[Qemu-devel] [PULL 0/8] target-arm queue
[PULL v2 00/57] target-arm queue
1
target-arm queue: a smallish set of patches for rc1 tomorrow.
1
Squashed in a trivial fix for 32-bit hosts:
2
I've included the tcg patches because RTH has no others that
3
would merit a pullreq.
4
2
5
I haven't included Thomas Huth's 17-patch set to deal with
3
--- a/target/arm/mve_helper.c
6
the introspection crashes, to give that a little more time
4
+++ b/target/arm/mve_helper.c
7
on-list for review.
5
@@ -XXX,XX +XXX,XX @@ DO_LDAV(vmlsldavxsw, 4, int32_t, true, +=, -=)
6
acc = EVENACC(acc, TO128(n[H##ESIZE(e + 1 * XCHG)] * \
7
m[H##ESIZE(e)])); \
8
} \
9
- acc = int128_add(acc, 1 << 7); \
10
+ acc = int128_add(acc, int128_make64(1 << 7)); \
11
} \
12
} \
13
mve_advance_vpt(env); \
8
14
9
thanks
10
-- PMM
15
-- PMM
11
16
12
The following changes since commit 102ad0a80f5110483efd06877c29c4236be267f9:
17
The following changes since commit 53f306f316549d20c76886903181413d20842423:
13
18
14
Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2018-07-16' into staging (2018-07-16 15:34:38 +0100)
19
Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-06-21 11:26:04 +0100)
15
20
16
are available in the Git repository at:
21
are available in the Git repository at:
17
22
18
git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180716
23
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210624
19
24
20
for you to fetch changes up to 3474c98a2a2afcefa7c665f02ad2bed2a43ab0f7:
25
for you to fetch changes up to 90a76c6316cfe6416fc33814a838fb3928f746ee:
21
26
22
accel/tcg: Assert that tlb fill gave us a valid TLB entry (2018-07-16 17:26:01 +0100)
27
docs/system: arm: Add nRF boards description (2021-06-24 14:58:48 +0100)
23
28
24
----------------------------------------------------------------
29
----------------------------------------------------------------
25
target-arm queue:
30
target-arm queue:
26
* accel/tcg: Use correct test when looking in victim TLB for code
31
* Don't require 'virt' board to be compiled in for ACPI GHES code
27
* bcm2835_aux: Swap RX and TX interrupt assignments
32
* docs: Document which architecture extensions we emulate
28
* hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
33
* Fix bugs in M-profile FPCXT_NS accesses
29
* hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
34
* First slice of MVE patches
30
* hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
35
* Implement MTE3
31
* aspeed: Implement write-1-{set, clear} for AST2500 strapping
36
* docs/system: arm: Add nRF boards description
32
* target/arm: Fix LD1W and LDFF1W (scalar plus vector)
33
37
34
----------------------------------------------------------------
38
----------------------------------------------------------------
35
Andrew Jeffery (1):
39
Alexandre Iooss (1):
36
aspeed: Implement write-1-{set, clear} for AST2500 strapping
40
docs/system: arm: Add nRF boards description
37
41
38
Guenter Roeck (1):
42
Peter Collingbourne (1):
39
bcm2835_aux: Swap RX and TX interrupt assignments
43
target/arm: Implement MTE3
40
44
41
Peter Maydell (4):
45
Peter Maydell (55):
42
hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
46
hw/acpi: Provide stub version of acpi_ghes_record_errors()
43
hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
47
hw/acpi: Provide function acpi_ghes_present()
44
accel/tcg: Use correct test when looking in victim TLB for code
48
target/arm: Use acpi_ghes_present() to see if we report ACPI memory errors
45
accel/tcg: Assert that tlb fill gave us a valid TLB entry
49
docs/system/arm: Document which architecture extensions we emulate
50
target/arm/translate-vfp.c: Whitespace fixes
51
target/arm: Handle FPU being disabled in FPCXT_NS accesses
52
target/arm: Don't NOCP fault for FPCXT_NS accesses
53
target/arm: Handle writeback in VLDR/VSTR sysreg with no memory access
54
target/arm: Factor FP context update code out into helper function
55
target/arm: Split vfp_access_check() into A and M versions
56
target/arm: Handle FPU check for FPCXT_NS insns via vfp_access_check_m()
57
target/arm: Implement MVE VLDR/VSTR (non-widening forms)
58
target/arm: Implement widening/narrowing MVE VLDR/VSTR insns
59
target/arm: Implement MVE VCLZ
60
target/arm: Implement MVE VCLS
61
target/arm: Implement MVE VREV16, VREV32, VREV64
62
target/arm: Implement MVE VMVN (register)
63
target/arm: Implement MVE VABS
64
target/arm: Implement MVE VNEG
65
tcg: Make gen_dup_i32/i64() public as tcg_gen_dup_i32/i64
66
target/arm: Implement MVE VDUP
67
target/arm: Implement MVE VAND, VBIC, VORR, VORN, VEOR
68
target/arm: Implement MVE VADD, VSUB, VMUL
69
target/arm: Implement MVE VMULH
70
target/arm: Implement MVE VRMULH
71
target/arm: Implement MVE VMAX, VMIN
72
target/arm: Implement MVE VABD
73
target/arm: Implement MVE VHADD, VHSUB
74
target/arm: Implement MVE VMULL
75
target/arm: Implement MVE VMLALDAV
76
target/arm: Implement MVE VMLSLDAV
77
target/arm: Implement MVE VRMLALDAVH, VRMLSLDAVH
78
target/arm: Implement MVE VADD (scalar)
79
target/arm: Implement MVE VSUB, VMUL (scalar)
80
target/arm: Implement MVE VHADD, VHSUB (scalar)
81
target/arm: Implement MVE VBRSR
82
target/arm: Implement MVE VPST
83
target/arm: Implement MVE VQADD and VQSUB
84
target/arm: Implement MVE VQDMULH and VQRDMULH (scalar)
85
target/arm: Implement MVE VQDMULL scalar
86
target/arm: Implement MVE VQDMULH, VQRDMULH (vector)
87
target/arm: Implement MVE VQADD, VQSUB (vector)
88
target/arm: Implement MVE VQSHL (vector)
89
target/arm: Implement MVE VQRSHL
90
target/arm: Implement MVE VSHL insn
91
target/arm: Implement MVE VRSHL
92
target/arm: Implement MVE VQDMLADH and VQRDMLADH
93
target/arm: Implement MVE VQDMLSDH and VQRDMLSDH
94
target/arm: Implement MVE VQDMULL (vector)
95
target/arm: Implement MVE VRHADD
96
target/arm: Implement MVE VADC, VSBC
97
target/arm: Implement MVE VCADD
98
target/arm: Implement MVE VHCADD
99
target/arm: Implement MVE VADDV
100
target/arm: Make VMOV scalar <-> gpreg beatwise for MVE
46
101
47
Richard Henderson (1):
102
docs/system/arm/emulation.rst | 103 ++++
48
target/arm: Fix LD1W and LDFF1W (scalar plus vector)
103
docs/system/arm/nrf.rst | 51 ++
104
docs/system/target-arm.rst | 7 +
105
include/hw/acpi/ghes.h | 9 +
106
include/tcg/tcg-op.h | 8 +
107
include/tcg/tcg.h | 1 -
108
target/arm/helper-mve.h | 357 +++++++++++++
109
target/arm/helper.h | 2 +
110
target/arm/internals.h | 11 +
111
target/arm/translate-a32.h | 3 +
112
target/arm/translate.h | 10 +
113
target/arm/m-nocp.decode | 24 +
114
target/arm/mve.decode | 240 +++++++++
115
target/arm/vfp.decode | 14 -
116
hw/acpi/ghes-stub.c | 22 +
117
hw/acpi/ghes.c | 17 +
118
target/arm/cpu64.c | 2 +-
119
target/arm/kvm64.c | 6 +-
120
target/arm/mte_helper.c | 82 +--
121
target/arm/mve_helper.c | 1160 +++++++++++++++++++++++++++++++++++++++++
122
target/arm/translate-m-nocp.c | 550 +++++++++++++++++++
123
target/arm/translate-mve.c | 759 +++++++++++++++++++++++++++
124
target/arm/translate-vfp.c | 741 +++++++-------------------
125
tcg/tcg-op-gvec.c | 20 +-
126
MAINTAINERS | 1 +
127
hw/acpi/meson.build | 6 +-
128
target/arm/meson.build | 1 +
129
27 files changed, 3578 insertions(+), 629 deletions(-)
130
create mode 100644 docs/system/arm/emulation.rst
131
create mode 100644 docs/system/arm/nrf.rst
132
create mode 100644 target/arm/helper-mve.h
133
create mode 100644 hw/acpi/ghes-stub.c
134
create mode 100644 target/arm/mve_helper.c
49
135
50
Thomas Huth (1):
51
hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
52
53
include/hw/misc/aspeed_scu.h | 2 ++
54
accel/tcg/cputlb.c | 6 +++---
55
hw/arm/bcm2836.c | 2 ++
56
hw/char/bcm2835_aux.c | 4 ++--
57
hw/intc/arm_gic.c | 22 +++++++++++++++++++---
58
hw/misc/aspeed_scu.c | 19 +++++++++++++++++--
59
target/arm/sve_helper.c | 4 ++--
60
7 files changed, 47 insertions(+), 12 deletions(-)
61
diff view generated by jsdifflib
[Qemu-devel] [PULL 1/8] target/arm: Fix LD1W and LDFF1W (scalar plus vector)
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
'I' was being double-incremented; correctly within the inner loop
4
and incorrectly within the outer loop.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
8
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
9
Tested-by: Alex Bennée <alex.bennee@linaro.org>
10
Message-id: 20180711103957.3040-1-richard.henderson@linaro.org
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
target/arm/sve_helper.c | 4 ++--
14
1 file changed, 2 insertions(+), 2 deletions(-)
15
16
diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/sve_helper.c
19
+++ b/target/arm/sve_helper.c
20
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm, \
21
intptr_t i, oprsz = simd_oprsz(desc); \
22
unsigned scale = simd_data(desc); \
23
uintptr_t ra = GETPC(); \
24
- for (i = 0; i < oprsz; i++) { \
25
+ for (i = 0; i < oprsz; ) { \
26
uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3)); \
27
do { \
28
TYPEM m = 0; \
29
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm, \
30
uintptr_t ra = GETPC(); \
31
bool first = true; \
32
mmap_lock(); \
33
- for (i = 0; i < oprsz; i++) { \
34
+ for (i = 0; i < oprsz; ) { \
35
uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3)); \
36
do { \
37
TYPEM m = 0; \
38
--
39
2.17.1
40
41
diff view generated by jsdifflib
[Qemu-devel] [PULL 2/8] aspeed: Implement write-1-{set, clear} for AST2500 strapping
Deleted patch
1
From: Andrew Jeffery <andrew@aj.id.au>
2
1
3
The AST2500 SoC family changes the runtime behaviour of the hardware
4
strapping register (SCU70) to write-1-set/write-1-clear, with
5
write-1-clear implemented on the "read-only" SoC revision register
6
(SCU7C). For the the AST2400, the hardware strapping is
7
runtime-configured with read-modify-write semantics.
8
9
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
10
Reviewed-by: Joel Stanley <joel@jms.id.au>
11
Message-id: 20180709143524.17480-1-andrew@aj.id.au
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
include/hw/misc/aspeed_scu.h | 2 ++
15
hw/misc/aspeed_scu.c | 19 +++++++++++++++++--
16
2 files changed, 19 insertions(+), 2 deletions(-)
17
18
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
19
index XXXXXXX..XXXXXXX 100644
20
--- a/include/hw/misc/aspeed_scu.h
21
+++ b/include/hw/misc/aspeed_scu.h
22
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
23
#define AST2500_A0_SILICON_REV 0x04000303U
24
#define AST2500_A1_SILICON_REV 0x04010303U
25
26
+#define ASPEED_IS_AST2500(si_rev) ((((si_rev) >> 24) & 0xff) == 0x04)
27
+
28
extern bool is_supported_silicon_rev(uint32_t silicon_rev);
29
30
#define ASPEED_SCU_PROT_KEY 0x1688A8A8
31
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
32
index XXXXXXX..XXXXXXX 100644
33
--- a/hw/misc/aspeed_scu.c
34
+++ b/hw/misc/aspeed_scu.c
35
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
36
s->regs[reg] = data;
37
aspeed_scu_set_apb_freq(s);
38
break;
39
-
40
+ case HW_STRAP1:
41
+ if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
42
+ s->regs[HW_STRAP1] |= data;
43
+ return;
44
+ }
45
+ /* Jump to assignment below */
46
+ break;
47
+ case SILICON_REV:
48
+ if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
49
+ s->regs[HW_STRAP1] &= ~data;
50
+ } else {
51
+ qemu_log_mask(LOG_GUEST_ERROR,
52
+ "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
53
+ __func__, offset);
54
+ }
55
+ /* Avoid assignment below, we've handled everything */
56
+ return;
57
case FREQ_CNTR_EVAL:
58
case VGA_SCRATCH1 ... VGA_SCRATCH8:
59
case RNG_DATA:
60
- case SILICON_REV:
61
case FREE_CNTR4:
62
case FREE_CNTR4_EXT:
63
qemu_log_mask(LOG_GUEST_ERROR,
64
--
65
2.17.1
66
67
diff view generated by jsdifflib
[Qemu-devel] [PULL 3/8] hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
Deleted patch
1
In gic_deactivate_irq() the interrupt number comes from the guest
2
(on a write to the GICC_DIR register), so we need to sanity check
3
that it isn't out of range before we use it as an array index.
4
Handle this in a similar manner to the check we do in
5
gic_complete_irq() for the GICC_EOI register.
6
1
7
The array overrun is not disastrous because the calling code
8
uses (value & 0x3ff) to extract the interrupt field, so the
9
only out-of-range values possible are 1020..1023, which allow
10
overrunning only from irq_state[] into the following
11
irq_target[] array which the guest can already manipulate.
12
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
15
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
16
Message-id: 20180712154152.32183-2-peter.maydell@linaro.org
17
---
18
hw/intc/arm_gic.c | 16 +++++++++++++++-
19
1 file changed, 15 insertions(+), 1 deletion(-)
20
21
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
22
index XXXXXXX..XXXXXXX 100644
23
--- a/hw/intc/arm_gic.c
24
+++ b/hw/intc/arm_gic.c
25
@@ -XXX,XX +XXX,XX @@ static bool gic_eoi_split(GICState *s, int cpu, MemTxAttrs attrs)
26
static void gic_deactivate_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
27
{
28
int cm = 1 << cpu;
29
- int group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
30
+ int group;
31
+
32
+ if (irq >= s->num_irq) {
33
+ /*
34
+ * This handles two cases:
35
+ * 1. If software writes the ID of a spurious interrupt [ie 1023]
36
+ * to the GICC_DIR, the GIC ignores that write.
37
+ * 2. If software writes the number of a non-existent interrupt
38
+ * this must be a subcase of "value written is not an active interrupt"
39
+ * and so this is UNPREDICTABLE. We choose to ignore it.
40
+ */
41
+ return;
42
+ }
43
+
44
+ group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
45
46
if (!gic_eoi_split(s, cpu, attrs)) {
47
/* This is UNPREDICTABLE; we choose to ignore it */
48
--
49
2.17.1
50
51
diff view generated by jsdifflib
[Qemu-devel] [PULL 4/8] hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
Deleted patch
1
The GICD_ITARGETSR implementation still has some 11MPCore behaviour
2
that we were incorrectly using in our GICv1 and GICv2 implementations
3
for the case where the interrupt number is less than GIC_INTERNAL.
4
The desired behaviour here is:
5
* for 11MPCore: RAZ/WI for irqs 0..28; read a number matching the
6
CPU doing the read for irqs 29..31
7
* for GICv1 and v2: RAZ/WI if uniprocessor; otherwise read a
8
number matching the CPU doing the read for all irqs < 32
9
1
10
Stop squashing GICD_ITARGETSR to 0 for IRQs 0..28 unless this
11
is an 11MPCore GIC.
12
13
Reported-by: Jan Kiszka <jan.kiszka@web.de>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
16
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
17
Message-id: 20180712154152.32183-3-peter.maydell@linaro.org
18
---
19
hw/intc/arm_gic.c | 6 ++++--
20
1 file changed, 4 insertions(+), 2 deletions(-)
21
22
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
23
index XXXXXXX..XXXXXXX 100644
24
--- a/hw/intc/arm_gic.c
25
+++ b/hw/intc/arm_gic.c
26
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
27
if (irq >= s->num_irq) {
28
goto bad_reg;
29
}
30
- if (irq >= 29 && irq <= 31) {
31
+ if (irq < 29 && s->revision == REV_11MPCORE) {
32
+ res = 0;
33
+ } else if (irq < GIC_INTERNAL) {
34
res = cm;
35
} else {
36
res = GIC_TARGET(irq);
37
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
38
if (irq >= s->num_irq) {
39
goto bad_reg;
40
}
41
- if (irq < 29) {
42
+ if (irq < 29 && s->revision == REV_11MPCORE) {
43
value = 0;
44
} else if (irq < GIC_INTERNAL) {
45
value = ALL_CPU_MASK;
46
--
47
2.17.1
48
49
diff view generated by jsdifflib
[Qemu-devel] [PULL 5/8] hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
Deleted patch
1
From: Thomas Huth <thuth@redhat.com>
2
1
3
These devices are currently causing some problems when a user is trying
4
to hot-plug or introspect them during runtime. Since these devices can
5
not be instantiated by the user at all (they need to be wired up in code
6
instead), we should mark them with user_creatable = false anyway, then we
7
avoid at least the crashes with the hot-plugging. The introspection problem
8
will be handled by a separate patch.
9
10
Signed-off-by: Thomas Huth <thuth@redhat.com>
11
Message-id: 1531415537-26037-1-git-send-email-thuth@redhat.com
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
Reviewed-by: Markus Armbruster <armbru@redhat.com>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
---
16
hw/arm/bcm2836.c | 2 ++
17
1 file changed, 2 insertions(+)
18
19
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
20
index XXXXXXX..XXXXXXX 100644
21
--- a/hw/arm/bcm2836.c
22
+++ b/hw/arm/bcm2836.c
23
@@ -XXX,XX +XXX,XX @@ static void bcm283x_class_init(ObjectClass *oc, void *data)
24
bc->info = data;
25
dc->realize = bcm2836_realize;
26
dc->props = bcm2836_props;
27
+ /* Reason: Must be wired up in code (see raspi_init() function) */
28
+ dc->user_creatable = false;
29
}
30
31
static const TypeInfo bcm283x_type_info = {
32
--
33
2.17.1
34
35
diff view generated by jsdifflib
[Qemu-devel] [PULL 6/8] bcm2835_aux: Swap RX and TX interrupt assignments
Deleted patch
1
From: Guenter Roeck <linux@roeck-us.net>
2
1
3
RX and TX interrupt bits were reversed, resulting in an endless sequence
4
of serial interupts in the emulated system and the following repeated
5
error message when booting Linux.
6
7
serial8250: too much work for irq61
8
9
This results in a boot failure most of the time.
10
11
Qemu command line used to reproduce the problem:
12
13
    qemu-system-aarch64 -M raspi3 -m 1024 \
14
    -kernel arch/arm64/boot/Image \
15
    --append "rdinit=/sbin/init console=ttyS1,115200"
16
    -initrd rootfs.cpio \
17
    -dtb arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dtb \
18
    -nographic -monitor null -serial null -serial stdio
19
20
This is with arm64:defconfig. The root file system was generated using
21
buildroot.
22
23
NB that this error likely arises from an erratum in the
24
BCM2835 datasheet where the TX and RX bits were swapped
25
in the AU_MU_IER_REG description (but correct for IIR):
26
https://elinux.org/BCM2835_datasheet_errata#p12
27
28
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
29
Message-id: 1529355846-25102-1-git-send-email-linux@roeck-us.net
30
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
31
[PMM: added NB about datasheet]
32
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
33
---
34
hw/char/bcm2835_aux.c | 4 ++--
35
1 file changed, 2 insertions(+), 2 deletions(-)
36
37
diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
38
index XXXXXXX..XXXXXXX 100644
39
--- a/hw/char/bcm2835_aux.c
40
+++ b/hw/char/bcm2835_aux.c
41
@@ -XXX,XX +XXX,XX @@
42
#define AUX_MU_BAUD_REG 0x68
43
44
/* bits in IER/IIR registers */
45
-#define TX_INT 0x1
46
-#define RX_INT 0x2
47
+#define RX_INT 0x1
48
+#define TX_INT 0x2
49
50
static void bcm2835_aux_update(BCM2835AuxState *s)
51
{
52
--
53
2.17.1
54
55
diff view generated by jsdifflib
[Qemu-devel] [PULL 7/8] accel/tcg: Use correct test when looking in victim TLB for code
Deleted patch
1
In get_page_addr_code(), we were incorrectly looking in the victim
2
TLB for an entry which matched the target address for reads, not
3
for code accesses. This meant that we could hit on a victim TLB
4
entry that indicated that the address was readable but not
5
executable, and incorrectly bypass the call to tlb_fill() which
6
should generate the guest MMU exception. Fix this bug.
7
1
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20180713141636.18665-2-peter.maydell@linaro.org
11
---
12
accel/tcg/cputlb.c | 2 +-
13
1 file changed, 1 insertion(+), 1 deletion(-)
14
15
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/accel/tcg/cputlb.c
18
+++ b/accel/tcg/cputlb.c
19
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
20
index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
21
mmu_idx = cpu_mmu_index(env, true);
22
if (unlikely(!tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr))) {
23
- if (!VICTIM_TLB_HIT(addr_read, addr)) {
24
+ if (!VICTIM_TLB_HIT(addr_code, addr)) {
25
tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
26
}
27
}
28
--
29
2.17.1
30
31
diff view generated by jsdifflib
[Qemu-devel] [PULL 8/8] accel/tcg: Assert that tlb fill gave us a valid TLB entry
Deleted patch
1
In commit 4b1a3e1e34ad97 we added a check for whether the TLB entry
2
we had following a tlb_fill had the INVALID bit set. This could
3
happen in some circumstances because a stale or wrong TLB entry was
4
pulled out of the victim cache. However, after commit
5
68fea038553039e (which prevents stale entries being in the victim
6
cache) and the previous commit (which ensures we don't incorrectly
7
hit in the victim cache)) this should never be possible.
8
1
9
Drop the check on TLB_INVALID_MASK from the "is this a TLB_RECHECK?"
10
condition, and instead assert that the tlb fill procedure has given
11
us a valid TLB entry (or longjumped out with a guest exception).
12
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
15
Message-id: 20180713141636.18665-3-peter.maydell@linaro.org
16
---
17
accel/tcg/cputlb.c | 4 ++--
18
1 file changed, 2 insertions(+), 2 deletions(-)
19
20
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
21
index XXXXXXX..XXXXXXX 100644
22
--- a/accel/tcg/cputlb.c
23
+++ b/accel/tcg/cputlb.c
24
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
25
if (!VICTIM_TLB_HIT(addr_code, addr)) {
26
tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
27
}
28
+ assert(tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr));
29
}
30
31
- if (unlikely((env->tlb_table[mmu_idx][index].addr_code &
32
- (TLB_RECHECK | TLB_INVALID_MASK)) == TLB_RECHECK)) {
33
+ if (unlikely(env->tlb_table[mmu_idx][index].addr_code & TLB_RECHECK)) {
34
/*
35
* This is a TLB_RECHECK access, where the MMU protection
36
* covers a smaller range than a target page, and we must
37
--
38
2.17.1
39
40
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.