1 | Hi; this target-arm pull request has a collection of generally | 1 | arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length |
---|---|---|---|
2 | fairly minor bugs to sneak in before 3.0 rc0 tomorrow... | 2 | patches, which are somewhere between a bugfix and a new feature. |
3 | 3 | ||
4 | thanks | 4 | thanks |
5 | -- PMM | 5 | -- PMM |
6 | 6 | ||
7 | The following changes since commit a98ff0ec2ba3538dd766b349518ee18d03942ed8: | 7 | The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a: |
8 | 8 | ||
9 | Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180709' into staging (2018-07-09 11:00:45 +0100) | 9 | Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100) |
10 | 10 | ||
11 | are available in the Git repository at: | 11 | are available in the Git repository at: |
12 | 12 | ||
13 | git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180709 | 13 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727 |
14 | 14 | ||
15 | for you to fetch changes up to 8fad0a65582c0a6e324580f45516461e9b6aa439: | 15 | for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749: |
16 | 16 | ||
17 | hw/net/dp8393x: don't make prom region 'nomigrate' (2018-07-09 14:51:35 +0100) | 17 | hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100) |
18 | 18 | ||
19 | ---------------------------------------------------------------- | 19 | ---------------------------------------------------------------- |
20 | target-arm queue: | 20 | target-arm queue: |
21 | * hw/net/dp8393x: don't make prom region 'nomigrate' | 21 | * hw/arm/smmuv3: Check 31st bit to see if CD is valid |
22 | * boards.h: Remove doc comment reference to nonexistent function | 22 | * qemu-options.hx: Fix formatting of -machine memory-backend option |
23 | * hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset' | 23 | * hw: aspeed_gpio: Fix memory size |
24 | * target/arm: Fix do_predset for large VL | 24 | * hw/arm/nseries: Display hexadecimal value with '0x' prefix |
25 | * tcg: Restrict check_size_impl to multiples of the line size | 25 | * Add sve-default-vector-length cpu property |
26 | * target/arm: Suppress Coverity warning for PRF | 26 | * docs: Update path that mentions deprecated.rst |
27 | * hw/timer/cmsdk-apb-timer: fix minor corner-case bugs and | 27 | * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS |
28 | suppress spurious warnings when running Linux's timer driver | 28 | * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING |
29 | * hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr | 29 | * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts |
30 | * target/arm: Report M-profile alignment faults correctly to the guest | ||
31 | * target/arm: Add missing 'return's after calling v7m_exception_taken() | ||
32 | * target/arm: Enforce that M-profile SP low 2 bits are always zero | ||
30 | 33 | ||
31 | ---------------------------------------------------------------- | 34 | ---------------------------------------------------------------- |
32 | Eric Auger (1): | 35 | Joe Komlodi (1): |
33 | hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr | 36 | hw/arm/smmuv3: Check 31st bit to see if CD is valid |
34 | 37 | ||
35 | Guenter Roeck (1): | 38 | Joel Stanley (1): |
36 | hw/timer/cmsdk-apb-timer: Correctly identify and set one-shot mode | 39 | hw: aspeed_gpio: Fix memory size |
37 | 40 | ||
38 | Peter Maydell (5): | 41 | Mao Zhongyi (1): |
39 | ptimer: Add TRIGGER_ONLY_ON_DECREMENT policy option | 42 | docs: Update path that mentions deprecated.rst |
40 | hw/timer/cmsdk-apb-timer: Correct ptimer policy settings | 43 | |
41 | hw/timer/cmsdk-apb-timer: run or stop timer on writes to RELOAD and VALUE | 44 | Peter Maydell (7): |
42 | boards.h: Remove doc comment reference to nonexistent function | 45 | qemu-options.hx: Fix formatting of -machine memory-backend option |
43 | hw/net/dp8393x: don't make prom region 'nomigrate' | 46 | target/arm: Enforce that M-profile SP low 2 bits are always zero |
47 | target/arm: Add missing 'return's after calling v7m_exception_taken() | ||
48 | target/arm: Report M-profile alignment faults correctly to the guest | ||
49 | hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts | ||
50 | hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING | ||
51 | hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS | ||
44 | 52 | ||
45 | Philippe Mathieu-Daudé (1): | 53 | Philippe Mathieu-Daudé (1): |
46 | hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset' | 54 | hw/arm/nseries: Display hexadecimal value with '0x' prefix |
47 | 55 | ||
48 | Richard Henderson (3): | 56 | Richard Henderson (3): |
49 | target/arm: Suppress Coverity warning for PRF | 57 | target/arm: Correctly bound length in sve_zcr_get_valid_len |
50 | tcg: Restrict check_size_impl to multiples of the line size | 58 | target/arm: Export aarch64_sve_zcr_get_valid_len |
51 | target/arm: Fix do_predset for large VL | 59 | target/arm: Add sve-default-vector-length cpu property |
52 | 60 | ||
53 | include/hw/arm/smmu-common.h | 1 + | 61 | docs/system/arm/cpu-features.rst | 15 ++++++++++ |
54 | include/hw/boards.h | 3 +-- | 62 | configure | 2 +- |
55 | include/hw/ptimer.h | 9 +++++++++ | 63 | hw/arm/smmuv3-internal.h | 2 +- |
56 | hw/arm/smmu-common.c | 2 +- | 64 | target/arm/cpu.h | 5 ++++ |
57 | hw/core/ptimer.c | 22 +++++++++++++++++++++- | 65 | target/arm/internals.h | 10 +++++++ |
58 | hw/net/dp8393x.c | 2 +- | 66 | hw/arm/nseries.c | 2 +- |
59 | hw/sd/omap_mmc.c | 14 +++++++++++--- | 67 | hw/gpio/aspeed_gpio.c | 3 +- |
60 | hw/timer/cmsdk-apb-timer.c | 20 ++++++++++++++++++-- | 68 | hw/intc/armv7m_nvic.c | 40 +++++++++++++++++++-------- |
61 | target/arm/translate-sve.c | 14 ++++---------- | 69 | target/arm/cpu.c | 14 ++++++++-- |
62 | tcg/tcg-op-gvec.c | 7 +++++-- | 70 | target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++++++++++ |
63 | tests/ptimer-test.c | 25 +++++++++++++++++++------ | 71 | target/arm/gdbstub.c | 4 +++ |
64 | 11 files changed, 91 insertions(+), 28 deletions(-) | 72 | target/arm/helper.c | 8 ++++-- |
73 | target/arm/m_helper.c | 24 ++++++++++++---- | ||
74 | target/arm/translate.c | 3 ++ | ||
75 | target/i386/cpu.c | 2 +- | ||
76 | MAINTAINERS | 2 +- | ||
77 | qemu-options.hx | 30 +++++++++++--------- | ||
78 | 17 files changed, 183 insertions(+), 43 deletions(-) | ||
65 | 79 | diff view generated by jsdifflib |
1 | From: Guenter Roeck <linux@roeck-us.net> | 1 | From: Joe Komlodi <joe.komlodi@xilinx.com> |
---|---|---|---|
2 | 2 | ||
3 | The CMSDK APB timer is currently always configured as periodic timer. | 3 | The bit to see if a CD is valid is the last bit of the first word of the CD. |
4 | This results in the following messages when trying to boot Linux. | ||
5 | 4 | ||
6 | Timer with delta zero, disabling | 5 | Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com> |
7 | 6 | Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com | |
8 | If the timer limit set with the RELOAD command is 0, the timer | ||
9 | needs to be enabled as one-shot timer. | ||
10 | |||
11 | Signed-off-by: Guenter Roeck <linux@roeck-us.net> | ||
12 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
13 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
14 | Tested-by: Guenter Roeck <linux@roeck-us.net> | ||
15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 8 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
16 | --- | 9 | --- |
17 | hw/timer/cmsdk-apb-timer.c | 2 +- | 10 | hw/arm/smmuv3-internal.h | 2 +- |
18 | 1 file changed, 1 insertion(+), 1 deletion(-) | 11 | 1 file changed, 1 insertion(+), 1 deletion(-) |
19 | 12 | ||
20 | diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c | 13 | diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h |
21 | index XXXXXXX..XXXXXXX 100644 | 14 | index XXXXXXX..XXXXXXX 100644 |
22 | --- a/hw/timer/cmsdk-apb-timer.c | 15 | --- a/hw/arm/smmuv3-internal.h |
23 | +++ b/hw/timer/cmsdk-apb-timer.c | 16 | +++ b/hw/arm/smmuv3-internal.h |
24 | @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value, | 17 | @@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste) |
25 | } | 18 | |
26 | s->ctrl = value & 0xf; | 19 | /* CD fields */ |
27 | if (s->ctrl & R_CTRL_EN_MASK) { | 20 | |
28 | - ptimer_run(s->timer, 0); | 21 | -#define CD_VALID(x) extract32((x)->word[0], 30, 1) |
29 | + ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0); | 22 | +#define CD_VALID(x) extract32((x)->word[0], 31, 1) |
30 | } else { | 23 | #define CD_ASID(x) extract32((x)->word[1], 16, 16) |
31 | ptimer_stop(s->timer); | 24 | #define CD_TTB(x, sel) \ |
32 | } | 25 | ({ \ |
33 | -- | 26 | -- |
34 | 2.17.1 | 27 | 2.20.1 |
35 | 28 | ||
36 | 29 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | The documentation of the -machine memory-backend has some minor | ||
2 | formatting errors: | ||
3 | * Misindentation of the initial line meant that the whole option | ||
4 | section is incorrectly indented in the HTML output compared to | ||
5 | the other -machine options | ||
6 | * The examples weren't indented, which meant that they were formatted | ||
7 | as plain run-on text including outputting the "::" as text. | ||
8 | * The a) b) list has no rst-format markup so it is rendered as | ||
9 | a single run-on paragraph | ||
1 | 10 | ||
11 | Fix the formatting. | ||
12 | |||
13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
14 | Reviewed-by: Igor Mammedov <imammedo@redhat.com> | ||
15 | Message-id: 20210719105257.3599-1-peter.maydell@linaro.org | ||
16 | --- | ||
17 | qemu-options.hx | 30 +++++++++++++++++------------- | ||
18 | 1 file changed, 17 insertions(+), 13 deletions(-) | ||
19 | |||
20 | diff --git a/qemu-options.hx b/qemu-options.hx | ||
21 | index XXXXXXX..XXXXXXX 100644 | ||
22 | --- a/qemu-options.hx | ||
23 | +++ b/qemu-options.hx | ||
24 | @@ -XXX,XX +XXX,XX @@ SRST | ||
25 | Enables or disables ACPI Heterogeneous Memory Attribute Table | ||
26 | (HMAT) support. The default is off. | ||
27 | |||
28 | - ``memory-backend='id'`` | ||
29 | + ``memory-backend='id'`` | ||
30 | An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options. | ||
31 | Allows to use a memory backend as main RAM. | ||
32 | |||
33 | For example: | ||
34 | :: | ||
35 | - -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on | ||
36 | - -machine memory-backend=pc.ram | ||
37 | - -m 512M | ||
38 | + | ||
39 | + -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on | ||
40 | + -machine memory-backend=pc.ram | ||
41 | + -m 512M | ||
42 | |||
43 | Migration compatibility note: | ||
44 | - a) as backend id one shall use value of 'default-ram-id', advertised by | ||
45 | - machine type (available via ``query-machines`` QMP command), if migration | ||
46 | - to/from old QEMU (<5.0) is expected. | ||
47 | - b) for machine types 4.0 and older, user shall | ||
48 | - use ``x-use-canonical-path-for-ramblock-id=off`` backend option | ||
49 | - if migration to/from old QEMU (<5.0) is expected. | ||
50 | + | ||
51 | + * as backend id one shall use value of 'default-ram-id', advertised by | ||
52 | + machine type (available via ``query-machines`` QMP command), if migration | ||
53 | + to/from old QEMU (<5.0) is expected. | ||
54 | + * for machine types 4.0 and older, user shall | ||
55 | + use ``x-use-canonical-path-for-ramblock-id=off`` backend option | ||
56 | + if migration to/from old QEMU (<5.0) is expected. | ||
57 | + | ||
58 | For example: | ||
59 | :: | ||
60 | - -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off | ||
61 | - -machine memory-backend=pc.ram | ||
62 | - -m 512M | ||
63 | + | ||
64 | + -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off | ||
65 | + -machine memory-backend=pc.ram | ||
66 | + -m 512M | ||
67 | ERST | ||
68 | |||
69 | HXCOMM Deprecated by -machine | ||
70 | -- | ||
71 | 2.20.1 | ||
72 | |||
73 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | For M-profile, unlike A-profile, the low 2 bits of SP are defined to be | ||
2 | RES0H, which is to say that they must be hardwired to zero so that | ||
3 | guest attempts to write non-zero values to them are ignored. | ||
1 | 4 | ||
5 | Implement this behaviour by masking out the low bits: | ||
6 | * for writes to r13 by the gdbstub | ||
7 | * for writes to any of the various flavours of SP via MSR | ||
8 | * for writes to r13 via store_reg() in generated code | ||
9 | |||
10 | Note that all the direct uses of cpu_R[] in translate.c are in places | ||
11 | where the register is definitely not r13 (usually because that has | ||
12 | been checked for as an UNDEFINED or UNPREDICTABLE case and handled as | ||
13 | UNDEF). | ||
14 | |||
15 | All the other writes to regs[13] in C code are either: | ||
16 | * A-profile only code | ||
17 | * writes of values we can guarantee to be aligned, such as | ||
18 | - writes of previous-SP-value plus or minus a 4-aligned constant | ||
19 | - writes of the value in an SP limit register (which we already | ||
20 | enforce to be aligned) | ||
21 | |||
22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
23 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
24 | Message-id: 20210723162146.5167-2-peter.maydell@linaro.org | ||
25 | --- | ||
26 | target/arm/gdbstub.c | 4 ++++ | ||
27 | target/arm/m_helper.c | 14 ++++++++------ | ||
28 | target/arm/translate.c | 3 +++ | ||
29 | 3 files changed, 15 insertions(+), 6 deletions(-) | ||
30 | |||
31 | diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c | ||
32 | index XXXXXXX..XXXXXXX 100644 | ||
33 | --- a/target/arm/gdbstub.c | ||
34 | +++ b/target/arm/gdbstub.c | ||
35 | @@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n) | ||
36 | |||
37 | if (n < 16) { | ||
38 | /* Core integer register. */ | ||
39 | + if (n == 13 && arm_feature(env, ARM_FEATURE_M)) { | ||
40 | + /* M profile SP low bits are always 0 */ | ||
41 | + tmp &= ~3; | ||
42 | + } | ||
43 | env->regs[n] = tmp; | ||
44 | return 4; | ||
45 | } | ||
46 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c | ||
47 | index XXXXXXX..XXXXXXX 100644 | ||
48 | --- a/target/arm/m_helper.c | ||
49 | +++ b/target/arm/m_helper.c | ||
50 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
51 | if (!env->v7m.secure) { | ||
52 | return; | ||
53 | } | ||
54 | - env->v7m.other_ss_msp = val; | ||
55 | + env->v7m.other_ss_msp = val & ~3; | ||
56 | return; | ||
57 | case 0x89: /* PSP_NS */ | ||
58 | if (!env->v7m.secure) { | ||
59 | return; | ||
60 | } | ||
61 | - env->v7m.other_ss_psp = val; | ||
62 | + env->v7m.other_ss_psp = val & ~3; | ||
63 | return; | ||
64 | case 0x8a: /* MSPLIM_NS */ | ||
65 | if (!env->v7m.secure) { | ||
66 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
67 | |||
68 | limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; | ||
69 | |||
70 | + val &= ~0x3; | ||
71 | + | ||
72 | if (val < limit) { | ||
73 | raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC()); | ||
74 | } | ||
75 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
76 | break; | ||
77 | case 8: /* MSP */ | ||
78 | if (v7m_using_psp(env)) { | ||
79 | - env->v7m.other_sp = val; | ||
80 | + env->v7m.other_sp = val & ~3; | ||
81 | } else { | ||
82 | - env->regs[13] = val; | ||
83 | + env->regs[13] = val & ~3; | ||
84 | } | ||
85 | break; | ||
86 | case 9: /* PSP */ | ||
87 | if (v7m_using_psp(env)) { | ||
88 | - env->regs[13] = val; | ||
89 | + env->regs[13] = val & ~3; | ||
90 | } else { | ||
91 | - env->v7m.other_sp = val; | ||
92 | + env->v7m.other_sp = val & ~3; | ||
93 | } | ||
94 | break; | ||
95 | case 10: /* MSPLIM */ | ||
96 | diff --git a/target/arm/translate.c b/target/arm/translate.c | ||
97 | index XXXXXXX..XXXXXXX 100644 | ||
98 | --- a/target/arm/translate.c | ||
99 | +++ b/target/arm/translate.c | ||
100 | @@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var) | ||
101 | */ | ||
102 | tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3); | ||
103 | s->base.is_jmp = DISAS_JUMP; | ||
104 | + } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) { | ||
105 | + /* For M-profile SP bits [1:0] are always zero */ | ||
106 | + tcg_gen_andi_i32(var, var, ~3); | ||
107 | } | ||
108 | tcg_gen_mov_i32(cpu_R[reg], var); | ||
109 | tcg_temp_free_i32(var); | ||
110 | -- | ||
111 | 2.20.1 | ||
112 | |||
113 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | In do_v7m_exception_exit(), we perform various checks as part of | ||
2 | performing the exception return. If one of these checks fails, the | ||
3 | architecture requires that we take an appropriate exception on the | ||
4 | existing stackframe. We implement this by calling | ||
5 | v7m_exception_taken() to set up to take the new exception, and then | ||
6 | immediately returning from do_v7m_exception_exit() without proceeding | ||
7 | any further with the unstack-and-exception-return process. | ||
1 | 8 | ||
9 | In a couple of checks that are new in v8.1M, we forgot the "return" | ||
10 | statement, with the effect that if bad code in the guest tripped over | ||
11 | these checks we would set up to take a UsageFault exception but then | ||
12 | blunder on trying to also unstack and return from the original | ||
13 | exception, with the probable result that the guest would crash. | ||
14 | |||
15 | Add the missing return statements. | ||
16 | |||
17 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
18 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
19 | Message-id: 20210723162146.5167-3-peter.maydell@linaro.org | ||
20 | --- | ||
21 | target/arm/m_helper.c | 2 ++ | ||
22 | 1 file changed, 2 insertions(+) | ||
23 | |||
24 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c | ||
25 | index XXXXXXX..XXXXXXX 100644 | ||
26 | --- a/target/arm/m_helper.c | ||
27 | +++ b/target/arm/m_helper.c | ||
28 | @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) | ||
29 | qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " | ||
30 | "stackframe: NSACR prevents clearing FPU registers\n"); | ||
31 | v7m_exception_taken(cpu, excret, true, false); | ||
32 | + return; | ||
33 | } else if (!cpacr_pass) { | ||
34 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, | ||
35 | exc_secure); | ||
36 | @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) | ||
37 | qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " | ||
38 | "stackframe: CPACR prevents clearing FPU registers\n"); | ||
39 | v7m_exception_taken(cpu, excret, true, false); | ||
40 | + return; | ||
41 | } | ||
42 | } | ||
43 | /* Clear s0..s15, FPSCR and VPR */ | ||
44 | -- | ||
45 | 2.20.1 | ||
46 | |||
47 | diff view generated by jsdifflib |
1 | Currently we use memory_region_init_rom_nomigrate() to create | 1 | For M-profile, we weren't reporting alignment faults triggered by the |
---|---|---|---|
2 | the "dp3893x-prom" memory region, and we don't manually register | 2 | generic TCG code correctly to the guest. These get passed into |
3 | it with vmstate_register_ram(). This currently means that its | 3 | arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile |
4 | contents are migrated but as a ram block whose name is the empty | 4 | style exception.fsr value of 1. We didn't check for this, and so |
5 | string; in future it may mean they are not migrated at all. Use | 5 | they fell through into the default of "assume this is an MPU fault" |
6 | memory_region_init_ram() instead. | 6 | and were reported to the guest as a data access violation MPU fault. |
7 | 7 | ||
8 | Note that this is a a cross-version migration compatibility break | 8 | Report these alignment faults as UsageFaults which set the UNALIGNED |
9 | for the MIPS "magnum" and "pica61" machines. | 9 | bit in the UFSR. |
10 | 10 | ||
11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
12 | Reviewed-by: Aleksandar Markovic <aleksandar.markovic@wavecomp.com> | 12 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
13 | Message-id: 20180706174309.27110-1-peter.maydell@linaro.org | 13 | Message-id: 20210723162146.5167-4-peter.maydell@linaro.org |
14 | --- | 14 | --- |
15 | hw/net/dp8393x.c | 2 +- | 15 | target/arm/m_helper.c | 8 ++++++++ |
16 | 1 file changed, 1 insertion(+), 1 deletion(-) | 16 | 1 file changed, 8 insertions(+) |
17 | 17 | ||
18 | diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c | 18 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c |
19 | index XXXXXXX..XXXXXXX 100644 | 19 | index XXXXXXX..XXXXXXX 100644 |
20 | --- a/hw/net/dp8393x.c | 20 | --- a/target/arm/m_helper.c |
21 | +++ b/hw/net/dp8393x.c | 21 | +++ b/target/arm/m_helper.c |
22 | @@ -XXX,XX +XXX,XX @@ static void dp8393x_realize(DeviceState *dev, Error **errp) | 22 | @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) |
23 | s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s); | 23 | env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; |
24 | s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */ | 24 | break; |
25 | 25 | case EXCP_UNALIGNED: | |
26 | - memory_region_init_ram_nomigrate(&s->prom, OBJECT(dev), | 26 | + /* Unaligned faults reported by M-profile aware code */ |
27 | + memory_region_init_ram(&s->prom, OBJECT(dev), | 27 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); |
28 | "dp8393x-prom", SONIC_PROM_SIZE, &local_err); | 28 | env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK; |
29 | if (local_err) { | 29 | break; |
30 | error_propagate(errp, local_err); | 30 | @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) |
31 | } | ||
32 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); | ||
33 | break; | ||
34 | + case 0x1: /* Alignment fault reported by generic code */ | ||
35 | + qemu_log_mask(CPU_LOG_INT, | ||
36 | + "...really UsageFault with UFSR.UNALIGNED\n"); | ||
37 | + env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK; | ||
38 | + armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, | ||
39 | + env->v7m.secure); | ||
40 | + break; | ||
41 | default: | ||
42 | /* | ||
43 | * All other FSR values are either MPU faults or "can't happen | ||
31 | -- | 44 | -- |
32 | 2.17.1 | 45 | 2.20.1 |
33 | 46 | ||
34 | 47 | diff view generated by jsdifflib |
1 | If the CMSDK APB timer is set up with a zero RELOAD value | 1 | The ISCR.ISRPENDING bit is set when an external interrupt is pending. |
---|---|---|---|
2 | then it will count down to zero, fire once and then stay | 2 | This is true whether that external interrupt is enabled or not. |
3 | at zero. From the point of view of the ptimer system, the | 3 | This means that we can't use 's->vectpending == 0' as a shortcut to |
4 | timer is disabled; but the enable bit in the CTRL register | 4 | "ISRPENDING is zero", because s->vectpending indicates only the |
5 | is still set and if the guest subsequently writes to the | 5 | highest priority pending enabled interrupt. |
6 | RELOAD or VALUE registers this should cause the timer to | ||
7 | start counting down again. | ||
8 | 6 | ||
9 | Add code to the write paths for RELOAD and VALUE so that | 7 | Remove the incorrect optimization so that if there is no pending |
10 | we correctly restart the timer in this situation. | 8 | enabled interrupt we fall through to scanning through the whole |
11 | 9 | interrupt array. | |
12 | Conversely, if the new RELOAD and VALUE are both zero, | ||
13 | we should stop the ptimer. | ||
14 | 10 | ||
15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
16 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 12 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
17 | Tested-by: Guenter Roeck <linux@roeck-us.net> | 13 | Message-id: 20210723162146.5167-5-peter.maydell@linaro.org |
18 | Message-id: 20180703171044.9503-5-peter.maydell@linaro.org | ||
19 | --- | 14 | --- |
20 | hw/timer/cmsdk-apb-timer.c | 16 ++++++++++++++++ | 15 | hw/intc/armv7m_nvic.c | 9 ++++----- |
21 | 1 file changed, 16 insertions(+) | 16 | 1 file changed, 4 insertions(+), 5 deletions(-) |
22 | 17 | ||
23 | diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c | 18 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c |
24 | index XXXXXXX..XXXXXXX 100644 | 19 | index XXXXXXX..XXXXXXX 100644 |
25 | --- a/hw/timer/cmsdk-apb-timer.c | 20 | --- a/hw/intc/armv7m_nvic.c |
26 | +++ b/hw/timer/cmsdk-apb-timer.c | 21 | +++ b/hw/intc/armv7m_nvic.c |
27 | @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value, | 22 | @@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s) |
28 | break; | 23 | { |
29 | case A_RELOAD: | 24 | int irq; |
30 | /* Writing to reload also sets the current timer value */ | 25 | |
31 | + if (!value) { | 26 | - /* We can shortcut if the highest priority pending interrupt |
32 | + ptimer_stop(s->timer); | 27 | - * happens to be external or if there is nothing pending. |
33 | + } | 28 | + /* |
34 | ptimer_set_limit(s->timer, value, 1); | 29 | + * We can shortcut if the highest priority pending interrupt |
35 | + if (value && (s->ctrl & R_CTRL_EN_MASK)) { | 30 | + * happens to be external; if not we need to check the whole |
36 | + /* | 31 | + * vectors[] array. |
37 | + * Make sure timer is running (it might have stopped if this | 32 | */ |
38 | + * was an expired one-shot timer) | 33 | if (s->vectpending > NVIC_FIRST_IRQ) { |
39 | + */ | 34 | return true; |
40 | + ptimer_run(s->timer, 0); | 35 | } |
41 | + } | 36 | - if (s->vectpending == 0) { |
42 | break; | 37 | - return false; |
43 | case A_VALUE: | 38 | - } |
44 | + if (!value && !ptimer_get_limit(s->timer)) { | 39 | |
45 | + ptimer_stop(s->timer); | 40 | for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) { |
46 | + } | 41 | if (s->vectors[irq].pending) { |
47 | ptimer_set_count(s->timer, value); | ||
48 | + if (value && (s->ctrl & R_CTRL_EN_MASK)) { | ||
49 | + ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0); | ||
50 | + } | ||
51 | break; | ||
52 | case A_INTSTATUS: | ||
53 | /* Just one bit, which is W1C. */ | ||
54 | -- | 42 | -- |
55 | 2.17.1 | 43 | 2.20.1 |
56 | 44 | ||
57 | 45 | diff view generated by jsdifflib |
1 | The CMSDK timer interrupt triggers when the counter goes from 1 to 0, | 1 | The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of |
---|---|---|---|
2 | so we want to trigger immediately, rather than waiting for a | 2 | the register. We were incorrectly masking it to 8 bits, so it would |
3 | clock cycle. Drop the incorrect NO_IMMEDIATE_TRIGGER setting. | 3 | report the wrong value if the pending exception was greater than 256. |
4 | We also do not want to get an interrupt if the guest sets the | 4 | Fix the bug. |
5 | counter directly to zero, so use the new TRIGGER_ONLY_ON_DECREMENT | ||
6 | policy. | ||
7 | 5 | ||
8 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 6 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
9 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 7 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
10 | Tested-by: Guenter Roeck <linux@roeck-us.net> | 8 | Message-id: 20210723162146.5167-6-peter.maydell@linaro.org |
11 | Message-id: 20180703171044.9503-3-peter.maydell@linaro.org | ||
12 | --- | 9 | --- |
13 | hw/timer/cmsdk-apb-timer.c | 2 +- | 10 | hw/intc/armv7m_nvic.c | 2 +- |
14 | 1 file changed, 1 insertion(+), 1 deletion(-) | 11 | 1 file changed, 1 insertion(+), 1 deletion(-) |
15 | 12 | ||
16 | diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c | 13 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c |
17 | index XXXXXXX..XXXXXXX 100644 | 14 | index XXXXXXX..XXXXXXX 100644 |
18 | --- a/hw/timer/cmsdk-apb-timer.c | 15 | --- a/hw/intc/armv7m_nvic.c |
19 | +++ b/hw/timer/cmsdk-apb-timer.c | 16 | +++ b/hw/intc/armv7m_nvic.c |
20 | @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp) | 17 | @@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) |
21 | bh = qemu_bh_new(cmsdk_apb_timer_tick, s); | 18 | /* VECTACTIVE */ |
22 | s->timer = ptimer_init(bh, | 19 | val = cpu->env.v7m.exception; |
23 | PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD | | 20 | /* VECTPENDING */ |
24 | - PTIMER_POLICY_NO_IMMEDIATE_TRIGGER | | 21 | - val |= (s->vectpending & 0xff) << 12; |
25 | + PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT | | 22 | + val |= (s->vectpending & 0x1ff) << 12; |
26 | PTIMER_POLICY_NO_IMMEDIATE_RELOAD | | 23 | /* ISRPENDING - set if any external IRQ is pending */ |
27 | PTIMER_POLICY_NO_COUNTER_ROUND_DOWN); | 24 | if (nvic_isrpending(s)) { |
28 | 25 | val |= (1 << 22); | |
29 | -- | 26 | -- |
30 | 2.17.1 | 27 | 2.20.1 |
31 | 28 | ||
32 | 29 | diff view generated by jsdifflib |
1 | The CMSDK timer behaviour is that an interrupt is triggered when the | 1 | In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if |
---|---|---|---|
2 | counter counts down from 1 to 0; however one is not triggered if the | 2 | the register is accessed NonSecure and the highest priority pending |
3 | counter is manually set to 0 by a guest write to the counter register. | 3 | enabled exception (that would be returned in the VECTPENDING field) |
4 | Currently ptimer can't handle this; add a policy option to allow | 4 | targets Secure, then the VECTPENDING field must read 1 rather than |
5 | a ptimer user to request this behaviour. | 5 | the exception number of the pending exception. Implement this. |
6 | 6 | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
8 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 8 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
9 | Tested-by: Guenter Roeck <linux@roeck-us.net> | 9 | Message-id: 20210723162146.5167-7-peter.maydell@linaro.org |
10 | Message-id: 20180703171044.9503-2-peter.maydell@linaro.org | ||
11 | --- | 10 | --- |
12 | include/hw/ptimer.h | 9 +++++++++ | 11 | hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++------- |
13 | hw/core/ptimer.c | 22 +++++++++++++++++++++- | 12 | 1 file changed, 24 insertions(+), 7 deletions(-) |
14 | tests/ptimer-test.c | 25 +++++++++++++++++++------ | ||
15 | 3 files changed, 49 insertions(+), 7 deletions(-) | ||
16 | 13 | ||
17 | diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h | 14 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c |
18 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
19 | --- a/include/hw/ptimer.h | 16 | --- a/hw/intc/armv7m_nvic.c |
20 | +++ b/include/hw/ptimer.h | 17 | +++ b/hw/intc/armv7m_nvic.c |
21 | @@ -XXX,XX +XXX,XX @@ | 18 | @@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque) |
22 | * not the one less. */ | 19 | nvic_irq_update(s); |
23 | #define PTIMER_POLICY_NO_COUNTER_ROUND_DOWN (1 << 4) | 20 | } |
24 | 21 | ||
25 | +/* | 22 | +static bool vectpending_targets_secure(NVICState *s) |
26 | + * Starting to run with a zero counter, or setting the counter to "0" via | 23 | +{ |
27 | + * ptimer_set_count() or ptimer_set_limit() will not trigger the timer | 24 | + /* Return true if s->vectpending targets Secure state */ |
28 | + * (though it will cause a reload). Only a counter decrement to "0" | 25 | + if (s->vectpending_is_s_banked) { |
29 | + * will cause a trigger. Not compatible with NO_IMMEDIATE_TRIGGER; | 26 | + return true; |
30 | + * ptimer_init() will assert() that you don't set both. | 27 | + } |
31 | + */ | 28 | + return !exc_is_banked(s->vectpending) && |
32 | +#define PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT (1 << 5) | 29 | + exc_targets_secure(s, s->vectpending); |
30 | +} | ||
33 | + | 31 | + |
34 | /* ptimer.c */ | 32 | void armv7m_nvic_get_pending_irq_info(void *opaque, |
35 | typedef struct ptimer_state ptimer_state; | 33 | int *pirq, bool *ptargets_secure) |
36 | typedef void (*ptimer_cb)(void *opaque); | ||
37 | diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c | ||
38 | index XXXXXXX..XXXXXXX 100644 | ||
39 | --- a/hw/core/ptimer.c | ||
40 | +++ b/hw/core/ptimer.c | ||
41 | @@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust) | ||
42 | uint32_t period_frac = s->period_frac; | ||
43 | uint64_t period = s->period; | ||
44 | uint64_t delta = s->delta; | ||
45 | + bool suppress_trigger = false; | ||
46 | |||
47 | - if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) { | ||
48 | + /* | ||
49 | + * Note that if delta_adjust is 0 then we must be here because of | ||
50 | + * a count register write or timer start, not because of timer expiry. | ||
51 | + * In that case the policy might require us to suppress the timer trigger | ||
52 | + * that we would otherwise generate for a zero delta. | ||
53 | + */ | ||
54 | + if (delta_adjust == 0 && | ||
55 | + (s->policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT)) { | ||
56 | + suppress_trigger = true; | ||
57 | + } | ||
58 | + if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER) | ||
59 | + && !suppress_trigger) { | ||
60 | ptimer_trigger(s); | ||
61 | } | ||
62 | |||
63 | @@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask) | ||
64 | s->bh = bh; | ||
65 | s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s); | ||
66 | s->policy_mask = policy_mask; | ||
67 | + | ||
68 | + /* | ||
69 | + * These two policies are incompatible -- trigger-on-decrement implies | ||
70 | + * a timer trigger when the count becomes 0, but no-immediate-trigger | ||
71 | + * implies a trigger when the count stops being 0. | ||
72 | + */ | ||
73 | + assert(!((policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) && | ||
74 | + (policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER))); | ||
75 | return s; | ||
76 | } | ||
77 | |||
78 | diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c | ||
79 | index XXXXXXX..XXXXXXX 100644 | ||
80 | --- a/tests/ptimer-test.c | ||
81 | +++ b/tests/ptimer-test.c | ||
82 | @@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg) | ||
83 | bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER); | ||
84 | bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD); | ||
85 | bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN); | ||
86 | + bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT); | ||
87 | |||
88 | triggered = false; | ||
89 | |||
90 | @@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg) | ||
91 | g_assert_cmpuint(ptimer_get_count(ptimer), ==, | ||
92 | no_immediate_reload ? 0 : 10); | ||
93 | |||
94 | - if (no_immediate_trigger) { | ||
95 | + if (no_immediate_trigger || trig_only_on_dec) { | ||
96 | g_assert_false(triggered); | ||
97 | } else { | ||
98 | g_assert_true(triggered); | ||
99 | @@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg) | ||
100 | bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER); | ||
101 | bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD); | ||
102 | bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN); | ||
103 | + bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT); | ||
104 | |||
105 | triggered = false; | ||
106 | |||
107 | @@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg) | ||
108 | g_assert_cmpuint(ptimer_get_count(ptimer), ==, | ||
109 | no_immediate_reload ? 0 : 99); | ||
110 | |||
111 | - if (no_immediate_trigger) { | ||
112 | + if (no_immediate_trigger || trig_only_on_dec) { | ||
113 | g_assert_false(triggered); | ||
114 | } else { | ||
115 | g_assert_true(triggered); | ||
116 | @@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg) | ||
117 | g_assert_cmpuint(ptimer_get_count(ptimer), ==, | ||
118 | no_immediate_reload ? 0 : 99); | ||
119 | |||
120 | - if (no_immediate_trigger) { | ||
121 | + if (no_immediate_trigger || trig_only_on_dec) { | ||
122 | g_assert_false(triggered); | ||
123 | } else { | ||
124 | g_assert_true(triggered); | ||
125 | @@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg) | ||
126 | ptimer_state *ptimer = ptimer_init(bh, *policy); | ||
127 | bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER); | ||
128 | bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER); | ||
129 | + bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT); | ||
130 | |||
131 | triggered = false; | ||
132 | |||
133 | @@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg) | ||
134 | |||
135 | g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0); | ||
136 | |||
137 | - if (no_immediate_trigger) { | ||
138 | + if (no_immediate_trigger || trig_only_on_dec) { | ||
139 | g_assert_false(triggered); | ||
140 | } else { | ||
141 | g_assert_true(triggered); | ||
142 | @@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg) | ||
143 | QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL); | ||
144 | ptimer_state *ptimer = ptimer_init(bh, *policy); | ||
145 | bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER); | ||
146 | + bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT); | ||
147 | |||
148 | triggered = false; | ||
149 | |||
150 | @@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg) | ||
151 | |||
152 | g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0); | ||
153 | |||
154 | - if (no_immediate_trigger) { | ||
155 | + if (no_immediate_trigger || trig_only_on_dec) { | ||
156 | g_assert_false(triggered); | ||
157 | } else { | ||
158 | g_assert_true(triggered); | ||
159 | @@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy) | ||
160 | g_strlcat(policy_name, "no_counter_rounddown,", 256); | ||
161 | } | ||
162 | |||
163 | + if (policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) { | ||
164 | + g_strlcat(policy_name, "trigger_only_on_decrement,", 256); | ||
165 | + } | ||
166 | + | ||
167 | g_test_add_data_func_full( | ||
168 | tmp = g_strdup_printf("/ptimer/set_count policy=%s", policy_name), | ||
169 | g_memdup(&policy, 1), check_set_count, g_free); | ||
170 | @@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy) | ||
171 | |||
172 | static void add_all_ptimer_policies_comb_tests(void) | ||
173 | { | 34 | { |
174 | - int last_policy = PTIMER_POLICY_NO_COUNTER_ROUND_DOWN; | 35 | @@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque, |
175 | + int last_policy = PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT; | 36 | |
176 | int policy = PTIMER_POLICY_DEFAULT; | 37 | assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq); |
177 | 38 | ||
178 | for (; policy < (last_policy << 1); policy++) { | 39 | - if (s->vectpending_is_s_banked) { |
179 | + if ((policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) && | 40 | - targets_secure = true; |
180 | + (policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) { | 41 | - } else { |
181 | + /* Incompatible policy flag settings -- don't try to test them */ | 42 | - targets_secure = !exc_is_banked(pending) && |
182 | + continue; | 43 | - exc_targets_secure(s, pending); |
44 | - } | ||
45 | + targets_secure = vectpending_targets_secure(s); | ||
46 | |||
47 | trace_nvic_get_pending_irq_info(pending, targets_secure); | ||
48 | |||
49 | @@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) | ||
50 | /* VECTACTIVE */ | ||
51 | val = cpu->env.v7m.exception; | ||
52 | /* VECTPENDING */ | ||
53 | - val |= (s->vectpending & 0x1ff) << 12; | ||
54 | + if (s->vectpending) { | ||
55 | + /* | ||
56 | + * From v8.1M VECTPENDING must read as 1 if accessed as | ||
57 | + * NonSecure and the highest priority pending and enabled | ||
58 | + * exception targets Secure. | ||
59 | + */ | ||
60 | + int vp = s->vectpending; | ||
61 | + if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) && | ||
62 | + vectpending_targets_secure(s)) { | ||
63 | + vp = 1; | ||
64 | + } | ||
65 | + val |= (vp & 0x1ff) << 12; | ||
183 | + } | 66 | + } |
184 | add_ptimer_tests(policy); | 67 | /* ISRPENDING - set if any external IRQ is pending */ |
185 | } | 68 | if (nvic_isrpending(s)) { |
186 | } | 69 | val |= (1 << 22); |
187 | -- | 70 | -- |
188 | 2.17.1 | 71 | 2.20.1 |
189 | 72 | ||
190 | 73 | diff view generated by jsdifflib |
1 | From: Eric Auger <eric.auger@redhat.com> | 1 | From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> |
---|---|---|---|
2 | 2 | ||
3 | smmu_iommu_mr() aims at returning the IOMMUMemoryRegion corresponding | 3 | Missed in commit f3478392 "docs: Move deprecation, build |
4 | to a given sid. The function extracts both the PCIe bus number and | 4 | and license info out of system/" |
5 | the devfn to return this data. Current computation of devfn is wrong | ||
6 | as it only returns the PCIe function instead of slot | function. | ||
7 | 5 | ||
8 | Fixes 32cfd7f39e08 ("hw/arm/smmuv3: Cache/invalidate config data") | 6 | Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> |
9 | |||
10 | Signed-off-by: Eric Auger <eric.auger@redhat.com> | ||
11 | Message-id: 1530775623-32399-1-git-send-email-eric.auger@redhat.com | ||
12 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
8 | Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com | ||
13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
14 | --- | 10 | --- |
15 | include/hw/arm/smmu-common.h | 1 + | 11 | configure | 2 +- |
16 | hw/arm/smmu-common.c | 2 +- | 12 | target/i386/cpu.c | 2 +- |
17 | 2 files changed, 2 insertions(+), 1 deletion(-) | 13 | MAINTAINERS | 2 +- |
14 | 3 files changed, 3 insertions(+), 3 deletions(-) | ||
18 | 15 | ||
19 | diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h | 16 | diff --git a/configure b/configure |
17 | index XXXXXXX..XXXXXXX 100755 | ||
18 | --- a/configure | ||
19 | +++ b/configure | ||
20 | @@ -XXX,XX +XXX,XX @@ fi | ||
21 | |||
22 | if test -n "${deprecated_features}"; then | ||
23 | echo "Warning, deprecated features enabled." | ||
24 | - echo "Please see docs/system/deprecated.rst" | ||
25 | + echo "Please see docs/about/deprecated.rst" | ||
26 | echo " features: ${deprecated_features}" | ||
27 | fi | ||
28 | |||
29 | diff --git a/target/i386/cpu.c b/target/i386/cpu.c | ||
20 | index XXXXXXX..XXXXXXX 100644 | 30 | index XXXXXXX..XXXXXXX 100644 |
21 | --- a/include/hw/arm/smmu-common.h | 31 | --- a/target/i386/cpu.c |
22 | +++ b/include/hw/arm/smmu-common.h | 32 | +++ b/target/i386/cpu.c |
23 | @@ -XXX,XX +XXX,XX @@ | 33 | @@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = { |
24 | 34 | * none", but this is just for compatibility while libvirt isn't | |
25 | #define SMMU_PCI_BUS_MAX 256 | 35 | * adapted to resolve CPU model versions before creating VMs. |
26 | #define SMMU_PCI_DEVFN_MAX 256 | 36 | * See "Runnability guarantee of CPU models" at |
27 | +#define SMMU_PCI_DEVFN(sid) (sid & 0xFF) | 37 | - * docs/system/deprecated.rst. |
28 | 38 | + * docs/about/deprecated.rst. | |
29 | #define SMMU_MAX_VA_BITS 48 | 39 | */ |
30 | 40 | X86CPUVersion default_cpu_version = 1; | |
31 | diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c | 41 | |
42 | diff --git a/MAINTAINERS b/MAINTAINERS | ||
32 | index XXXXXXX..XXXXXXX 100644 | 43 | index XXXXXXX..XXXXXXX 100644 |
33 | --- a/hw/arm/smmu-common.c | 44 | --- a/MAINTAINERS |
34 | +++ b/hw/arm/smmu-common.c | 45 | +++ b/MAINTAINERS |
35 | @@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid) | 46 | @@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/* |
36 | bus_n = PCI_BUS_NUM(sid); | 47 | |
37 | smmu_bus = smmu_find_smmu_pcibus(s, bus_n); | 48 | Incompatible changes |
38 | if (smmu_bus) { | 49 | R: libvir-list@redhat.com |
39 | - devfn = sid & 0x7; | 50 | -F: docs/system/deprecated.rst |
40 | + devfn = SMMU_PCI_DEVFN(sid); | 51 | +F: docs/about/deprecated.rst |
41 | smmu = smmu_bus->pbdev[devfn]; | 52 | |
42 | if (smmu) { | 53 | Build System |
43 | return &smmu->iommu; | 54 | ------------ |
44 | -- | 55 | -- |
45 | 2.17.1 | 56 | 2.20.1 |
46 | 57 | ||
47 | 58 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
---|---|---|---|
2 | 2 | ||
3 | Use MAKE_64BIT_MASK instead of open-coding. Remove an odd | 3 | Currently, our only caller is sve_zcr_len_for_el, which has |
4 | vector size check that is unlikely to be more profitable | 4 | already masked the length extracted from ZCR_ELx, so the |
5 | than 3 64-bit integer stores. Correct the iteration for WORD | 5 | masking done here is a nop. But we will shortly have uses |
6 | to avoid writing too much data. | 6 | from other locations, where the length will be unmasked. |
7 | 7 | ||
8 | Fixes RISU tests of PTRUE for VL 256. | 8 | Saturate the length to ARM_MAX_VQ instead of truncating to |
9 | the low 4 bits. | ||
9 | 10 | ||
10 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 11 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
11 | Reviewed-by: Alex Bennée <alex.bennee@linaro.org> | 12 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
12 | Tested-by: Alex Bennée <alex.bennee@linaro.org> | 13 | Message-id: 20210723203344.968563-2-richard.henderson@linaro.org |
13 | Message-id: 20180705191929.30773-3-richard.henderson@linaro.org | ||
14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
15 | --- | 15 | --- |
16 | target/arm/translate-sve.c | 10 ++-------- | 16 | target/arm/helper.c | 4 +++- |
17 | 1 file changed, 2 insertions(+), 8 deletions(-) | 17 | 1 file changed, 3 insertions(+), 1 deletion(-) |
18 | 18 | ||
19 | diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c | 19 | diff --git a/target/arm/helper.c b/target/arm/helper.c |
20 | index XXXXXXX..XXXXXXX 100644 | 20 | index XXXXXXX..XXXXXXX 100644 |
21 | --- a/target/arm/translate-sve.c | 21 | --- a/target/arm/helper.c |
22 | +++ b/target/arm/translate-sve.c | 22 | +++ b/target/arm/helper.c |
23 | @@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag) | 23 | @@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) |
24 | setsz = numelem << esz; | 24 | { |
25 | lastword = word = pred_esz_masks[esz]; | 25 | uint32_t end_len; |
26 | if (setsz % 64) { | 26 | |
27 | - lastword &= ~(-1ull << (setsz % 64)); | 27 | - end_len = start_len &= 0xf; |
28 | + lastword &= MAKE_64BIT_MASK(0, setsz % 64); | 28 | + start_len = MIN(start_len, ARM_MAX_VQ - 1); |
29 | } | 29 | + end_len = start_len; |
30 | } | 30 | + |
31 | 31 | if (!test_bit(start_len, cpu->sve_vq_map)) { | |
32 | @@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag) | 32 | end_len = find_last_bit(cpu->sve_vq_map, start_len); |
33 | tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word); | 33 | assert(end_len < start_len); |
34 | goto done; | ||
35 | } | ||
36 | - if (oprsz * 8 == setsz + 8) { | ||
37 | - tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word); | ||
38 | - tcg_gen_movi_i64(t, 0); | ||
39 | - tcg_gen_st_i64(t, cpu_env, ofs + oprsz - 8); | ||
40 | - goto done; | ||
41 | - } | ||
42 | } | ||
43 | |||
44 | setsz /= 8; | ||
45 | fullsz /= 8; | ||
46 | |||
47 | tcg_gen_movi_i64(t, word); | ||
48 | - for (i = 0; i < setsz; i += 8) { | ||
49 | + for (i = 0; i < QEMU_ALIGN_DOWN(setsz, 8); i += 8) { | ||
50 | tcg_gen_st_i64(t, cpu_env, ofs + i); | ||
51 | } | ||
52 | if (lastword != word) { | ||
53 | -- | 34 | -- |
54 | 2.17.1 | 35 | 2.20.1 |
55 | 36 | ||
56 | 37 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
---|---|---|---|
2 | 2 | ||
3 | Normally this is automatic in the size restrictions that are placed | 3 | Rename from sve_zcr_get_valid_len and make accessible |
4 | on vector sizes coming from the implementation. However, for the | 4 | from outside of helper.c. |
5 | legitimate size tuple [oprsz=8, maxsz=32], we need to clear the final | ||
6 | 24 bytes of the vector register. Without this check, do_dup selects | ||
7 | TCG_TYPE_V128 and clears only 16 bytes. | ||
8 | 5 | ||
9 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
10 | Reviewed-by: Alex Bennée <alex.bennee@linaro.org> | 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
11 | Tested-by: Alex Bennée <alex.bennee@linaro.org> | 8 | Message-id: 20210723203344.968563-3-richard.henderson@linaro.org |
12 | Message-id: 20180705191929.30773-2-richard.henderson@linaro.org | ||
13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
14 | --- | 10 | --- |
15 | tcg/tcg-op-gvec.c | 7 +++++-- | 11 | target/arm/internals.h | 10 ++++++++++ |
16 | 1 file changed, 5 insertions(+), 2 deletions(-) | 12 | target/arm/helper.c | 4 ++-- |
13 | 2 files changed, 12 insertions(+), 2 deletions(-) | ||
17 | 14 | ||
18 | diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c | 15 | diff --git a/target/arm/internals.h b/target/arm/internals.h |
19 | index XXXXXXX..XXXXXXX 100644 | 16 | index XXXXXXX..XXXXXXX 100644 |
20 | --- a/tcg/tcg-op-gvec.c | 17 | --- a/target/arm/internals.h |
21 | +++ b/tcg/tcg-op-gvec.c | 18 | +++ b/target/arm/internals.h |
22 | @@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs, | 19 | @@ -XXX,XX +XXX,XX @@ void arm_translate_init(void); |
23 | in units of LNSZ. This limits the expansion of inline code. */ | 20 | void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb); |
24 | static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz) | 21 | #endif /* CONFIG_TCG */ |
22 | |||
23 | +/** | ||
24 | + * aarch64_sve_zcr_get_valid_len: | ||
25 | + * @cpu: cpu context | ||
26 | + * @start_len: maximum len to consider | ||
27 | + * | ||
28 | + * Return the maximum supported sve vector length <= @start_len. | ||
29 | + * Note that both @start_len and the return value are in units | ||
30 | + * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128. | ||
31 | + */ | ||
32 | +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len); | ||
33 | |||
34 | enum arm_fprounding { | ||
35 | FPROUNDING_TIEEVEN, | ||
36 | diff --git a/target/arm/helper.c b/target/arm/helper.c | ||
37 | index XXXXXXX..XXXXXXX 100644 | ||
38 | --- a/target/arm/helper.c | ||
39 | +++ b/target/arm/helper.c | ||
40 | @@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el) | ||
41 | return 0; | ||
42 | } | ||
43 | |||
44 | -static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) | ||
45 | +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) | ||
25 | { | 46 | { |
26 | - uint32_t lnct = oprsz / lnsz; | 47 | uint32_t end_len; |
27 | - return lnct >= 1 && lnct <= MAX_UNROLL; | 48 | |
28 | + if (oprsz % lnsz == 0) { | 49 | @@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) |
29 | + uint32_t lnct = oprsz / lnsz; | 50 | zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); |
30 | + return lnct >= 1 && lnct <= MAX_UNROLL; | 51 | } |
31 | + } | 52 | |
32 | + return false; | 53 | - return sve_zcr_get_valid_len(cpu, zcr_len); |
54 | + return aarch64_sve_zcr_get_valid_len(cpu, zcr_len); | ||
33 | } | 55 | } |
34 | 56 | ||
35 | static void expand_clr(uint32_t dofs, uint32_t maxsz); | 57 | static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, |
36 | -- | 58 | -- |
37 | 2.17.1 | 59 | 2.20.1 |
38 | 60 | ||
39 | 61 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
---|---|---|---|
2 | 2 | ||
3 | These instructions must perform the sve_access_check, but | 3 | Mirror the behavour of /proc/sys/abi/sve_default_vector_length |
4 | since they are implemented as NOPs there is no generated | 4 | under the real linux kernel. We have no way of passing along |
5 | code to elide when the access check fails. | 5 | a real default across exec like the kernel can, but this is a |
6 | decent way of adjusting the startup vector length of a process. | ||
6 | 7 | ||
7 | Fixes: Coverity issues 1393780 & 1393779. | 8 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482 |
8 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 9 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
9 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 10 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
11 | Message-id: 20210723203344.968563-4-richard.henderson@linaro.org | ||
12 | [PMM: tweaked docs formatting, document -1 special-case, | ||
13 | added fixup patch from RTH mentioning QEMU's maximum veclen.] | ||
10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
11 | --- | 15 | --- |
12 | target/arm/translate-sve.c | 4 ++-- | 16 | docs/system/arm/cpu-features.rst | 15 ++++++++ |
13 | 1 file changed, 2 insertions(+), 2 deletions(-) | 17 | target/arm/cpu.h | 5 +++ |
18 | target/arm/cpu.c | 14 ++++++-- | ||
19 | target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++ | ||
20 | 4 files changed, 92 insertions(+), 2 deletions(-) | ||
14 | 21 | ||
15 | diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c | 22 | diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst |
16 | index XXXXXXX..XXXXXXX 100644 | 23 | index XXXXXXX..XXXXXXX 100644 |
17 | --- a/target/arm/translate-sve.c | 24 | --- a/docs/system/arm/cpu-features.rst |
18 | +++ b/target/arm/translate-sve.c | 25 | +++ b/docs/system/arm/cpu-features.rst |
19 | @@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a, uint32_t insn) | 26 | @@ -XXX,XX +XXX,XX @@ verbose command lines. However, the recommended way to select vector |
20 | static bool trans_PRF(DisasContext *s, arg_PRF *a, uint32_t insn) | 27 | lengths is to explicitly enable each desired length. Therefore only |
28 | example's (1), (4), and (6) exhibit recommended uses of the properties. | ||
29 | |||
30 | +SVE User-mode Default Vector Length Property | ||
31 | +-------------------------------------------- | ||
32 | + | ||
33 | +For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is | ||
34 | +defined to mirror the Linux kernel parameter file | ||
35 | +``/proc/sys/abi/sve_default_vector_length``. The default length, ``N``, | ||
36 | +is in units of bytes and must be between 16 and 8192. | ||
37 | +If not specified, the default vector length is 64. | ||
38 | + | ||
39 | +If the default length is larger than the maximum vector length enabled, | ||
40 | +the actual vector length will be reduced. Note that the maximum vector | ||
41 | +length supported by QEMU is 256. | ||
42 | + | ||
43 | +If this property is set to ``-1`` then the default vector length | ||
44 | +is set to the maximum possible length. | ||
45 | diff --git a/target/arm/cpu.h b/target/arm/cpu.h | ||
46 | index XXXXXXX..XXXXXXX 100644 | ||
47 | --- a/target/arm/cpu.h | ||
48 | +++ b/target/arm/cpu.h | ||
49 | @@ -XXX,XX +XXX,XX @@ struct ARMCPU { | ||
50 | /* Used to set the maximum vector length the cpu will support. */ | ||
51 | uint32_t sve_max_vq; | ||
52 | |||
53 | +#ifdef CONFIG_USER_ONLY | ||
54 | + /* Used to set the default vector length at process start. */ | ||
55 | + uint32_t sve_default_vq; | ||
56 | +#endif | ||
57 | + | ||
58 | /* | ||
59 | * In sve_vq_map each set bit is a supported vector length of | ||
60 | * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector | ||
61 | diff --git a/target/arm/cpu.c b/target/arm/cpu.c | ||
62 | index XXXXXXX..XXXXXXX 100644 | ||
63 | --- a/target/arm/cpu.c | ||
64 | +++ b/target/arm/cpu.c | ||
65 | @@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev) | ||
66 | env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3); | ||
67 | /* with reasonable vector length */ | ||
68 | if (cpu_isar_feature(aa64_sve, cpu)) { | ||
69 | - env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3); | ||
70 | + env->vfp.zcr_el[1] = | ||
71 | + aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1); | ||
72 | } | ||
73 | /* | ||
74 | * Enable TBI0 but not TBI1. | ||
75 | @@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj) | ||
76 | QLIST_INIT(&cpu->pre_el_change_hooks); | ||
77 | QLIST_INIT(&cpu->el_change_hooks); | ||
78 | |||
79 | -#ifndef CONFIG_USER_ONLY | ||
80 | +#ifdef CONFIG_USER_ONLY | ||
81 | +# ifdef TARGET_AARCH64 | ||
82 | + /* | ||
83 | + * The linux kernel defaults to 512-bit vectors, when sve is supported. | ||
84 | + * See documentation for /proc/sys/abi/sve_default_vector_length, and | ||
85 | + * our corresponding sve-default-vector-length cpu property. | ||
86 | + */ | ||
87 | + cpu->sve_default_vq = 4; | ||
88 | +# endif | ||
89 | +#else | ||
90 | /* Our inbound IRQ and FIQ lines */ | ||
91 | if (kvm_enabled()) { | ||
92 | /* VIRQ and VFIQ are unused with KVM but we add them to maintain | ||
93 | diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c | ||
94 | index XXXXXXX..XXXXXXX 100644 | ||
95 | --- a/target/arm/cpu64.c | ||
96 | +++ b/target/arm/cpu64.c | ||
97 | @@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp) | ||
98 | cpu->isar.id_aa64pfr0 = t; | ||
99 | } | ||
100 | |||
101 | +#ifdef CONFIG_USER_ONLY | ||
102 | +/* Mirror linux /proc/sys/abi/sve_default_vector_length. */ | ||
103 | +static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v, | ||
104 | + const char *name, void *opaque, | ||
105 | + Error **errp) | ||
106 | +{ | ||
107 | + ARMCPU *cpu = ARM_CPU(obj); | ||
108 | + int32_t default_len, default_vq, remainder; | ||
109 | + | ||
110 | + if (!visit_type_int32(v, name, &default_len, errp)) { | ||
111 | + return; | ||
112 | + } | ||
113 | + | ||
114 | + /* Undocumented, but the kernel allows -1 to indicate "maximum". */ | ||
115 | + if (default_len == -1) { | ||
116 | + cpu->sve_default_vq = ARM_MAX_VQ; | ||
117 | + return; | ||
118 | + } | ||
119 | + | ||
120 | + default_vq = default_len / 16; | ||
121 | + remainder = default_len % 16; | ||
122 | + | ||
123 | + /* | ||
124 | + * Note that the 512 max comes from include/uapi/asm/sve_context.h | ||
125 | + * and is the maximum architectural width of ZCR_ELx.LEN. | ||
126 | + */ | ||
127 | + if (remainder || default_vq < 1 || default_vq > 512) { | ||
128 | + error_setg(errp, "cannot set sve-default-vector-length"); | ||
129 | + if (remainder) { | ||
130 | + error_append_hint(errp, "Vector length not a multiple of 16\n"); | ||
131 | + } else if (default_vq < 1) { | ||
132 | + error_append_hint(errp, "Vector length smaller than 16\n"); | ||
133 | + } else { | ||
134 | + error_append_hint(errp, "Vector length larger than %d\n", | ||
135 | + 512 * 16); | ||
136 | + } | ||
137 | + return; | ||
138 | + } | ||
139 | + | ||
140 | + cpu->sve_default_vq = default_vq; | ||
141 | +} | ||
142 | + | ||
143 | +static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v, | ||
144 | + const char *name, void *opaque, | ||
145 | + Error **errp) | ||
146 | +{ | ||
147 | + ARMCPU *cpu = ARM_CPU(obj); | ||
148 | + int32_t value = cpu->sve_default_vq * 16; | ||
149 | + | ||
150 | + visit_type_int32(v, name, &value, errp); | ||
151 | +} | ||
152 | +#endif | ||
153 | + | ||
154 | void aarch64_add_sve_properties(Object *obj) | ||
21 | { | 155 | { |
22 | /* Prefetch is a nop within QEMU. */ | 156 | uint32_t vq; |
23 | - sve_access_check(s); | 157 | @@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj) |
24 | + (void)sve_access_check(s); | 158 | object_property_add(obj, name, "bool", cpu_arm_get_sve_vq, |
25 | return true; | 159 | cpu_arm_set_sve_vq, NULL, NULL); |
160 | } | ||
161 | + | ||
162 | +#ifdef CONFIG_USER_ONLY | ||
163 | + /* Mirror linux /proc/sys/abi/sve_default_vector_length. */ | ||
164 | + object_property_add(obj, "sve-default-vector-length", "int32", | ||
165 | + cpu_arm_get_sve_default_vec_len, | ||
166 | + cpu_arm_set_sve_default_vec_len, NULL, NULL); | ||
167 | +#endif | ||
26 | } | 168 | } |
27 | 169 | ||
28 | @@ -XXX,XX +XXX,XX @@ static bool trans_PRF_rr(DisasContext *s, arg_PRF_rr *a, uint32_t insn) | 170 | void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) |
29 | return false; | ||
30 | } | ||
31 | /* Prefetch is a nop within QEMU. */ | ||
32 | - sve_access_check(s); | ||
33 | + (void)sve_access_check(s); | ||
34 | return true; | ||
35 | } | ||
36 | |||
37 | -- | 171 | -- |
38 | 2.17.1 | 172 | 2.20.1 |
39 | 173 | ||
40 | 174 | diff view generated by jsdifflib |
1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> | 1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> |
---|---|---|---|
2 | 2 | ||
3 | DeviceClass::reset models a "cold power-on" reset which can | ||
4 | also be used to powercycle a device; but there is no "hot reset" | ||
5 | (a.k.a. soft-reset) method available. | ||
6 | |||
7 | The OMAP MMC Power-Up Control bit is not designed to powercycle | ||
8 | a card, but to disable it without powering it off (pseudo-reset): | ||
9 | |||
10 | Multimedia Card (MMC/SD/SDIO) Interface [SPRU765A] | ||
11 | |||
12 | MMC_CON[11] Power-Up Control (POW) | ||
13 | This bit must be set to 1 before any valid transaction to either | ||
14 | MMC/SD or SPI memory cards. | ||
15 | When 1, the card is considered powered-up and the controller core | ||
16 | is enabled. | ||
17 | When 0, the card is considered powered-down (system dependent), | ||
18 | and the controller core logic is in pseudo-reset state. This is, | ||
19 | the MMC_STAT flags and the FIFO pointers are reset, any access to | ||
20 | MMC_DATA[DATA] has no effect, a write into the MMC.CMD register | ||
21 | is ignored, and a setting of MMC_SPI[STR] to 1 is ignored. | ||
22 | |||
23 | By splitting the 'pseudo-reset' code out of the 'power-on' reset | ||
24 | function, this patch fixes a latent bug in omap_mmc_write(MMC_CON)i | ||
25 | recently exposed by ecd219f7abb. | ||
26 | |||
27 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | 3 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
28 | Message-id: 20180706162155.8432-2-f4bug@amsat.org | 4 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
29 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 5 | Message-id: 20210726150953.1218690-1-f4bug@amsat.org |
30 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 6 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
31 | --- | 7 | --- |
32 | hw/sd/omap_mmc.c | 14 +++++++++++--- | 8 | hw/arm/nseries.c | 2 +- |
33 | 1 file changed, 11 insertions(+), 3 deletions(-) | 9 | 1 file changed, 1 insertion(+), 1 deletion(-) |
34 | 10 | ||
35 | diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c | 11 | diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c |
36 | index XXXXXXX..XXXXXXX 100644 | 12 | index XXXXXXX..XXXXXXX 100644 |
37 | --- a/hw/sd/omap_mmc.c | 13 | --- a/hw/arm/nseries.c |
38 | +++ b/hw/sd/omap_mmc.c | 14 | +++ b/hw/arm/nseries.c |
39 | @@ -XXX,XX +XXX,XX @@ | 15 | @@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len) |
40 | /* | 16 | default: |
41 | * OMAP on-chip MMC/SD host emulation. | 17 | bad_cmd: |
42 | * | 18 | qemu_log_mask(LOG_GUEST_ERROR, |
43 | + * Datasheet: TI Multimedia Card (MMC/SD/SDIO) Interface (SPRU765A) | 19 | - "%s: unknown command %02x\n", __func__, s->cmd); |
44 | + * | 20 | + "%s: unknown command 0x%02x\n", __func__, s->cmd); |
45 | * Copyright (C) 2006-2007 Andrzej Zaborowski <balrog@zabor.org> | ||
46 | * | ||
47 | * This program is free software; you can redistribute it and/or | ||
48 | @@ -XXX,XX +XXX,XX @@ static void omap_mmc_update(void *opaque) | ||
49 | omap_mmc_interrupts_update(s); | ||
50 | } | ||
51 | |||
52 | +static void omap_mmc_pseudo_reset(struct omap_mmc_s *host) | ||
53 | +{ | ||
54 | + host->status = 0; | ||
55 | + host->fifo_len = 0; | ||
56 | +} | ||
57 | + | ||
58 | void omap_mmc_reset(struct omap_mmc_s *host) | ||
59 | { | ||
60 | host->last_cmd = 0; | ||
61 | @@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host) | ||
62 | host->dw = 0; | ||
63 | host->mode = 0; | ||
64 | host->enable = 0; | ||
65 | - host->status = 0; | ||
66 | host->mask = 0; | ||
67 | host->cto = 0; | ||
68 | host->dto = 0; | ||
69 | - host->fifo_len = 0; | ||
70 | host->blen = 0; | ||
71 | host->blen_counter = 0; | ||
72 | host->nblk = 0; | ||
73 | @@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host) | ||
74 | qemu_set_irq(host->coverswitch, host->cdet_state); | ||
75 | host->clkdiv = 0; | ||
76 | |||
77 | + omap_mmc_pseudo_reset(host); | ||
78 | + | ||
79 | /* Since we're still using the legacy SD API the card is not plugged | ||
80 | * into any bus, and we must reset it manually. When omap_mmc is | ||
81 | * QOMified this must move into the QOM reset function. | ||
82 | @@ -XXX,XX +XXX,XX @@ static void omap_mmc_write(void *opaque, hwaddr offset, | ||
83 | if (s->dw != 0 && s->lines < 4) | ||
84 | printf("4-bit SD bus enabled\n"); | ||
85 | if (!s->enable) | ||
86 | - omap_mmc_reset(s); | ||
87 | + omap_mmc_pseudo_reset(s); | ||
88 | break; | 21 | break; |
89 | 22 | } | |
90 | case 0x10: /* MMC_STAT */ | 23 | |
91 | -- | 24 | -- |
92 | 2.17.1 | 25 | 2.20.1 |
93 | 26 | ||
94 | 27 | diff view generated by jsdifflib |
1 | commit b08199c6fbea1 accidentally added a reference to a doc | 1 | From: Joel Stanley <joel@jms.id.au> |
---|---|---|---|
2 | comment to a nonexistent memory_region_allocate_aux_memory(). | ||
3 | This was a leftover from a previous version of the patchset | ||
4 | which defined memory_region_allocate_aux_memory() for | ||
5 | "allocate RAM MemoryRegion and register it for migration" | ||
6 | and left "memory_region_init_ram()" with its original semantics | ||
7 | of "allocate RAM MR but do not register for migration". In | ||
8 | the end we decided on the approach of "memory_region_init_ram() | ||
9 | registers the MR for migration, and memory_region_init_ram_nomigrate() | ||
10 | is a new function which does not", but this comment change | ||
11 | got left in by mistake. Revert that part of the commit. | ||
12 | 2 | ||
13 | Reported-by: Thomas Huth <huth@tuxfamily.org> | 3 | The macro used to calculate the maximum memory size of the MMIO region |
4 | had a mistake, causing all GPIO models to create a mapping of 0x9D8. | ||
5 | The intent was to have it be 0x9D8 - 0x800. | ||
6 | |||
7 | This extra size doesn't matter on ast2400 and ast2500, which have a 4KB | ||
8 | region set aside for the GPIO controller. | ||
9 | |||
10 | On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the | ||
11 | regions would overlap. Worse was the 1.8V controller would map over the | ||
12 | top of the following peripheral, which happens to be the RTC. | ||
13 | |||
14 | The mmio region used by each device is a maximum of 2KB, so avoid the | ||
15 | calculations and hard code this as the maximum. | ||
16 | |||
17 | Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation") | ||
18 | Signed-off-by: Joel Stanley <joel@jms.id.au> | ||
19 | Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com> | ||
20 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | ||
21 | Message-id: 20210713065854.134634-2-joel@jms.id.au | ||
22 | [PMM: fix autocorrect error in commit message] | ||
14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 23 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
15 | Message-id: 20180702130605.13611-1-peter.maydell@linaro.org | ||
16 | --- | 24 | --- |
17 | include/hw/boards.h | 3 +-- | 25 | hw/gpio/aspeed_gpio.c | 3 +-- |
18 | 1 file changed, 1 insertion(+), 2 deletions(-) | 26 | 1 file changed, 1 insertion(+), 2 deletions(-) |
19 | 27 | ||
20 | diff --git a/include/hw/boards.h b/include/hw/boards.h | 28 | diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c |
21 | index XXXXXXX..XXXXXXX 100644 | 29 | index XXXXXXX..XXXXXXX 100644 |
22 | --- a/include/hw/boards.h | 30 | --- a/hw/gpio/aspeed_gpio.c |
23 | +++ b/include/hw/boards.h | 31 | +++ b/hw/gpio/aspeed_gpio.c |
24 | @@ -XXX,XX +XXX,XX @@ | 32 | @@ -XXX,XX +XXX,XX @@ |
25 | * | 33 | #define GPIO_1_8V_MEM_SIZE 0x9D8 |
26 | * Smaller pieces of memory (display RAM, static RAMs, etc) don't need | 34 | #define GPIO_1_8V_REG_ARRAY_SIZE ((GPIO_1_8V_MEM_SIZE - \ |
27 | * to be backed via the -mem-path memory backend and can simply | 35 | GPIO_1_8V_REG_OFFSET) >> 2) |
28 | - * be created via memory_region_allocate_aux_memory() or | 36 | -#define GPIO_MAX_MEM_SIZE MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE) |
29 | - * memory_region_init_ram(). | 37 | |
30 | + * be created via memory_region_init_ram(). | 38 | static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio) |
31 | */ | 39 | { |
32 | void memory_region_allocate_system_memory(MemoryRegion *mr, Object *owner, | 40 | @@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp) |
33 | const char *name, | 41 | } |
42 | |||
43 | memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s, | ||
44 | - TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE); | ||
45 | + TYPE_ASPEED_GPIO, 0x800); | ||
46 | |||
47 | sysbus_init_mmio(sbd, &s->iomem); | ||
48 | } | ||
34 | -- | 49 | -- |
35 | 2.17.1 | 50 | 2.20.1 |
36 | 51 | ||
37 | 52 | diff view generated by jsdifflib |