT_HPDS (Hierarchical permission disables)
|
|
|
|
|
- FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
|
|
|
|
|
- FEAT_JSCVT (JavaScript conversion instructions)
|
|
|
|
|
- FEAT_LOR (Limited ordering regions)
|
2022-03-02 00:59:50 +03:00
|
|
|
- FEAT_LPA (Large Physical Address space)
|
2022-03-02 00:59:56 +03:00
|
|
|
- FEAT_LPA2 (Large Physical and virtual Address space v2)
|
2021-06-17 17:03:28 +03:00
|
|
|
- FEAT_LRCPC (Load-acquire RCpc instructions)
|
|
|
|
|
- FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
|
|
|
|
|
- FEAT_LSE (Large System Extensions)
|
2022-03-02 00:59:49 +03:00
|
|
|
- FEAT_LVA (Large Virtual Address space)
|
2021-06-17 17:03:28 +03:00
|
|
|
- FEAT_MTE (Memory Tagging Extension)
|
|
|
|
|
- FEAT_MTE2 (Memory Tagging Extension)
|
2021-06-16 22:56:14 +03:00
|
|
|
- FEAT_MTE3 (MTE Asymmetric Fault Handling)
|
2021-06-17 17:03:28 +03:00
|
|
|
- FEAT_PAN (Privileged access never)
|
|
|
|
|
- FEAT_PAN2 (AT S1E1R and AT S1E1W instruction variants affected by PSTATE.PAN)
|
|
|
|
|
- FEAT_PAuth (Pointer authentication)
|
|
|
|
|
- FEAT_PMULL (PMULL, PMULL2 instructions)
|
|
|
|
|
- FEAT_PMUv3p1 (PMU Extensions v3.1)
|
|
|
|
|
- FEAT_PMUv3p4 (PMU Extensions v3.4)
|
|
|
|
|
- FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
|
|
|
|
|
- FEAT_RNG (Random number generator)
|
|
|
|
|
- FEAT_SB (Speculation Barrier)
|
|
|
|
|
- FEAT_SEL2 (Secure EL2)
|
|
|
|
|
- FEAT_SHA1 (SHA1 instructions)
|
|
|
|
|
- FEAT_SHA256 (SHA256 instructions)
|
|
|
|
|
- FEAT_SHA3 (Advanced SIMD SHA3 instructions)
|
|
|
|
|
- FEAT_SHA512 (Advanced SIMD SHA512 instructions)
|
|
|
|
|
- FEAT_SM3 (Advanced SIMD SM3 instructions)
|
|
|
|
|
- FEAT_SM4 (Advanced SIMD SM4 instructions)
|
|
|
|
|
- FEAT_SPECRES (Speculation restriction instructions)
|
|
|
|
|
- FEAT_SSBS (Speculative Store Bypass Safe)
|
|
|
|
|
- FEAT_TLBIOS (TLB invalidate instructions in Outer Shareable domain)
|
|
|
|
|
- FEAT_TLBIRANGE (TLB invalidate range instructions)
|
|
|
|
|
- FEAT_TTCNP (Translation table Common not private translations)
|
2022-04-26 19:04:20 +03:00
|
|
|
- FEAT_TTL (Translation Table Level)
|
2021-06-17 17:03:28 +03:00
|
|
|
- FEAT_TTST (Small translation tables)
|
|
|
|
|
- FEAT_UAO (Unprivileged Access Override control)
|
|
|
|
|
- FEAT_VHE (Virtualization Host Extensions)
|
|
|
|
|
- FEAT_VMID16 (16-bit VMID)
|
|
|
|
|
- FEAT_XNX (Translation table stage 2 Unprivileged Execute-never)
|
|
|
|
|
- SVE (The Scalable Vector Extension)
|
|
|
|
|
- SVE2 (The Scalable Vector Extension v2)
|
|
|
|
|
|
|
|
|
|
For information on the specifics of these extensions, please refer
|
|
|
|
|
to the `Armv8-A Arm Architecture Reference Manual
|
|
|
|
|
<https://developer.arm.com/documentation/ddi0487/latest>`_.
|
|
|
|
|
|
|
|
|
|
When a specific named CPU is being emulated, only those features which
|
|
|
|
|
are present in hardware for that CPU are emulated. (If a feature is
|
|
|
|
|
not in the list above then it is not supported, even if the real
|
|
|
|
|
hardware should have it.) The ``max`` CPU enables all features.
|
|
|
|
|
|
|
|
|
|
R-profile CPU architecture support
|
|
|
|
|
==================================
|
|
|
|
|
|
|
|
|
|
QEMU's TCG emulation support for R-profile CPUs is currently limited.
|
|
|
|
|
We emulate only the Cortex-R5 and Cortex-R5F CPUs.
|
|
|
|
|
|
|
|
|
|
M-profile CPU architecture support
|
|
|
|
|
==================================
|
|
|
|
|
|
|
|
|
|
QEMU's TCG emulation includes support for Armv6-M, Armv7-M, Armv8-M, and
|
|
|
|
|
Armv8.1-M versions of the M-profile architucture. It also has support
|
|
|
|
|
for the following architecture extensions:
|
|
|
|
|
|
|
|
|
|
- FP (Floating-point Extension)
|
|
|
|
|
- FPCXT (FPCXT access instructions)
|
|
|
|
|
- HP (Half-precision floating-point instructions)
|
|
|
|
|
- LOB (Low Overhead loops and Branch future)
|
|
|
|
|
- M (Main Extension)
|
|
|
|
|
- MPU (Memory Protection Unit Extension)
|
|
|
|
|
- PXN (Privileged Execute Never)
|
|
|
|
|
- RAS (Reliability, Serviceability and Availability): "minimum RAS Extension" only
|
|
|
|
|
- S (Security Extension)
|
|
|
|
|
- ST (System Timer Extension)
|
|
|
|
|
|
|
|
|
|
For information on the specifics of these extensions, please refer
|
|
|
|
|
to the `Armv8-M Arm Architecture Reference Manual
|
|
|
|
|
<https://developer.arm.com/documentation/ddi0553/latest>`_.
|
|
|
|
|
|
|
|
|
|
When a specific named CPU is being emulated, only those features which
|
|
|
|
|
are present in hardware for that CPU are emulated. (If a feature is
|
|
|
|
|
not in the list above then it is not supported, even if the real
|
|
|
|
|
hardware should have it.) There is no equivalent of the ``max`` CPU for
|
|
|
|
|
M-profile.
|