| 1 | v2: dropped a couple of cadence_gem changes to ID regs that | 1 | Hi; this pull request has a couple of fixes for bugs in |
|---|---|---|---|
| 2 | caused new clang sanitizer warnings. | 2 | the Arm page-table-walk code, which arrived in the last |
| 3 | day or so. | ||
| 3 | 4 | ||
| 5 | I'm sending this out now in the hope it might just sneak | ||
| 6 | in before rc2 gets tagged, so the fixes can get more | ||
| 7 | testing time before the 7.2 release; but if they don't | ||
| 8 | make it then this should go into rc3. | ||
| 9 | |||
| 10 | thanks | ||
| 4 | -- PMM | 11 | -- PMM |
| 5 | 12 | ||
| 6 | The following changes since commit dddb37495b844270088e68e3bf30b764d48d863f: | 13 | The following changes since commit 6d71357a3b651ec9db126e4862b77e13165427f5: |
| 7 | 14 | ||
| 8 | Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20181015.0' into staging (2018-10-15 18:44:04 +0100) | 15 | rtl8139: honor large send MSS value (2022-11-21 09:28:43 -0500) |
| 9 | 16 | ||
| 10 | are available in the Git repository at: | 17 | are available in the Git repository at: |
| 11 | 18 | ||
| 12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181016-1 | 19 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221122 |
| 13 | 20 | ||
| 14 | for you to fetch changes up to 2ef297af07196c29446556537861f8e7dfeeae7b: | 21 | for you to fetch changes up to 15f8f4671afd22491ce99d28a296514717fead4f: |
| 15 | 22 | ||
| 16 | coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls (2018-10-16 17:14:55 +0100) | 23 | target/arm: Use signed quantity to represent VMSAv8-64 translation level (2022-11-22 16:10:25 +0000) |
| 17 | 24 | ||
| 18 | ---------------------------------------------------------------- | 25 | ---------------------------------------------------------------- |
| 19 | target-arm queue: | 26 | target-arm: |
| 20 | * hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART | 27 | * Fix broken 5-level pagetable handling |
| 21 | * target/arm: Fix aarch64_sve_change_el wrt EL0 | 28 | * Fix debug accesses when EL2 is present |
| 22 | * target/arm: Define fields of ISAR registers | ||
| 23 | * target/arm: Align cortex-r5 id_isar0 | ||
| 24 | * target/arm: Fix cortex-a7 id_isar0 | ||
| 25 | * net/cadence_gem: Fix various bugs, add support for new | ||
| 26 | features that will be used by the Xilinx Versal board | ||
| 27 | * target-arm: powerctl: Enable HVC when starting CPUs to EL2 | ||
| 28 | * target/arm: Add the Cortex-A72 | ||
| 29 | * target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO | ||
| 30 | * target/arm: Mask PMOVSR writes based on supported counters | ||
| 31 | * target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write | ||
| 32 | * coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls | ||
| 33 | 29 | ||
| 34 | ---------------------------------------------------------------- | 30 | ---------------------------------------------------------------- |
| 35 | Aaron Lindsay (2): | 31 | Ard Biesheuvel (1): |
| 36 | target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO | 32 | target/arm: Use signed quantity to represent VMSAv8-64 translation level |
| 37 | target/arm: Mask PMOVSR writes based on supported counters | ||
| 38 | 33 | ||
| 39 | Edgar E. Iglesias (8): | 34 | Peter Maydell (1): |
| 40 | net: cadence_gem: Disable TSU feature bit | 35 | target/arm: Don't do two-stage lookup if stage 2 is disabled |
| 41 | net: cadence_gem: Use uint32_t for 32bit descriptor words | ||
| 42 | net: cadence_gem: Add macro with max number of descriptor words | ||
| 43 | net: cadence_gem: Add support for extended descriptors | ||
| 44 | net: cadence_gem: Add support for selecting the DMA MemoryRegion | ||
| 45 | net: cadence_gem: Implement support for 64bit descriptor addresses | ||
| 46 | target-arm: powerctl: Enable HVC when starting CPUs to EL2 | ||
| 47 | target/arm: Add the Cortex-A72 | ||
| 48 | 36 | ||
| 49 | Jerome Forissier (1): | 37 | target/arm/ptw.c | 11 ++++++----- |
| 50 | hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART | 38 | 1 file changed, 6 insertions(+), 5 deletions(-) |
| 51 | |||
| 52 | Peter Maydell (2): | ||
| 53 | target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write | ||
| 54 | coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls | ||
| 55 | |||
| 56 | Richard Henderson (4): | ||
| 57 | target/arm: Fix aarch64_sve_change_el wrt EL0 | ||
| 58 | target/arm: Define fields of ISAR registers | ||
| 59 | target/arm: Align cortex-r5 id_isar0 | ||
| 60 | target/arm: Fix cortex-a7 id_isar0 | ||
| 61 | |||
| 62 | include/hw/net/cadence_gem.h | 7 +- | ||
| 63 | target/arm/cpu.h | 95 ++++++++++++++- | ||
| 64 | hw/arm/virt.c | 4 + | ||
| 65 | hw/net/cadence_gem.c | 185 ++++++++++++++++++++--------- | ||
| 66 | target/arm/arm-powerctl.c | 10 ++ | ||
| 67 | target/arm/cpu.c | 7 +- | ||
| 68 | target/arm/cpu64.c | 66 +++++++++- | ||
| 69 | target/arm/helper.c | 27 +++-- | ||
| 70 | target/arm/op_helper.c | 6 +- | ||
| 71 | scripts/coccinelle/inplace-byteswaps.cocci | 65 ++++++++++ | ||
| 72 | 10 files changed, 402 insertions(+), 70 deletions(-) | ||
| 73 | create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci | ||
| 74 | diff view generated by jsdifflib |
New patch | |||
|---|---|---|---|
| 1 | In get_phys_addr_with_struct(), we call get_phys_addr_twostage() if | ||
| 2 | the CPU supports EL2. However, we don't check here that stage 2 is | ||
| 3 | actually enabled. Instead we only check that inside | ||
| 4 | get_phys_addr_twostage() to skip stage 2 translation. This means | ||
| 5 | that even if stage 2 is disabled we still tell the stage 1 lookup to | ||
| 6 | do its page table walks via stage 2. | ||
| 1 | 7 | ||
| 8 | This works by luck for normal CPU accesses, but it breaks for debug | ||
| 9 | accesses, which are used by the disassembler and also by semihosting | ||
| 10 | file reads and writes, because the debug case takes a different code | ||
| 11 | path inside S1_ptw_translate(). | ||
| 12 | |||
| 13 | This means that setups that use semihosting for file loads are broken | ||
| 14 | (a regression since 7.1, introduced in recent ptw refactoring), and | ||
| 15 | that sometimes disassembly in debug logs reports "unable to read | ||
| 16 | memory" rather than showing the guest insns. | ||
| 17 | |||
| 18 | Fix the bug by hoisting the "is stage 2 enabled?" check up to | ||
| 19 | get_phys_addr_with_struct(), so that we handle S2 disabled the same | ||
| 20 | way we do the "no EL2" case, with a simple single stage lookup. | ||
| 21 | |||
| 22 | Reported-by: Jens Wiklander <jens.wiklander@linaro.org> | ||
| 23 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
| 24 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 25 | Message-id: 20221121212404.1450382-1-peter.maydell@linaro.org | ||
| 26 | --- | ||
| 27 | target/arm/ptw.c | 7 ++++--- | ||
| 28 | 1 file changed, 4 insertions(+), 3 deletions(-) | ||
| 29 | |||
| 30 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
| 31 | index XXXXXXX..XXXXXXX 100644 | ||
| 32 | --- a/target/arm/ptw.c | ||
| 33 | +++ b/target/arm/ptw.c | ||
| 34 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, | ||
| 35 | |||
| 36 | ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi); | ||
| 37 | |||
| 38 | - /* If S1 fails or S2 is disabled, return early. */ | ||
| 39 | - if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) { | ||
| 40 | + /* If S1 fails, return early. */ | ||
| 41 | + if (ret) { | ||
| 42 | return ret; | ||
| 43 | } | ||
| 44 | |||
| 45 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, | ||
| 46 | * Otherwise, a stage1+stage2 translation is just stage 1. | ||
| 47 | */ | ||
| 48 | ptw->in_mmu_idx = mmu_idx = s1_mmu_idx; | ||
| 49 | - if (arm_feature(env, ARM_FEATURE_EL2)) { | ||
| 50 | + if (arm_feature(env, ARM_FEATURE_EL2) && | ||
| 51 | + !regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) { | ||
| 52 | return get_phys_addr_twostage(env, ptw, address, access_type, | ||
| 53 | result, fi); | ||
| 54 | } | ||
| 55 | -- | ||
| 56 | 2.25.1 | diff view generated by jsdifflib |
New patch | |||
|---|---|---|---|
| 1 | From: Ard Biesheuvel <ardb@kernel.org> | ||
| 1 | 2 | ||
| 3 | The LPA2 extension implements 52-bit virtual addressing for 4k and 16k | ||
| 4 | translation granules, and for the former, this means an additional level | ||
| 5 | of translation is needed. This means we start counting at -1 instead of | ||
| 6 | 0 when doing a walk, and so 'level' is now a signed quantity, and should | ||
| 7 | be typed as such. So turn it from uint32_t into int32_t. | ||
| 8 | |||
| 9 | This avoids a level of -1 getting misinterpreted as being >= 3, and | ||
| 10 | terminating a page table walk prematurely with a bogus output address. | ||
| 11 | |||
| 12 | Cc: Peter Maydell <peter.maydell@linaro.org> | ||
| 13 | Cc: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
| 14 | Cc: Richard Henderson <richard.henderson@linaro.org> | ||
| 15 | Signed-off-by: Ard Biesheuvel <ardb@kernel.org> | ||
| 16 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 17 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 18 | --- | ||
| 19 | target/arm/ptw.c | 4 ++-- | ||
| 20 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
| 21 | |||
| 22 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
| 23 | index XXXXXXX..XXXXXXX 100644 | ||
| 24 | --- a/target/arm/ptw.c | ||
| 25 | +++ b/target/arm/ptw.c | ||
| 26 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
| 27 | ARMCPU *cpu = env_archcpu(env); | ||
| 28 | ARMMMUIdx mmu_idx = ptw->in_mmu_idx; | ||
| 29 | bool is_secure = ptw->in_secure; | ||
| 30 | - uint32_t level; | ||
| 31 | + int32_t level; | ||
| 32 | ARMVAParameters param; | ||
| 33 | uint64_t ttbr; | ||
| 34 | hwaddr descaddr, indexmask, indexmask_grainsize; | ||
| 35 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
| 36 | */ | ||
| 37 | uint32_t sl0 = extract32(tcr, 6, 2); | ||
| 38 | uint32_t sl2 = extract64(tcr, 33, 1); | ||
| 39 | - uint32_t startlevel; | ||
| 40 | + int32_t startlevel; | ||
| 41 | bool ok; | ||
| 42 | |||
| 43 | /* SL2 is RES0 unless DS=1 & 4kb granule. */ | ||
| 44 | -- | ||
| 45 | 2.25.1 | ||
| 46 | |||
| 47 | diff view generated by jsdifflib |