[Qemu-devel] [PULL 0/6] target-arm queue
[PULL 00/12] target-arm queue
1
A set of small bugfixes for arm for 3.0; the "migration was
1
One last arm pullreq before I stop work for the end of the year...
2
broken" fixes for SMMUv3 and v7M NVIC with security extensions
3
are the most significant.
4
2
5
thanks
6
-- PMM
3
-- PMM
7
4
8
The following changes since commit 6d9dd5fb9d0e9f4a174f53a0e20a39fbe809c71e:
5
The following changes since commit 8e5943260a8f765216674ee87ce8588cc4e7463e:
9
6
10
Merge remote-tracking branch 'remotes/armbru/tags/pull-qobject-2018-07-27-v2' into staging (2018-07-30 09:55:47 +0100)
7
Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-12-20 12:46:10 +0000)
11
8
12
are available in the Git repository at:
9
are available in the Git repository at:
13
10
14
git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180730
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191220
15
12
16
for you to fetch changes up to 0261fb805c00a6f97d143235e7b06b0906bdf898:
13
for you to fetch changes up to c8fa6079eb35888587f1be27c1590da4edcc5098:
17
14
18
target/arm: Remove duplicate 'host' entry in '-cpu ?' output (2018-07-30 15:07:08 +0100)
15
arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on() (2019-12-20 14:03:00 +0000)
19
16
20
----------------------------------------------------------------
17
----------------------------------------------------------------
21
target-arm queue:
18
target-arm queue:
22
* arm/smmuv3: Fix broken VM state migration
19
* Support emulating the generic timers at frequencies other than 62.5MHz
23
* armv7m_nvic: Fix broken VM state migration
20
* Various fixes for SMMUv3 emulation bugs
24
* hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()
21
* Improve assert error message for hflags mismatches
25
* hw/arm/iotkit: Fix IRQ number for timer1
22
* arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
26
* hw/misc/tz-mpc: Zero the LUT on initialization, not just reset
27
* target/arm: Remove duplicate 'host' entry in '-cpu ?' output
28
23
29
----------------------------------------------------------------
24
----------------------------------------------------------------
30
Dr. David Alan Gilbert (1):
25
Andrew Jeffery (4):
31
arm/smmuv3: Fix missing VMSD terminator
26
target/arm: Remove redundant scaling of nexttick
27
target/arm: Abstract the generic timer frequency
28
target/arm: Prepare generic timer for per-platform CNTFRQ
29
ast2600: Configure CNTFRQ at 1125MHz
32
30
33
Geert Uytterhoeven (1):
31
Niek Linnenbank (1):
34
hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()
32
arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
35
36
Peter Maydell (3):
37
armv7m_nvic: Fix m-security subsection name
38
hw/arm/iotkit: Fix IRQ number for timer1
39
hw/misc/tz-mpc: Zero the LUT on initialization, not just reset
40
33
41
Philippe Mathieu-Daudé (1):
34
Philippe Mathieu-Daudé (1):
42
target/arm: Remove duplicate 'host' entry in '-cpu ?' output
35
target/arm: Display helpful message when hflags mismatch
43
36
44
hw/arm/iotkit.c | 2 +-
37
Simon Veith (6):
45
hw/arm/smmuv3.c | 1 +
38
hw/arm/smmuv3: Apply address mask to linear strtab base address
46
hw/arm/sysbus-fdt.c | 1 +
39
hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
47
hw/intc/armv7m_nvic.c | 2 +-
40
hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
48
hw/misc/tz-mpc.c | 2 +-
41
hw/arm/smmuv3: Align stream table base address to table size
49
target/arm/helper.c | 6 ------
42
hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro
50
6 files changed, 5 insertions(+), 9 deletions(-)
43
hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position
51
44
45
hw/arm/smmuv3-internal.h | 6 ++---
46
target/arm/cpu.h | 5 ++++
47
hw/arm/aspeed_ast2600.c | 3 +++
48
hw/arm/smmuv3.c | 28 +++++++++++++++-----
49
target/arm/arm-powerctl.c | 3 +++
50
target/arm/cpu.c | 65 +++++++++++++++++++++++++++++++++++++++++------
51
target/arm/helper.c | 42 +++++++++++++++++++++++-------
52
7 files changed, 125 insertions(+), 27 deletions(-)
53
diff view generated by jsdifflib
New patch
[PULL 01/12] target/arm: Remove redundant scaling of nexttick
1
From: Andrew Jeffery <andrew@aj.id.au>
1
2
3
The corner-case codepath was adjusting nexttick such that overflow
4
wouldn't occur when timer_mod() scaled the value back up. Remove a use
5
of GTIMER_SCALE and avoid unnecessary operations by calling
6
timer_mod_ns() directly.
7
8
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Reviewed-by: Cédric Le Goater <clg@kaod.org>
11
Message-id: f8c680720e3abe55476e6d9cb604ad27fdbeb2e0.1576215453.git-series.andrew@aj.id.au
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 5 +++--
15
1 file changed, 3 insertions(+), 2 deletions(-)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
22
* timer expires we will reset the timer for any remaining period.
23
*/
24
if (nexttick > INT64_MAX / GTIMER_SCALE) {
25
- nexttick = INT64_MAX / GTIMER_SCALE;
26
+ timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
27
+ } else {
28
+ timer_mod(cpu->gt_timer[timeridx], nexttick);
29
}
30
- timer_mod(cpu->gt_timer[timeridx], nexttick);
31
trace_arm_gt_recalc(timeridx, irqstate, nexttick);
32
} else {
33
/* Timer disabled: ISTATUS and timer output always clear */
34
--
35
2.20.1
36
37
diff view generated by jsdifflib
New patch
[PULL 02/12] target/arm: Abstract the generic timer frequency
1
From: Andrew Jeffery <andrew@aj.id.au>
1
2
3
Prepare for SoCs such as the ASPEED AST2600 whose firmware configures
4
CNTFRQ to values significantly larger than the static 62.5MHz value
5
currently derived from GTIMER_SCALE. As the OS potentially derives its
6
timer periods from the CNTFRQ value the lack of support for running
7
QEMUTimers at the appropriate rate leads to sticky behaviour in the
8
guest.
9
10
Substitute the GTIMER_SCALE constant with use of a helper to derive the
11
period from gt_cntfrq_hz stored in struct ARMCPU. Initially set
12
gt_cntfrq_hz to the frequency associated with GTIMER_SCALE so current
13
behaviour is maintained.
14
15
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
16
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
17
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
18
Message-id: 40bd8df043f66e1ccfb3e9482999d099ac72bb2e.1576215453.git-series.andrew@aj.id.au
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
---
21
target/arm/cpu.h | 5 +++++
22
target/arm/cpu.c | 8 ++++++++
23
target/arm/helper.c | 10 +++++++---
24
3 files changed, 20 insertions(+), 3 deletions(-)
25
26
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
27
index XXXXXXX..XXXXXXX 100644
28
--- a/target/arm/cpu.h
29
+++ b/target/arm/cpu.h
30
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
31
*/
32
DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
33
DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
34
+
35
+ /* Generic timer counter frequency, in Hz */
36
+ uint64_t gt_cntfrq_hz;
37
};
38
39
+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);
40
+
41
void arm_cpu_post_init(Object *obj);
42
43
uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz);
44
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
45
index XXXXXXX..XXXXXXX 100644
46
--- a/target/arm/cpu.c
47
+++ b/target/arm/cpu.c
48
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
49
if (tcg_enabled()) {
50
cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
51
}
52
+
53
+ cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
54
}
55
56
static Property arm_cpu_reset_cbar_property =
57
@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
58
visit_type_uint32(v, name, &cpu->init_svtor, errp);
59
}
60
61
+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
62
+{
63
+ return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
64
+ NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
65
+}
66
+
67
void arm_cpu_post_init(Object *obj)
68
{
69
ARMCPU *cpu = ARM_CPU(obj);
70
diff --git a/target/arm/helper.c b/target/arm/helper.c
71
index XXXXXXX..XXXXXXX 100644
72
--- a/target/arm/helper.c
73
+++ b/target/arm/helper.c
74
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_stimer_access(CPUARMState *env,
75
76
static uint64_t gt_get_countervalue(CPUARMState *env)
77
{
78
- return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
79
+ ARMCPU *cpu = env_archcpu(env);
80
+
81
+ return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
82
}
83
84
static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
85
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
86
* set the timer for as far in the future as possible. When the
87
* timer expires we will reset the timer for any remaining period.
88
*/
89
- if (nexttick > INT64_MAX / GTIMER_SCALE) {
90
+ if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
91
timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
92
} else {
93
timer_mod(cpu->gt_timer[timeridx], nexttick);
94
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
95
96
static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
97
{
98
+ ARMCPU *cpu = env_archcpu(env);
99
+
100
/* Currently we have no support for QEMUTimer in linux-user so we
101
* can't call gt_get_countervalue(env), instead we directly
102
* call the lower level functions.
103
*/
104
- return cpu_get_clock() / GTIMER_SCALE;
105
+ return cpu_get_clock() / gt_cntfrq_period_ns(cpu);
106
}
107
108
static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
109
--
110
2.20.1
111
112
diff view generated by jsdifflib
New patch
[PULL 03/12] target/arm: Prepare generic timer for per-platform CNTFRQ
1
From: Andrew Jeffery <andrew@aj.id.au>
1
2
3
The ASPEED AST2600 clocks the generic timer at the rate of HPLL. On
4
recent firmwares this is at 1125MHz, which is considerably quicker than
5
the assumed 62.5MHz of the current generic timer implementation. The
6
delta between the value as read from CNTFRQ and the true rate of the
7
underlying QEMUTimer leads to sticky behaviour in AST2600 guests.
8
9
Add a feature-gated property exposing CNTFRQ for ARM CPUs providing the
10
generic timer. This allows platforms to configure CNTFRQ (and the
11
associated QEMUTimer) to the appropriate frequency prior to starting the
12
guest.
13
14
As the platform can now determine the rate of CNTFRQ we're exposed to
15
limitations of QEMUTimer that didn't previously materialise: In the
16
course of emulation we need to arbitrarily and accurately convert
17
between guest ticks and time, but we're constrained by QEMUTimer's use
18
of an integer scaling factor. The effect is QEMUTimer cannot exactly
19
capture the period of frequencies that do not cleanly divide
20
NANOSECONDS_PER_SECOND for scaling ticks to time. As such, provide an
21
equally inaccurate scaling factor for scaling time to ticks so at least
22
a self-consistent inverse relationship holds.
23
24
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
25
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
26
Message-id: a22db9325f96e39f76e3c2baddcb712149f46bf2.1576215453.git-series.andrew@aj.id.au
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
---
29
target/arm/cpu.c | 61 +++++++++++++++++++++++++++++++++++++--------
30
target/arm/helper.c | 9 ++++++-
31
2 files changed, 59 insertions(+), 11 deletions(-)
32
33
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/cpu.c
36
+++ b/target/arm/cpu.c
37
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
38
if (tcg_enabled()) {
39
cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
40
}
41
-
42
- cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
43
}
44
45
+static Property arm_cpu_gt_cntfrq_property =
46
+ DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,
47
+ NANOSECONDS_PER_SECOND / GTIMER_SCALE);
48
+
49
static Property arm_cpu_reset_cbar_property =
50
DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
51
52
@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
53
54
unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
55
{
56
+ /*
57
+ * The exact approach to calculating guest ticks is:
58
+ *
59
+ * muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), cpu->gt_cntfrq_hz,
60
+ * NANOSECONDS_PER_SECOND);
61
+ *
62
+ * We don't do that. Rather we intentionally use integer division
63
+ * truncation below and in the caller for the conversion of host monotonic
64
+ * time to guest ticks to provide the exact inverse for the semantics of
65
+ * the QEMUTimer scale factor. QEMUTimer's scale facter is an integer, so
66
+ * it loses precision when representing frequencies where
67
+ * `(NANOSECONDS_PER_SECOND % cpu->gt_cntfrq) > 0` holds. Failing to
68
+ * provide an exact inverse leads to scheduling timers with negative
69
+ * periods, which in turn leads to sticky behaviour in the guest.
70
+ *
71
+ * Finally, CNTFRQ is effectively capped at 1GHz to ensure our scale factor
72
+ * cannot become zero.
73
+ */
74
return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
75
NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
76
}
77
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
78
79
qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
80
&error_abort);
81
+
82
+ if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
83
+ qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property,
84
+ &error_abort);
85
+ }
86
}
87
88
static void arm_cpu_finalizefn(Object *obj)
89
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
90
}
91
}
92
93
- cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
94
- arm_gt_ptimer_cb, cpu);
95
- cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
96
- arm_gt_vtimer_cb, cpu);
97
- cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
98
- arm_gt_htimer_cb, cpu);
99
- cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
100
- arm_gt_stimer_cb, cpu);
101
+
102
+ {
103
+ uint64_t scale;
104
+
105
+ if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
106
+ if (!cpu->gt_cntfrq_hz) {
107
+ error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",
108
+ cpu->gt_cntfrq_hz);
109
+ return;
110
+ }
111
+ scale = gt_cntfrq_period_ns(cpu);
112
+ } else {
113
+ scale = GTIMER_SCALE;
114
+ }
115
+
116
+ cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
117
+ arm_gt_ptimer_cb, cpu);
118
+ cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
119
+ arm_gt_vtimer_cb, cpu);
120
+ cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
121
+ arm_gt_htimer_cb, cpu);
122
+ cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
123
+ arm_gt_stimer_cb, cpu);
124
+ }
125
#endif
126
127
cpu_exec_realizefn(cs, &local_err);
128
diff --git a/target/arm/helper.c b/target/arm/helper.c
129
index XXXXXXX..XXXXXXX 100644
130
--- a/target/arm/helper.c
131
+++ b/target/arm/helper.c
132
@@ -XXX,XX +XXX,XX @@ void arm_gt_stimer_cb(void *opaque)
133
gt_recalc_timer(cpu, GTIMER_SEC);
134
}
135
136
+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
137
+{
138
+ ARMCPU *cpu = env_archcpu(env);
139
+
140
+ cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
141
+}
142
+
143
static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
144
/* Note that CNTFRQ is purely reads-as-written for the benefit
145
* of software; writing it doesn't actually change the timer frequency.
146
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
147
.opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
148
.access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
149
.fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
150
- .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
151
+ .resetfn = arm_gt_cntfrq_reset,
152
},
153
/* overall control: mostly access permissions */
154
{ .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
155
--
156
2.20.1
157
158
diff view generated by jsdifflib
New patch
[PULL 04/12] ast2600: Configure CNTFRQ at 1125MHz
1
From: Andrew Jeffery <andrew@aj.id.au>
1
2
3
This matches the configuration set by u-boot on the AST2600.
4
5
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
6
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Cédric Le Goater <clg@kaod.org>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
9
Message-id: 080ca1267a09381c43cf3c50d434fb6c186f2b6e.1576215453.git-series.andrew@aj.id.au
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
hw/arm/aspeed_ast2600.c | 3 +++
13
1 file changed, 3 insertions(+)
14
15
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/arm/aspeed_ast2600.c
18
+++ b/hw/arm/aspeed_ast2600.c
19
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
20
object_property_set_int(OBJECT(&s->cpu[i]), aspeed_calc_affinity(i),
21
"mp-affinity", &error_abort);
22
23
+ object_property_set_int(OBJECT(&s->cpu[i]), 1125000000, "cntfrq",
24
+ &error_abort);
25
+
26
/*
27
* TODO: the secondary CPUs are started and a boot helper
28
* is needed when using -kernel
29
--
30
2.20.1
31
32
diff view generated by jsdifflib
[Qemu-devel] [PULL 5/6] hw/misc/tz-mpc: Zero the LUT on initialization, not just reset
[PULL 05/12] hw/arm/smmuv3: Apply address mask to linear strtab base address
1
In the tz-mpc device we allocate a data block for the LUT,
1
From: Simon Veith <sveith@amazon.de>
2
which we then clear to zero in the device's reset method.
3
This is conceptually fine, but unfortunately results in a
4
valgrind complaint about use of uninitialized data on startup:
5
2
6
==30906== Conditional jump or move depends on uninitialised value(s)
3
In the SMMU_STRTAB_BASE register, the stream table base address only
7
==30906== at 0x503609: tz_mpc_translate (tz-mpc.c:439)
4
occupies bits [51:6]. Other bits, such as RA (bit [62]), must be masked
8
==30906== by 0x3F3D90: address_space_translate_iommu (exec.c:511)
5
out to obtain the base address.
9
==30906== by 0x3F3FF8: flatview_do_translate (exec.c:584)
10
==30906== by 0x3F4292: flatview_translate (exec.c:644)
11
==30906== by 0x3F2120: address_space_translate (memory.h:1962)
12
==30906== by 0x3FB753: address_space_ldl_internal (memory_ldst.inc.c:36)
13
==30906== by 0x3FB8A6: address_space_ldl (memory_ldst.inc.c:80)
14
==30906== by 0x619037: ldl_phys (memory_ldst_phys.inc.h:25)
15
==30906== by 0x61985D: arm_cpu_reset (cpu.c:255)
16
==30906== by 0x98791B: cpu_reset (cpu.c:249)
17
==30906== by 0x57FFDB: armv7m_reset (armv7m.c:265)
18
==30906== by 0x7B1775: qemu_devices_reset (reset.c:69)
19
6
20
This is because of a reset ordering problem -- the TZ MPC
7
The branch for 2-level stream tables correctly applies this mask by way
21
resets after the CPU, but an M-profile CPU's reset function
8
of SMMU_BASE_ADDR_MASK, but the one for linear stream tables does not.
22
includes memory loads to get the initial PC and SP, which
23
then go through an MPC that hasn't yet been reset.
24
9
25
The simplest fix for this is to zero the LUT when we
10
Apply the missing mask in that case as well so that the correct stream
26
initialize the data, which will result in the MPC's
11
base address is used by guests which configure a linear stream table.
27
translate function giving the right answers for these
28
early memory accesses.
29
12
30
Reported-by: Thomas Huth <thuth@redhat.com>
13
Linux guests are unaffected by this change because they choose a 2-level
14
stream table layout for the QEMU SMMUv3, based on the size of its stream
15
ID space.
16
17
ref. ARM IHI 0070C, section 6.3.23.
18
19
Signed-off-by: Simon Veith <sveith@amazon.de>
20
Acked-by: Eric Auger <eric.auger@redhat.com>
21
Tested-by: Eric Auger <eric.auger@redhat.com>
22
Message-id: 1576509312-13083-2-git-send-email-sveith@amazon.de
23
Cc: Eric Auger <eric.auger@redhat.com>
24
Cc: qemu-devel@nongnu.org
25
Cc: qemu-arm@nongnu.org
26
Acked-by: Eric Auger <eric.auger@redhat.com>
27
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
31
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
32
Tested-by: Thomas Huth <thuth@redhat.com>
33
Message-id: 20180724153616.32352-1-peter.maydell@linaro.org
34
---
29
---
35
hw/misc/tz-mpc.c | 2 +-
30
hw/arm/smmuv3.c | 2 +-
36
1 file changed, 1 insertion(+), 1 deletion(-)
31
1 file changed, 1 insertion(+), 1 deletion(-)
37
32
38
diff --git a/hw/misc/tz-mpc.c b/hw/misc/tz-mpc.c
33
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
39
index XXXXXXX..XXXXXXX 100644
34
index XXXXXXX..XXXXXXX 100644
40
--- a/hw/misc/tz-mpc.c
35
--- a/hw/arm/smmuv3.c
41
+++ b/hw/misc/tz-mpc.c
36
+++ b/hw/arm/smmuv3.c
42
@@ -XXX,XX +XXX,XX @@ static void tz_mpc_realize(DeviceState *dev, Error **errp)
37
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
43
address_space_init(&s->blocked_io_as, &s->blocked_io,
38
}
44
"tz-mpc-blocked-io");
39
addr = l2ptr + l2_ste_offset * sizeof(*ste);
45
40
} else {
46
- s->blk_lut = g_new(uint32_t, s->blk_max);
41
- addr = s->strtab_base + sid * sizeof(*ste);
47
+ s->blk_lut = g_new0(uint32_t, s->blk_max);
42
+ addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
48
}
43
}
49
44
50
static int tz_mpc_post_load(void *opaque, int version_id)
45
if (smmu_get_ste(s, addr, ste, event)) {
51
--
46
--
52
2.17.1
47
2.20.1
53
48
54
49
diff view generated by jsdifflib
[Qemu-devel] [PULL 4/6] hw/arm/iotkit: Fix IRQ number for timer1
[PULL 06/12] hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
1
A cut-and-paste error meant we were incorrectly wiring up the timer1
1
From: Simon Veith <sveith@amazon.de>
2
IRQ to IRQ3. IRQ3 is the interrupt for timer0 -- move timer0 to
3
IRQ4 where it belongs.
4
2
3
There are two issues with the current value of SMMU_BASE_ADDR_MASK:
4
5
- At the lower end, we are clearing bits [4:0]. Per the SMMUv3 spec,
6
we should also be treating bit 5 as zero in the base address.
7
- At the upper end, we are clearing bits [63:48]. Per the SMMUv3 spec,
8
only bits [63:52] must be explicitly treated as zero.
9
10
Update the SMMU_BASE_ADDR_MASK value to mask out bits [63:52] and [5:0].
11
12
ref. ARM IHI 0070C, section 6.3.23.
13
14
Signed-off-by: Simon Veith <sveith@amazon.de>
15
Acked-by: Eric Auger <eric.auger@redhat.com>
16
Tested-by: Eric Auger <eric.auger@redhat.com>
17
Message-id: 1576509312-13083-3-git-send-email-sveith@amazon.de
18
Cc: Eric Auger <eric.auger@redhat.com>
19
Cc: qemu-devel@nongnu.org
20
Cc: qemu-arm@nongnu.org
21
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
7
Message-id: 20180727113854.20283-3-peter.maydell@linaro.org
8
---
23
---
9
hw/arm/iotkit.c | 2 +-
24
hw/arm/smmuv3-internal.h | 2 +-
10
1 file changed, 1 insertion(+), 1 deletion(-)
25
1 file changed, 1 insertion(+), 1 deletion(-)
11
26
12
diff --git a/hw/arm/iotkit.c b/hw/arm/iotkit.c
27
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
13
index XXXXXXX..XXXXXXX 100644
28
index XXXXXXX..XXXXXXX 100644
14
--- a/hw/arm/iotkit.c
29
--- a/hw/arm/smmuv3-internal.h
15
+++ b/hw/arm/iotkit.c
30
+++ b/hw/arm/smmuv3-internal.h
16
@@ -XXX,XX +XXX,XX @@ static void iotkit_realize(DeviceState *dev, Error **errp)
31
@@ -XXX,XX +XXX,XX @@ REG32(GERROR_IRQ_CFG2, 0x74)
17
return;
32
18
}
33
#define A_STRTAB_BASE 0x80 /* 64b */
19
sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0,
34
20
- qdev_get_gpio_in(DEVICE(&s->armv7m), 3));
35
-#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
21
+ qdev_get_gpio_in(DEVICE(&s->armv7m), 4));
36
+#define SMMU_BASE_ADDR_MASK 0xfffffffffffc0
22
mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0);
37
23
object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr), "port[1]", &err);
38
REG32(STRTAB_BASE_CFG, 0x88)
24
if (err) {
39
FIELD(STRTAB_BASE_CFG, FMT, 16, 2)
25
--
40
--
26
2.17.1
41
2.20.1
27
42
28
43
diff view generated by jsdifflib
New patch
[PULL 07/12] hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
1
From: Simon Veith <sveith@amazon.de>
1
2
3
When checking whether a stream ID is in range of the stream table, we
4
have so far been only checking it against our implementation limit
5
(SMMU_IDR1_SIDSIZE). However, the guest can program the
6
STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this
7
limit.
8
9
Check the stream ID against this limit as well to match the hardware
10
behavior of raising C_BAD_STREAMID events in case the limit is exceeded.
11
Also, ensure that we do not go one entry beyond the end of the table by
12
checking that its index is strictly smaller than the table size.
13
14
ref. ARM IHI 0070C, section 6.3.24.
15
16
Signed-off-by: Simon Veith <sveith@amazon.de>
17
Acked-by: Eric Auger <eric.auger@redhat.com>
18
Tested-by: Eric Auger <eric.auger@redhat.com>
19
Message-id: 1576509312-13083-4-git-send-email-sveith@amazon.de
20
Cc: Eric Auger <eric.auger@redhat.com>
21
Cc: qemu-devel@nongnu.org
22
Cc: qemu-arm@nongnu.org
23
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
24
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
25
---
26
hw/arm/smmuv3.c | 8 ++++++--
27
1 file changed, 6 insertions(+), 2 deletions(-)
28
29
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
30
index XXXXXXX..XXXXXXX 100644
31
--- a/hw/arm/smmuv3.c
32
+++ b/hw/arm/smmuv3.c
33
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
34
SMMUEventInfo *event)
35
{
36
dma_addr_t addr;
37
+ uint32_t log2size;
38
int ret;
39
40
trace_smmuv3_find_ste(sid, s->features, s->sid_split);
41
- /* Check SID range */
42
- if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
43
+ log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
44
+ /*
45
+ * Check SID range against both guest-configured and implementation limits
46
+ */
47
+ if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
48
event->type = SMMU_EVT_C_BAD_STREAMID;
49
return -EINVAL;
50
}
51
--
52
2.20.1
53
54
diff view generated by jsdifflib
[Qemu-devel] [PULL 1/6] arm/smmuv3: Fix missing VMSD terminator
[PULL 08/12] hw/arm/smmuv3: Align stream table base address to table size
1
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
1
From: Simon Veith <sveith@amazon.de>
2
2
3
The 'vmstate_smmuv3_queue' is missing the end-of-list marker.
3
Per the specification, and as observed in hardware, the SMMUv3 aligns
4
the SMMU_STRTAB_BASE address to the size of the table by masking out the
5
respective least significant bits in the ADDR field.
4
6
5
Fixes: 10a83cb9887
7
Apply this masking logic to our smmu_find_ste() lookup function per the
6
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
8
specification.
7
Message-id: 20180727135406.15132-1-dgilbert@redhat.com
9
10
ref. ARM IHI 0070C, section 6.3.23.
11
12
Signed-off-by: Simon Veith <sveith@amazon.de>
13
Acked-by: Eric Auger <eric.auger@redhat.com>
14
Tested-by: Eric Auger <eric.auger@redhat.com>
15
Message-id: 1576509312-13083-5-git-send-email-sveith@amazon.de
16
Cc: Eric Auger <eric.auger@redhat.com>
17
Cc: qemu-devel@nongnu.org
18
Cc: qemu-arm@nongnu.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
19
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
[PMM: dropped stray blank line]
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
21
---
12
hw/arm/smmuv3.c | 1 +
22
hw/arm/smmuv3.c | 18 ++++++++++++++----
13
1 file changed, 1 insertion(+)
23
1 file changed, 14 insertions(+), 4 deletions(-)
14
24
15
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
25
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
16
index XXXXXXX..XXXXXXX 100644
26
index XXXXXXX..XXXXXXX 100644
17
--- a/hw/arm/smmuv3.c
27
--- a/hw/arm/smmuv3.c
18
+++ b/hw/arm/smmuv3.c
28
+++ b/hw/arm/smmuv3.c
19
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3_queue = {
29
@@ -XXX,XX +XXX,XX @@ bad_ste:
20
VMSTATE_UINT32(prod, SMMUQueue),
30
static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
21
VMSTATE_UINT32(cons, SMMUQueue),
31
SMMUEventInfo *event)
22
VMSTATE_UINT8(log2size, SMMUQueue),
32
{
23
+ VMSTATE_END_OF_LIST(),
33
- dma_addr_t addr;
24
},
34
+ dma_addr_t addr, strtab_base;
25
};
35
uint32_t log2size;
26
36
+ int strtab_size_shift;
37
int ret;
38
39
trace_smmuv3_find_ste(sid, s->features, s->sid_split);
40
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
41
}
42
if (s->features & SMMU_FEATURE_2LVL_STE) {
43
int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
44
- dma_addr_t strtab_base, l1ptr, l2ptr;
45
+ dma_addr_t l1ptr, l2ptr;
46
STEDesc l1std;
47
48
- strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
49
+ /*
50
+ * Align strtab base address to table size. For this purpose, assume it
51
+ * is not bounded by SMMU_IDR1_SIDSIZE.
52
+ */
53
+ strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
54
+ strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
55
+ ~MAKE_64BIT_MASK(0, strtab_size_shift);
56
l1_ste_offset = sid >> s->sid_split;
57
l2_ste_offset = sid & ((1 << s->sid_split) - 1);
58
l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
59
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
60
}
61
addr = l2ptr + l2_ste_offset * sizeof(*ste);
62
} else {
63
- addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
64
+ strtab_size_shift = log2size + 5;
65
+ strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
66
+ ~MAKE_64BIT_MASK(0, strtab_size_shift);
67
+ addr = strtab_base + sid * sizeof(*ste);
68
}
69
70
if (smmu_get_ste(s, addr, ste, event)) {
27
--
71
--
28
2.17.1
72
2.20.1
29
73
30
74
diff view generated by jsdifflib
[Qemu-devel] [PULL 2/6] hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host()
[PULL 09/12] hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro
1
From: Geert Uytterhoeven <geert+renesas@glider.be>
1
From: Simon Veith <sveith@amazon.de>
2
2
3
When copy_properties_from_host() ignores the error for an optional
3
The bit offsets in the EVT_SET_ADDR2 macro do not match those specified
4
property, it frees the error, but fails to reset it.
4
in the ARM SMMUv3 Architecture Specification. In all events that use
5
this macro, e.g. F_WALK_EABT, the faulting fetch address or IPA actually
6
occupies the 32-bit words 6 and 7 in the event record contiguously, with
7
the upper and lower unused bits clear due to alignment or maximum
8
supported address bits. How many bits are clear depends on the
9
individual event type.
5
10
6
Hence if two or more optional properties are missing, an assertion is
11
Update the macro to write to the correct words in the event record so
7
triggered:
12
that guest drivers can obtain accurate address information on events.
8
13
9
util/error.c:57: error_setv: Assertion `*errp == NULL' failed.
14
ref. ARM IHI 0070C, sections 7.3.12 through 7.3.16.
10
15
11
Fis this by resetting err to NULL after ignoring the error.
16
Signed-off-by: Simon Veith <sveith@amazon.de>
12
17
Acked-by: Eric Auger <eric.auger@redhat.com>
13
Fixes: 9481cf2e5f2f2bb6 ("hw/arm/sysbus-fdt: helpers for clock node generation")
18
Tested-by: Eric Auger <eric.auger@redhat.com>
14
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
19
Message-id: 1576509312-13083-6-git-send-email-sveith@amazon.de
15
Message-id: 20180725113000.11014-1-geert+renesas@glider.be
20
Cc: Eric Auger <eric.auger@redhat.com>
21
Cc: qemu-devel@nongnu.org
22
Cc: qemu-arm@nongnu.org
23
Acked-by: Eric Auger <eric.auger@redhat.com>
16
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
24
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
25
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
---
26
---
19
hw/arm/sysbus-fdt.c | 1 +
27
hw/arm/smmuv3-internal.h | 4 ++--
20
1 file changed, 1 insertion(+)
28
1 file changed, 2 insertions(+), 2 deletions(-)
21
29
22
diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
30
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
23
index XXXXXXX..XXXXXXX 100644
31
index XXXXXXX..XXXXXXX 100644
24
--- a/hw/arm/sysbus-fdt.c
32
--- a/hw/arm/smmuv3-internal.h
25
+++ b/hw/arm/sysbus-fdt.c
33
+++ b/hw/arm/smmuv3-internal.h
26
@@ -XXX,XX +XXX,XX @@ static void copy_properties_from_host(HostProperty *props, int nb_props,
34
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
27
/* mandatory property not found: bail out */
35
} while (0)
28
exit(1);
36
#define EVT_SET_ADDR2(x, addr) \
29
}
37
do { \
30
+ err = NULL;
38
- (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16); \
31
}
39
- (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
32
}
40
+ (x)->word[7] = (uint32_t)(addr >> 32); \
33
}
41
+ (x)->word[6] = (uint32_t)(addr & 0xffffffff); \
42
} while (0)
43
44
void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
34
--
45
--
35
2.17.1
46
2.20.1
36
47
37
48
diff view generated by jsdifflib
[Qemu-devel] [PULL 3/6] armv7m_nvic: Fix m-security subsection name
[PULL 10/12] hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position
1
The vmstate save/load code insists that subsections of a VMState must
1
From: Simon Veith <sveith@amazon.de>
2
have names which include their parent VMState's name as a leading
3
substring. Unfortunately it neither documents this nor checks it on
4
device init or state save, but instead fails state load with a
5
confusing error message ("Missing section footer for armv7m_nvic").
6
2
7
Fix the name of the m-security subsection of the NVIC, so that
3
The smmuv3_record_event() function that generates the F_STE_FETCH error
8
state save/load works correctly for the security-enabled NVIC.
4
uses the EVT_SET_ADDR macro to record the fetch address, placing it in
5
32-bit words 4 and 5.
9
6
7
The correct position for this address is in words 6 and 7, per the
8
SMMUv3 Architecture Specification.
9
10
Update the function to use the EVT_SET_ADDR2 macro instead, which is the
11
macro intended for writing to these words.
12
13
ref. ARM IHI 0070C, section 7.3.4.
14
15
Signed-off-by: Simon Veith <sveith@amazon.de>
16
Acked-by: Eric Auger <eric.auger@redhat.com>
17
Tested-by: Eric Auger <eric.auger@redhat.com>
18
Message-id: 1576509312-13083-7-git-send-email-sveith@amazon.de
19
Cc: Eric Auger <eric.auger@redhat.com>
20
Cc: qemu-devel@nongnu.org
21
Cc: qemu-arm@nongnu.org
22
Acked-by: Eric Auger <eric.auger@redhat.com>
23
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 20180727113854.20283-2-peter.maydell@linaro.org
13
---
25
---
14
hw/intc/armv7m_nvic.c | 2 +-
26
hw/arm/smmuv3.c | 2 +-
15
1 file changed, 1 insertion(+), 1 deletion(-)
27
1 file changed, 1 insertion(+), 1 deletion(-)
16
28
17
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
29
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
18
index XXXXXXX..XXXXXXX 100644
30
index XXXXXXX..XXXXXXX 100644
19
--- a/hw/intc/armv7m_nvic.c
31
--- a/hw/arm/smmuv3.c
20
+++ b/hw/intc/armv7m_nvic.c
32
+++ b/hw/arm/smmuv3.c
21
@@ -XXX,XX +XXX,XX @@ static int nvic_security_post_load(void *opaque, int version_id)
33
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
22
}
34
case SMMU_EVT_F_STE_FETCH:
23
35
EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
24
static const VMStateDescription vmstate_nvic_security = {
36
EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);
25
- .name = "nvic/m-security",
37
- EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
26
+ .name = "armv7m_nvic/m-security",
38
+ EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
27
.version_id = 1,
39
break;
28
.minimum_version_id = 1,
40
case SMMU_EVT_C_BAD_STE:
29
.needed = nvic_security_needed,
41
EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
30
--
42
--
31
2.17.1
43
2.20.1
32
44
33
45
diff view generated by jsdifflib
[Qemu-devel] [PULL 6/6] target/arm: Remove duplicate 'host' entry in '-cpu ?' output
[PULL 11/12] target/arm: Display helpful message when hflags mismatch
1
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
Since 86f0a186d6f the TYPE_ARM_HOST_CPU is only compiled when CONFIG_KVM
3
Instead of crashing in a confuse way, give some hint to the user
4
is enabled.
4
about why we aborted. He might report the issue without having
5
to use a debugger.
5
6
6
Remove the now redundant special-case introduced in a96c0514ab7, to avoid:
7
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
7
8
Message-id: 20191209134552.27733-1-philmd@redhat.com
8
$ qemu-system-aarch64 -machine virt -cpu \? | fgrep host
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
host
10
Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
10
host (only available in KVM mode)
11
12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
13
Message-id: 20180727132311.2777-1-f4bug@amsat.org
14
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
16
---
12
---
17
target/arm/helper.c | 6 ------
13
target/arm/helper.c | 18 +++++++++++++++---
18
1 file changed, 6 deletions(-)
14
1 file changed, 15 insertions(+), 3 deletions(-)
19
15
20
diff --git a/target/arm/helper.c b/target/arm/helper.c
16
diff --git a/target/arm/helper.c b/target/arm/helper.c
21
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
22
--- a/target/arm/helper.c
18
--- a/target/arm/helper.c
23
+++ b/target/arm/helper.c
19
+++ b/target/arm/helper.c
24
@@ -XXX,XX +XXX,XX @@ void arm_cpu_list(FILE *f, fprintf_function cpu_fprintf)
20
@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
25
(*cpu_fprintf)(f, "Available CPUs:\n");
21
env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
26
g_slist_foreach(list, arm_cpu_list_entry, &s);
22
}
27
g_slist_free(list);
23
28
-#ifdef CONFIG_KVM
24
+static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
29
- /* The 'host' CPU type is dynamically registered only if KVM is
25
+{
30
- * enabled, so we have to special-case it here:
26
+#ifdef CONFIG_DEBUG_TCG
31
- */
27
+ uint32_t env_flags_current = env->hflags;
32
- (*cpu_fprintf)(f, " host (only available in KVM mode)\n");
28
+ uint32_t env_flags_rebuilt = rebuild_hflags_internal(env);
29
+
30
+ if (unlikely(env_flags_current != env_flags_rebuilt)) {
31
+ fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n",
32
+ env_flags_current, env_flags_rebuilt);
33
+ abort();
34
+ }
35
+#endif
36
+}
37
+
38
void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
39
target_ulong *cs_base, uint32_t *pflags)
40
{
41
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
42
uint32_t pstate_for_ss;
43
44
*cs_base = 0;
45
-#ifdef CONFIG_DEBUG_TCG
46
- assert(flags == rebuild_hflags_internal(env));
33
-#endif
47
-#endif
34
}
48
+ assert_hflags_rebuild_correctly(env);
35
49
36
static void arm_cpu_add_definition(gpointer data, gpointer user_data)
50
if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {
51
*pc = env->pc;
37
--
52
--
38
2.17.1
53
2.20.1
39
54
40
55
diff view generated by jsdifflib
New patch
[PULL 12/12] arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
1
From: Niek Linnenbank <nieklinnenbank@gmail.com>
1
2
3
After setting CP15 bits in arm_set_cpu_on() the cached hflags must
4
be rebuild to reflect the changed processor state. Without rebuilding,
5
the cached hflags would be inconsistent until the next call to
6
arm_rebuild_hflags(). When QEMU is compiled with debugging enabled
7
(--enable-debug), this problem is captured shortly after the first
8
call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:
9
10
qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:
11
Assertion `flags == rebuild_hflags_internal(env)' failed.
12
Aborted (core dumped)
13
14
Fixes: 0c7f8c43daf65
15
Cc: qemu-stable@nongnu.org
16
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
17
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
---
20
target/arm/arm-powerctl.c | 3 +++
21
1 file changed, 3 insertions(+)
22
23
diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
24
index XXXXXXX..XXXXXXX 100644
25
--- a/target/arm/arm-powerctl.c
26
+++ b/target/arm/arm-powerctl.c
27
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
28
target_cpu->env.regs[0] = info->context_id;
29
}
30
31
+ /* CP15 update requires rebuilding hflags */
32
+ arm_rebuild_hflags(&target_cpu->env);
33
+
34
/* Start the new CPU at the requested address */
35
cpu_set_pc(target_cpu_state, info->entry);
36
37
--
38
2.20.1
39
40
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.