[Qemu-devel] [PULL 00/17] target-arm queue
[PULL 0/6] target-arm queue
1
v2: dropped a couple of cadence_gem changes to ID regs that
1
Hi; here's a target-arm pull for rc2. Four arm-related fixes,
2
caused new clang sanitizer warnings.
2
and a couple of bug fixes for other areas of the codebase
3
that seemed like they'd fallen through the cracks.
3
4
5
thanks
4
-- PMM
6
-- PMM
5
7
6
The following changes since commit dddb37495b844270088e68e3bf30b764d48d863f:
8
The following changes since commit ccb86f079a9e4d94918086a9df18c1844347aff8:
7
9
8
Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20181015.0' into staging (2018-10-15 18:44:04 +0100)
10
Merge tag 'pull-nbd-2023-07-28' of https://repo.or.cz/qemu/ericb into staging (2023-07-28 09:56:57 -0700)
9
11
10
are available in the Git repository at:
12
are available in the Git repository at:
11
13
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181016-1
14
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230731
13
15
14
for you to fetch changes up to 2ef297af07196c29446556537861f8e7dfeeae7b:
16
for you to fetch changes up to 108e8180c6b0c315711aa54e914030a313505c17:
15
17
16
coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls (2018-10-16 17:14:55 +0100)
18
gdbstub: Fix client Ctrl-C handling (2023-07-31 14:57:32 +0100)
17
19
18
----------------------------------------------------------------
20
----------------------------------------------------------------
19
target-arm queue:
21
target-arm queue:
20
* hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
22
* Don't build AArch64 decodetree files for qemu-system-arm
21
* target/arm: Fix aarch64_sve_change_el wrt EL0
23
* Fix TCG assert in v8.1M CSEL etc
22
* target/arm: Define fields of ISAR registers
24
* Fix MemOp for STGP
23
* target/arm: Align cortex-r5 id_isar0
25
* gdbstub: Fix client Ctrl-C handling
24
* target/arm: Fix cortex-a7 id_isar0
26
* kvm: Fix crash due to access uninitialized kvm_state
25
* net/cadence_gem: Fix various bugs, add support for new
27
* elf2dmp: Don't abandon when Prcb is set to 0
26
features that will be used by the Xilinx Versal board
27
* target-arm: powerctl: Enable HVC when starting CPUs to EL2
28
* target/arm: Add the Cortex-A72
29
* target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
30
* target/arm: Mask PMOVSR writes based on supported counters
31
* target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
32
* coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls
33
28
34
----------------------------------------------------------------
29
----------------------------------------------------------------
35
Aaron Lindsay (2):
30
Akihiko Odaki (1):
36
target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
31
elf2dmp: Don't abandon when Prcb is set to 0
37
target/arm: Mask PMOVSR writes based on supported counters
38
32
39
Edgar E. Iglesias (8):
33
Gavin Shan (1):
40
net: cadence_gem: Disable TSU feature bit
34
kvm: Fix crash due to access uninitialized kvm_state
41
net: cadence_gem: Use uint32_t for 32bit descriptor words
42
net: cadence_gem: Add macro with max number of descriptor words
43
net: cadence_gem: Add support for extended descriptors
44
net: cadence_gem: Add support for selecting the DMA MemoryRegion
45
net: cadence_gem: Implement support for 64bit descriptor addresses
46
target-arm: powerctl: Enable HVC when starting CPUs to EL2
47
target/arm: Add the Cortex-A72
48
35
49
Jerome Forissier (1):
36
Nicholas Piggin (1):
50
hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
37
gdbstub: Fix client Ctrl-C handling
51
38
52
Peter Maydell (2):
39
Peter Maydell (2):
53
target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
40
target/arm: Avoid writing to constant TCGv in trans_CSEL()
54
coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls
41
target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-arm
55
42
56
Richard Henderson (4):
43
Richard Henderson (1):
57
target/arm: Fix aarch64_sve_change_el wrt EL0
44
target/arm: Fix MemOp for STGP
58
target/arm: Define fields of ISAR registers
59
target/arm: Align cortex-r5 id_isar0
60
target/arm: Fix cortex-a7 id_isar0
61
45
62
include/hw/net/cadence_gem.h | 7 +-
46
accel/kvm/kvm-all.c | 2 +-
63
target/arm/cpu.h | 95 ++++++++++++++-
47
contrib/elf2dmp/main.c | 5 +++++
64
hw/arm/virt.c | 4 +
48
gdbstub/gdbstub.c | 13 +++++++++++--
65
hw/net/cadence_gem.c | 185 ++++++++++++++++++++---------
49
target/arm/tcg/translate-a64.c | 21 ++++++++++++++++++---
66
target/arm/arm-powerctl.c | 10 ++
50
target/arm/tcg/translate.c | 15 ++++++++-------
67
target/arm/cpu.c | 7 +-
51
target/arm/tcg/meson.build | 10 +++++++---
68
target/arm/cpu64.c | 66 +++++++++-
52
6 files changed, 50 insertions(+), 16 deletions(-)
69
target/arm/helper.c | 27 +++--
70
target/arm/op_helper.c | 6 +-
71
scripts/coccinelle/inplace-byteswaps.cocci | 65 ++++++++++
72
10 files changed, 402 insertions(+), 70 deletions(-)
73
create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci
74
diff view generated by jsdifflib
New patch
[PULL 1/6] target/arm: Fix MemOp for STGP
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
When converting to decodetree, the code to rebuild mop for the pair
4
only made it into trans_STP and not into trans_STGP.
5
6
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1790
7
Fixes: 8c212eb6594 ("target/arm: Convert load/store-pair to decodetree")
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20230726165416.309624-1-richard.henderson@linaro.org
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
target/arm/tcg/translate-a64.c | 21 ++++++++++++++++++---
14
1 file changed, 18 insertions(+), 3 deletions(-)
15
16
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/target/arm/tcg/translate-a64.c
19
+++ b/target/arm/tcg/translate-a64.c
20
@@ -XXX,XX +XXX,XX @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
21
MemOp mop;
22
TCGv_i128 tmp;
23
24
+ /* STGP only comes in one size. */
25
+ tcg_debug_assert(a->sz == MO_64);
26
+
27
if (!dc_isar_feature(aa64_mte_insn_reg, s)) {
28
return false;
29
}
30
@@ -XXX,XX +XXX,XX @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
31
gen_helper_stg(cpu_env, dirty_addr, dirty_addr);
32
}
33
34
- mop = finalize_memop(s, a->sz);
35
- clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << a->sz, mop);
36
+ mop = finalize_memop(s, MO_64);
37
+ clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << MO_64, mop);
38
39
tcg_rt = cpu_reg(s, a->rt);
40
tcg_rt2 = cpu_reg(s, a->rt2);
41
42
- assert(a->sz == 3);
43
+ /*
44
+ * STGP is defined as two 8-byte memory operations and one tag operation.
45
+ * We implement it as one single 16-byte memory operation for convenience.
46
+ * Rebuild mop as for STP.
47
+ * TODO: The atomicity with LSE2 is stronger than required.
48
+ * Need a form of MO_ATOM_WITHIN16_PAIR that never requires
49
+ * 16-byte atomicity.
50
+ */
51
+ mop = MO_128;
52
+ if (s->align_mem) {
53
+ mop |= MO_ALIGN_8;
54
+ }
55
+ mop = finalize_memop_pair(s, mop);
56
57
tmp = tcg_temp_new_i128();
58
if (s->be_data == MO_LE) {
59
--
60
2.34.1
diff view generated by jsdifflib
New patch
[PULL 2/6] elf2dmp: Don't abandon when Prcb is set to 0
1
From: Akihiko Odaki <akihiko.odaki@daynix.com>
1
2
3
Prcb may be set to 0 for some CPUs if the dump was taken before they
4
start. The dump may still contain valuable information for started CPUs
5
so don't abandon conversion in such a case.
6
7
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
8
Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
9
Message-id: 20230611033434.14659-1-akihiko.odaki@daynix.com
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
contrib/elf2dmp/main.c | 5 +++++
13
1 file changed, 5 insertions(+)
14
15
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/contrib/elf2dmp/main.c
18
+++ b/contrib/elf2dmp/main.c
19
@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
20
return 1;
21
}
22
23
+ if (!Prcb) {
24
+ eprintf("Context for CPU #%d is missing\n", i);
25
+ continue;
26
+ }
27
+
28
if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
29
&Context, sizeof(Context), 0)) {
30
eprintf("Failed to read CPU #%d ContextFrame location\n", i);
31
--
32
2.34.1
diff view generated by jsdifflib
New patch
[PULL 3/6] target/arm: Avoid writing to constant TCGv in trans_CSEL()
1
In commit 0b188ea05acb5 we changed the implementation of
2
trans_CSEL() to use tcg_constant_i32(). However, this change
3
was incorrect, because the implementation of the function
4
sets up the TCGv_i32 rn and rm to be either zero or else
5
a TCG temp created in load_reg(), and these TCG temps are
6
then in both cases written to by the emitted TCG ops.
7
The result is that we hit a TCG assertion:
1
8
9
qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed.
10
11
(or on a non-debug build, just produce a garbage result)
12
13
Adjust the code so that rn and rm are always writeable
14
temporaries whether the instruction is using the special
15
case "0" or a normal register as input.
16
17
Cc: qemu-stable@nongnu.org
18
Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL")
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
21
Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
22
---
23
target/arm/tcg/translate.c | 15 ++++++++-------
24
1 file changed, 8 insertions(+), 7 deletions(-)
25
26
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
27
index XXXXXXX..XXXXXXX 100644
28
--- a/target/arm/tcg/translate.c
29
+++ b/target/arm/tcg/translate.c
30
@@ -XXX,XX +XXX,XX @@ static bool trans_IT(DisasContext *s, arg_IT *a)
31
/* v8.1M CSEL/CSINC/CSNEG/CSINV */
32
static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
33
{
34
- TCGv_i32 rn, rm, zero;
35
+ TCGv_i32 rn, rm;
36
DisasCompare c;
37
38
if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
39
@@ -XXX,XX +XXX,XX @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
40
}
41
42
/* In this insn input reg fields of 0b1111 mean "zero", not "PC" */
43
- zero = tcg_constant_i32(0);
44
+ rn = tcg_temp_new_i32();
45
+ rm = tcg_temp_new_i32();
46
if (a->rn == 15) {
47
- rn = zero;
48
+ tcg_gen_movi_i32(rn, 0);
49
} else {
50
- rn = load_reg(s, a->rn);
51
+ load_reg_var(s, rn, a->rn);
52
}
53
if (a->rm == 15) {
54
- rm = zero;
55
+ tcg_gen_movi_i32(rm, 0);
56
} else {
57
- rm = load_reg(s, a->rm);
58
+ load_reg_var(s, rm, a->rm);
59
}
60
61
switch (a->op) {
62
@@ -XXX,XX +XXX,XX @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
63
}
64
65
arm_test_cc(&c, a->fcond);
66
- tcg_gen_movcond_i32(c.cond, rn, c.value, zero, rn, rm);
67
+ tcg_gen_movcond_i32(c.cond, rn, c.value, tcg_constant_i32(0), rn, rm);
68
69
store_reg(s, a->rd, rn);
70
return true;
71
--
72
2.34.1
diff view generated by jsdifflib
New patch
[PULL 4/6] target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-arm
1
Currently we list all the Arm decodetree files together and add them
2
unconditionally to arm_ss. This means we build them for both
3
qemu-system-aarch64 and qemu-system-arm. However, some of them are
4
AArch64-specific, so there is no need to build them for
5
qemu-system-arm. (Meson is smart enough to notice that the generated
6
.c.inc file is not used by any objects that go into qemu-system-arm,
7
so we only unnecessarily run decodetree, not anything more
8
heavyweight like a recompile or relink, but it's still unnecessary
9
work.)
1
10
11
Split gen into gen_a32 and gen_a64, and only add gen_a64 for
12
TARGET_AARCH64 compiles.
13
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
16
Message-id: 20230718104628.1137734-1-peter.maydell@linaro.org
17
---
18
target/arm/tcg/meson.build | 10 +++++++---
19
1 file changed, 7 insertions(+), 3 deletions(-)
20
21
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
22
index XXXXXXX..XXXXXXX 100644
23
--- a/target/arm/tcg/meson.build
24
+++ b/target/arm/tcg/meson.build
25
@@ -XXX,XX +XXX,XX @@
26
-gen = [
27
+gen_a64 = [
28
+ decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
29
decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
30
decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
31
decodetree.process('sme-fa64.decode', extra_args: '--static-decode=disas_sme_fa64'),
32
+]
33
+
34
+gen_a32 = [
35
decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
36
decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
37
decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
38
@@ -XXX,XX +XXX,XX @@ gen = [
39
decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
40
decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
41
decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
42
- decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
43
]
44
45
-arm_ss.add(gen)
46
+arm_ss.add(gen_a32)
47
+arm_ss.add(when: 'TARGET_AARCH64', if_true: gen_a64)
48
49
arm_ss.add(files(
50
'cpu32.c',
51
--
52
2.34.1
53
54
diff view generated by jsdifflib
New patch
[PULL 5/6] kvm: Fix crash due to access uninitialized kvm_state
1
From: Gavin Shan <gshan@redhat.com>
1
2
3
Runs into core dump on arm64 and the backtrace extracted from the
4
core dump is shown as below. It's caused by accessing uninitialized
5
@kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
6
("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
7
memory region is added earlier than before.
8
9
main
10
qemu_init
11
configure_accelerators
12
qemu_opts_foreach
13
do_configure_accelerator
14
accel_init_machine
15
kvm_init
16
virt_kvm_type
17
virt_set_memmap
18
machine_memory_devices_init
19
memory_region_add_subregion
20
memory_region_add_subregion_common
21
memory_region_update_container_subregions
22
memory_region_transaction_begin
23
qemu_flush_coalesced_mmio_buffer
24
kvm_flush_coalesced_mmio_buffer
25
26
Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
27
uninitialized @kvm_state. With this applied, no crash is observed on
28
arm64.
29
30
Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
31
Signed-off-by: Gavin Shan <gshan@redhat.com>
32
Reviewed-by: David Hildenbrand <david@redhat.com>
33
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
34
Message-id: 20230731125946.2038742-1-gshan@redhat.com
35
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
36
---
37
accel/kvm/kvm-all.c | 2 +-
38
1 file changed, 1 insertion(+), 1 deletion(-)
39
40
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
41
index XXXXXXX..XXXXXXX 100644
42
--- a/accel/kvm/kvm-all.c
43
+++ b/accel/kvm/kvm-all.c
44
@@ -XXX,XX +XXX,XX @@ void kvm_flush_coalesced_mmio_buffer(void)
45
{
46
KVMState *s = kvm_state;
47
48
- if (s->coalesced_flush_in_progress) {
49
+ if (!s || s->coalesced_flush_in_progress) {
50
return;
51
}
52
53
--
54
2.34.1
55
56
diff view generated by jsdifflib
New patch
[PULL 6/6] gdbstub: Fix client Ctrl-C handling
1
From: Nicholas Piggin <npiggin@gmail.com>
1
2
3
The gdb remote protocol has a special interrupt character (0x03) that is
4
transmitted outside the regular packet processing, and represents a
5
Ctrl-C pressed in the client. Despite not being a regular packet, it
6
does expect a regular stop response if the stub successfully stops the
7
running program.
8
9
See: https://sourceware.org/gdb/onlinedocs/gdb/Interrupts.html
10
11
Inhibiting the stop reply packet can lead to gdb client hang. So permit
12
a stop response when receiving a character from gdb that stops the vm.
13
Additionally, add a warning if that was not a 0x03 character, because
14
the gdb session is likely to end up getting confused if this happens.
15
16
Cc: qemu-stable@nongnu.org
17
Fixes: 758370052fb ("gdbstub: only send stop-reply packets when allowed to")
18
Reported-by: Frederic Barrat <fbarrat@linux.ibm.com>
19
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
20
Tested-by: Joel Stanley <joel@jms.id.au>
21
Message-id: 20230711085903.304496-1-npiggin@gmail.com
22
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
---
25
gdbstub/gdbstub.c | 13 +++++++++++--
26
1 file changed, 11 insertions(+), 2 deletions(-)
27
28
diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
29
index XXXXXXX..XXXXXXX 100644
30
--- a/gdbstub/gdbstub.c
31
+++ b/gdbstub/gdbstub.c
32
@@ -XXX,XX +XXX,XX @@ void gdb_read_byte(uint8_t ch)
33
return;
34
}
35
if (runstate_is_running()) {
36
- /* when the CPU is running, we cannot do anything except stop
37
- it when receiving a char */
38
+ /*
39
+ * When the CPU is running, we cannot do anything except stop
40
+ * it when receiving a char. This is expected on a Ctrl-C in the
41
+ * gdb client. Because we are in all-stop mode, gdb sends a
42
+ * 0x03 byte which is not a usual packet, so we handle it specially
43
+ * here, but it does expect a stop reply.
44
+ */
45
+ if (ch != 0x03) {
46
+ warn_report("gdbstub: client sent packet while target running\n");
47
+ }
48
+ gdbserver_state.allow_stop_reply = true;
49
vm_stop(RUN_STATE_PAUSED);
50
} else
51
#endif
52
--
53
2.34.1
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.