[Qemu-devel] [PULL 00/22] target-arm queue
[Qemu-devel] [PULL 00/10] target-arm queue
1
Arm stuff, mostly patches from RTH.
1
target-arm queue for rc1 -- these are all bug fixes.
2
2
3
thanks
3
thanks
4
-- PMM
4
-- PMM
5
5
6
The following changes since commit 01a9a51ffaf4699827ea6425cb2b834a356e159d:
6
The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
7
7
8
Merge remote-tracking branch 'remotes/kraxel/tags/ui-20190205-pull-request' into staging (2019-02-05 14:01:29 +0000)
8
Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
9
9
10
are available in the Git repository at:
10
are available in the Git repository at:
11
11
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190205
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
13
13
14
for you to fetch changes up to a15945d98d3a3390c3da344d1b47218e91e49d8b:
14
for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
15
15
16
target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI (2019-02-05 16:52:42 +0000)
16
target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
17
17
18
----------------------------------------------------------------
18
----------------------------------------------------------------
19
target-arm queue:
19
target-arm queue:
20
* Implement Armv8.5-BTI extension for system emulation mode
20
* report ARMv8-A FP support for AArch32 -cpu max
21
* Implement the PR_PAC_RESET_KEYS prctl() for linux-user mode's Armv8.3-PAuth support
21
* hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
22
* Support TBI (top-byte-ignore) properly for linux-user mode
22
* hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
23
* gdbstub: allow killing QEMU via vKill command
23
* hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
24
* hw/arm/boot: Support DTB autoload for firmware-only boots
24
* hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
25
* target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI
25
* hw/arm/virt: Fix non-secure flash mode
26
* pl031: Correctly migrate state when using -rtc clock=host
27
* fix regression that meant arm926 and arm1026 lost VFP
28
double-precision support
29
* v8M: NS BusFault on vector table fetch escalates to NS HardFault
26
30
27
----------------------------------------------------------------
31
----------------------------------------------------------------
28
Max Filippov (1):
32
Alex Bennée (1):
29
gdbstub: allow killing QEMU via vKill command
33
target/arm: report ARMv8-A FP support for AArch32 -cpu max
30
34
31
Peter Maydell (7):
35
David Engraf (1):
32
target/arm: Compute TB_FLAGS for TBI for user-only
36
hw/arm/virt: Fix non-secure flash mode
33
hw/arm/boot: Fix block comment style in arm_load_kernel()
34
hw/arm/boot: Factor out "direct kernel boot" code into its own function
35
hw/arm/boot: Factor out "set up firmware boot" code
36
hw/arm/boot: Clarify why arm_setup_firmware_boot() doesn't set env->boot_info
37
hw/arm/boot: Support DTB autoload for firmware-only boots
38
target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI
39
37
40
Richard Henderson (14):
38
Peter Maydell (3):
41
target/arm: Introduce isar_feature_aa64_bti
39
pl031: Correctly migrate state when using -rtc clock=host
42
target/arm: Add PSTATE.BTYPE
40
target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
43
target/arm: Add BT and BTYPE to tb->flags
41
target/arm: NS BusFault on vector table fetch escalates to NS HardFault
44
exec: Add target-specific tlb bits to MemTxAttrs
45
target/arm: Cache the GP bit for a page in MemTxAttrs
46
target/arm: Default handling of BTYPE during translation
47
target/arm: Reset btype for direct branches
48
target/arm: Set btype for indirect branches
49
target/arm: Enable BTI for -cpu max
50
linux-user: Implement PR_PAC_RESET_KEYS
51
tests/tcg/aarch64: Add pauth smoke test
52
target/arm: Add TBFLAG_A64_TBID, split out gen_top_byte_ignore
53
target/arm: Clean TBI for data operations in the translator
54
target/arm: Enable TBI for user-only
55
42
56
tests/tcg/aarch64/Makefile.target | 6 +-
43
Philippe Mathieu-Daudé (5):
57
include/exec/memattrs.h | 10 +
44
hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
58
linux-user/aarch64/target_syscall.h | 7 +
45
hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
59
target/arm/cpu.h | 27 +-
46
hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
60
target/arm/internals.h | 27 +-
47
hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
61
target/arm/translate.h | 12 +-
48
hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
62
gdbstub.c | 4 +
63
hw/arm/boot.c | 166 +++++++------
64
linux-user/syscall.c | 36 +++
65
target/arm/cpu.c | 6 +
66
target/arm/cpu64.c | 4 +
67
target/arm/helper.c | 80 +++---
68
target/arm/translate-a64.c | 476 +++++++++++++++++++++++++-----------
69
tests/tcg/aarch64/pauth-1.c | 23 ++
70
14 files changed, 623 insertions(+), 261 deletions(-)
71
create mode 100644 tests/tcg/aarch64/pauth-1.c
72
49
50
include/hw/timer/pl031.h | 2 ++
51
hw/arm/virt.c | 2 +-
52
hw/core/machine.c | 1 +
53
hw/display/xlnx_dp.c | 15 +++++---
54
hw/ssi/mss-spi.c | 8 ++++-
55
hw/ssi/xilinx_spips.c | 43 +++++++++++++++-------
56
hw/timer/pl031.c | 92 +++++++++++++++++++++++++++++++++++++++++++++---
57
target/arm/cpu.c | 16 +++++++++
58
target/arm/m_helper.c | 21 ++++++++---
59
9 files changed, 174 insertions(+), 26 deletions(-)
60
diff view generated by jsdifflib
[Qemu-devel] [PULL 01/22] target/arm: Introduce isar_feature_aa64_bti
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Also create field definitions for id_aa64pfr1 from ARMv8.5.
4
5
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20190128223118.5255-2-richard.henderson@linaro.org
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
10
target/arm/cpu.h | 10 ++++++++++
11
1 file changed, 10 insertions(+)
12
13
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
14
index XXXXXXX..XXXXXXX 100644
15
--- a/target/arm/cpu.h
16
+++ b/target/arm/cpu.h
17
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, GIC, 24, 4)
18
FIELD(ID_AA64PFR0, RAS, 28, 4)
19
FIELD(ID_AA64PFR0, SVE, 32, 4)
20
21
+FIELD(ID_AA64PFR1, BT, 0, 4)
22
+FIELD(ID_AA64PFR1, SBSS, 4, 4)
23
+FIELD(ID_AA64PFR1, MTE, 8, 4)
24
+FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
25
+
26
FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
27
FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
28
FIELD(ID_AA64MMFR0, BIGEND, 8, 4)
29
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_lor(const ARMISARegisters *id)
30
return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, LO) != 0;
31
}
32
33
+static inline bool isar_feature_aa64_bti(const ARMISARegisters *id)
34
+{
35
+ return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, BT) != 0;
36
+}
37
+
38
/*
39
* Forward to the above feature tests given an ARMCPU pointer.
40
*/
41
--
42
2.20.1
43
44
diff view generated by jsdifflib
[Qemu-devel] [PULL 02/22] target/arm: Add PSTATE.BTYPE
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Place this in its own field within ENV, as that will
4
make it easier to reset from within TCG generated code.
5
6
With the change to pstate_read/write, exception entry
7
and return are automatically handled.
8
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 20190128223118.5255-3-richard.henderson@linaro.org
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/cpu.h | 8 ++++++--
15
target/arm/translate-a64.c | 3 +++
16
2 files changed, 9 insertions(+), 2 deletions(-)
17
18
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
19
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/cpu.h
21
+++ b/target/arm/cpu.h
22
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
23
* semantics as for AArch32, as described in the comments on each field)
24
* nRW (also known as M[4]) is kept, inverted, in env->aarch64
25
* DAIF (exception masks) are kept in env->daif
26
+ * BTYPE is kept in env->btype
27
* all other bits are stored in their correct places in env->pstate
28
*/
29
uint32_t pstate;
30
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
31
uint32_t GE; /* cpsr[19:16] */
32
uint32_t thumb; /* cpsr[5]. 0 = arm mode, 1 = thumb mode. */
33
uint32_t condexec_bits; /* IT bits. cpsr[15:10,26:25]. */
34
+ uint32_t btype; /* BTI branch type. spsr[11:10]. */
35
uint64_t daif; /* exception masks, in the bits they are in PSTATE */
36
37
uint64_t elr_el[4]; /* AArch64 exception link regs */
38
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
39
#define PSTATE_I (1U << 7)
40
#define PSTATE_A (1U << 8)
41
#define PSTATE_D (1U << 9)
42
+#define PSTATE_BTYPE (3U << 10)
43
#define PSTATE_IL (1U << 20)
44
#define PSTATE_SS (1U << 21)
45
#define PSTATE_V (1U << 28)
46
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
47
#define PSTATE_N (1U << 31)
48
#define PSTATE_NZCV (PSTATE_N | PSTATE_Z | PSTATE_C | PSTATE_V)
49
#define PSTATE_DAIF (PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F)
50
-#define CACHED_PSTATE_BITS (PSTATE_NZCV | PSTATE_DAIF)
51
+#define CACHED_PSTATE_BITS (PSTATE_NZCV | PSTATE_DAIF | PSTATE_BTYPE)
52
/* Mode values for AArch64 */
53
#define PSTATE_MODE_EL3h 13
54
#define PSTATE_MODE_EL3t 12
55
@@ -XXX,XX +XXX,XX @@ static inline uint32_t pstate_read(CPUARMState *env)
56
ZF = (env->ZF == 0);
57
return (env->NF & 0x80000000) | (ZF << 30)
58
| (env->CF << 29) | ((env->VF & 0x80000000) >> 3)
59
- | env->pstate | env->daif;
60
+ | env->pstate | env->daif | (env->btype << 10);
61
}
62
63
static inline void pstate_write(CPUARMState *env, uint32_t val)
64
@@ -XXX,XX +XXX,XX @@ static inline void pstate_write(CPUARMState *env, uint32_t val)
65
env->CF = (val >> 29) & 1;
66
env->VF = (val << 3) & 0x80000000;
67
env->daif = val & PSTATE_DAIF;
68
+ env->btype = (val >> 10) & 3;
69
env->pstate = val & ~CACHED_PSTATE_BITS;
70
}
71
72
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
73
index XXXXXXX..XXXXXXX 100644
74
--- a/target/arm/translate-a64.c
75
+++ b/target/arm/translate-a64.c
76
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
77
el,
78
psr & PSTATE_SP ? 'h' : 't');
79
80
+ if (cpu_isar_feature(aa64_bti, cpu)) {
81
+ cpu_fprintf(f, " BTYPE=%d", (psr & PSTATE_BTYPE) >> 10);
82
+ }
83
if (!(flags & CPU_DUMP_FPU)) {
84
cpu_fprintf(f, "\n");
85
return;
86
--
87
2.20.1
88
89
diff view generated by jsdifflib
[Qemu-devel] [PULL 03/22] target/arm: Add BT and BTYPE to tb->flags
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5
Message-id: 20190128223118.5255-4-richard.henderson@linaro.org
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
8
target/arm/cpu.h | 2 ++
9
target/arm/translate.h | 4 ++++
10
target/arm/helper.c | 22 +++++++++++++++-------
11
target/arm/translate-a64.c | 2 ++
12
4 files changed, 23 insertions(+), 7 deletions(-)
13
14
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.h
17
+++ b/target/arm/cpu.h
18
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, TBII, 0, 2)
19
FIELD(TBFLAG_A64, SVEEXC_EL, 2, 2)
20
FIELD(TBFLAG_A64, ZCR_LEN, 4, 4)
21
FIELD(TBFLAG_A64, PAUTH_ACTIVE, 8, 1)
22
+FIELD(TBFLAG_A64, BT, 9, 1)
23
+FIELD(TBFLAG_A64, BTYPE, 10, 2)
24
25
static inline bool bswap_code(bool sctlr_b)
26
{
27
diff --git a/target/arm/translate.h b/target/arm/translate.h
28
index XXXXXXX..XXXXXXX 100644
29
--- a/target/arm/translate.h
30
+++ b/target/arm/translate.h
31
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
32
bool ss_same_el;
33
/* True if v8.3-PAuth is active. */
34
bool pauth_active;
35
+ /* True with v8.5-BTI and SCTLR_ELx.BT* set. */
36
+ bool bt;
37
+ /* A copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI. */
38
+ uint8_t btype;
39
/* Bottom two bits of XScale c15_cpar coprocessor access control reg */
40
int c15_cpar;
41
/* TCG op of the current insn_start. */
42
diff --git a/target/arm/helper.c b/target/arm/helper.c
43
index XXXXXXX..XXXXXXX 100644
44
--- a/target/arm/helper.c
45
+++ b/target/arm/helper.c
46
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
47
48
if (is_a64(env)) {
49
ARMCPU *cpu = arm_env_get_cpu(env);
50
+ uint64_t sctlr;
51
52
*pc = env->pc;
53
flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
54
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
55
flags = FIELD_DP32(flags, TBFLAG_A64, ZCR_LEN, zcr_len);
56
}
57
58
+ if (current_el == 0) {
59
+ /* FIXME: ARMv8.1-VHE S2 translation regime. */
60
+ sctlr = env->cp15.sctlr_el[1];
61
+ } else {
62
+ sctlr = env->cp15.sctlr_el[current_el];
63
+ }
64
if (cpu_isar_feature(aa64_pauth, cpu)) {
65
/*
66
* In order to save space in flags, we record only whether
67
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
68
* a nop, or "active" when some action must be performed.
69
* The decision of which action to take is left to a helper.
70
*/
71
- uint64_t sctlr;
72
- if (current_el == 0) {
73
- /* FIXME: ARMv8.1-VHE S2 translation regime. */
74
- sctlr = env->cp15.sctlr_el[1];
75
- } else {
76
- sctlr = env->cp15.sctlr_el[current_el];
77
- }
78
if (sctlr & (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
79
flags = FIELD_DP32(flags, TBFLAG_A64, PAUTH_ACTIVE, 1);
80
}
81
}
82
+
83
+ if (cpu_isar_feature(aa64_bti, cpu)) {
84
+ /* Note that SCTLR_EL[23].BT == SCTLR_BT1. */
85
+ if (sctlr & (current_el == 0 ? SCTLR_BT0 : SCTLR_BT1)) {
86
+ flags = FIELD_DP32(flags, TBFLAG_A64, BT, 1);
87
+ }
88
+ flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);
89
+ }
90
} else {
91
*pc = env->regs[15];
92
flags = FIELD_DP32(flags, TBFLAG_A32, THUMB, env->thumb);
93
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
94
index XXXXXXX..XXXXXXX 100644
95
--- a/target/arm/translate-a64.c
96
+++ b/target/arm/translate-a64.c
97
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
98
dc->sve_excp_el = FIELD_EX32(tb_flags, TBFLAG_A64, SVEEXC_EL);
99
dc->sve_len = (FIELD_EX32(tb_flags, TBFLAG_A64, ZCR_LEN) + 1) * 16;
100
dc->pauth_active = FIELD_EX32(tb_flags, TBFLAG_A64, PAUTH_ACTIVE);
101
+ dc->bt = FIELD_EX32(tb_flags, TBFLAG_A64, BT);
102
+ dc->btype = FIELD_EX32(tb_flags, TBFLAG_A64, BTYPE);
103
dc->vec_len = 0;
104
dc->vec_stride = 0;
105
dc->cp_regs = arm_cpu->cp_regs;
106
--
107
2.20.1
108
109
diff view generated by jsdifflib
[Qemu-devel] [PULL 04/22] exec: Add target-specific tlb bits to MemTxAttrs
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
These bits can be used to cache target-specific data in cputlb
4
read from the page tables.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Message-id: 20190128223118.5255-5-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
include/exec/memattrs.h | 10 ++++++++++
12
1 file changed, 10 insertions(+)
13
14
diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
15
index XXXXXXX..XXXXXXX 100644
16
--- a/include/exec/memattrs.h
17
+++ b/include/exec/memattrs.h
18
@@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs {
19
unsigned int user:1;
20
/* Requester ID (for MSI for example) */
21
unsigned int requester_id:16;
22
+ /*
23
+ * The following are target-specific page-table bits. These are not
24
+ * related to actual memory transactions at all. However, this structure
25
+ * is part of the tlb_fill interface, cached in the cputlb structure,
26
+ * and has unused bits. These fields will be read by target-specific
27
+ * helpers using env->iotlb[mmu_idx][tlb_index()].attrs.target_tlb_bitN.
28
+ */
29
+ unsigned int target_tlb_bit0 : 1;
30
+ unsigned int target_tlb_bit1 : 1;
31
+ unsigned int target_tlb_bit2 : 1;
32
} MemTxAttrs;
33
34
/* Bus masters which don't specify any attributes will get this,
35
--
36
2.20.1
37
38
diff view generated by jsdifflib
[Qemu-devel] [PULL 05/22] target/arm: Cache the GP bit for a page in MemTxAttrs
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Caching the bit means that we will not have to re-walk the
4
page tables to look up the bit during translation.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Message-id: 20190128223118.5255-6-richard.henderson@linaro.org
9
[PMM: no need to OR in guarded bit status]
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/helper.c | 6 ++++++
13
1 file changed, 6 insertions(+)
14
15
diff --git a/target/arm/helper.c b/target/arm/helper.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/helper.c
18
+++ b/target/arm/helper.c
19
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
20
bool ttbr1_valid;
21
uint64_t descaddrmask;
22
bool aarch64 = arm_el_is_aa64(env, el);
23
+ bool guarded = false;
24
25
/* TODO:
26
* This code does not handle the different format TCR for VTCR_EL2.
27
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
28
}
29
/* Merge in attributes from table descriptors */
30
attrs |= nstable << 3; /* NS */
31
+ guarded = extract64(descriptor, 50, 1); /* GP */
32
if (param.hpd) {
33
/* HPD disables all the table attributes except NSTable. */
34
break;
35
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
36
*/
37
txattrs->secure = false;
38
}
39
+ /* When in aarch64 mode, and BTI is enabled, remember GP in the IOTLB. */
40
+ if (aarch64 && guarded && cpu_isar_feature(aa64_bti, cpu)) {
41
+ txattrs->target_tlb_bit0 = true;
42
+ }
43
44
if (cacheattrs != NULL) {
45
if (mmu_idx == ARMMMUIdx_S2NS) {
46
--
47
2.20.1
48
49
diff view generated by jsdifflib
[Qemu-devel] [PULL 15/22] target/arm: Enable TBI for user-only
[Qemu-devel] [PULL 01/10] target/arm: report ARMv8-A FP support for AArch32 -cpu max
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Alex Bennée <alex.bennee@linaro.org>
2
2
3
This has been enabled in the linux kernel since v3.11
3
When we converted to using feature bits in 602f6e42cfbf we missed out
4
(commit d50240a5f6cea, 2013-09-03,
4
the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
5
"arm64: mm: permit use of tagged pointers at EL0").
5
-cpu max configurations. This caused a regression in the GCC test
6
suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
7
report ARMv8-A with FP support (but not ARMv8.2-FP16).
6
8
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
9
Message-id: 20190204132126.3255-5-richard.henderson@linaro.org
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
12
Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
14
---
12
target/arm/cpu.c | 6 ++++++
15
target/arm/cpu.c | 4 ++++
13
1 file changed, 6 insertions(+)
16
1 file changed, 4 insertions(+)
14
17
15
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
18
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
16
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/cpu.c
20
--- a/target/arm/cpu.c
18
+++ b/target/arm/cpu.c
21
+++ b/target/arm/cpu.c
19
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
22
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
20
env->vfp.zcr_el[1] = cpu->sve_max_vq - 1;
23
t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
21
env->vfp.zcr_el[2] = env->vfp.zcr_el[1];
24
cpu->isar.id_isar6 = t;
22
env->vfp.zcr_el[3] = env->vfp.zcr_el[1];
25
23
+ /*
26
+ t = cpu->isar.mvfr1;
24
+ * Enable TBI0 and TBI1. While the real kernel only enables TBI0,
27
+ t = FIELD_DP32(t, MVFR1, FPHP, 2); /* v8.0 FP support */
25
+ * turning on both here will produce smaller code and otherwise
28
+ cpu->isar.mvfr1 = t;
26
+ * make no difference to the user-level emulation.
29
+
27
+ */
30
t = cpu->isar.mvfr2;
28
+ env->cp15.tcr_el[1].raw_tcr = (3ULL << 37);
31
t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
29
#else
32
t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */
30
/* Reset into the highest available EL */
31
if (arm_feature(env, ARM_FEATURE_EL3)) {
32
--
33
--
33
2.20.1
34
2.20.1
34
35
35
36
diff view generated by jsdifflib
[Qemu-devel] [PULL 13/22] target/arm: Clean TBI for data operations in the translator
[Qemu-devel] [PULL 02/10] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
This will allow TBI to be used in user-only mode, as well as
3
In the next commit we will implement the write_with_attrs()
4
avoid ping-ponging the softmmu TLB when TBI is in use. It
4
handler. To avoid using different APIs, convert the read()
5
will also enable other armv8 extensions.
5
handler first.
6
6
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
9
Message-id: 20190204132126.3255-3-richard.henderson@linaro.org
9
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
11
---
12
target/arm/translate-a64.c | 217 ++++++++++++++++++++-----------------
12
hw/ssi/xilinx_spips.c | 23 +++++++++++------------
13
1 file changed, 116 insertions(+), 101 deletions(-)
13
1 file changed, 11 insertions(+), 12 deletions(-)
14
14
15
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
15
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
16
index XXXXXXX..XXXXXXX 100644
16
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/translate-a64.c
17
--- a/hw/ssi/xilinx_spips.c
18
+++ b/target/arm/translate-a64.c
18
+++ b/hw/ssi/xilinx_spips.c
19
@@ -XXX,XX +XXX,XX @@ static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
19
@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
20
gen_top_byte_ignore(s, cpu_pc, src, s->tbii);
21
}
22
23
+/*
24
+ * Return a "clean" address for ADDR according to TBID.
25
+ * This is always a fresh temporary, as we need to be able to
26
+ * increment this independently of a dirty write-back address.
27
+ */
28
+static TCGv_i64 clean_data_tbi(DisasContext *s, TCGv_i64 addr)
29
+{
30
+ TCGv_i64 clean = new_tmp_a64(s);
31
+ gen_top_byte_ignore(s, clean, addr, s->tbid);
32
+ return clean;
33
+}
34
+
35
typedef struct DisasCompare64 {
36
TCGCond cond;
37
TCGv_i64 value;
38
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap(DisasContext *s, int rs, int rt,
39
TCGv_i64 tcg_rs = cpu_reg(s, rs);
40
TCGv_i64 tcg_rt = cpu_reg(s, rt);
41
int memidx = get_mem_index(s);
42
- TCGv_i64 addr = cpu_reg_sp(s, rn);
43
+ TCGv_i64 clean_addr;
44
45
if (rn == 31) {
46
gen_check_sp_alignment(s);
47
}
48
- tcg_gen_atomic_cmpxchg_i64(tcg_rs, addr, tcg_rs, tcg_rt, memidx,
49
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
50
+ tcg_gen_atomic_cmpxchg_i64(tcg_rs, clean_addr, tcg_rs, tcg_rt, memidx,
51
size | MO_ALIGN | s->be_data);
52
}
53
54
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
55
TCGv_i64 s2 = cpu_reg(s, rs + 1);
56
TCGv_i64 t1 = cpu_reg(s, rt);
57
TCGv_i64 t2 = cpu_reg(s, rt + 1);
58
- TCGv_i64 addr = cpu_reg_sp(s, rn);
59
+ TCGv_i64 clean_addr;
60
int memidx = get_mem_index(s);
61
62
if (rn == 31) {
63
gen_check_sp_alignment(s);
64
}
65
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
66
67
if (size == 2) {
68
TCGv_i64 cmp = tcg_temp_new_i64();
69
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
70
tcg_gen_concat32_i64(cmp, s2, s1);
71
}
72
73
- tcg_gen_atomic_cmpxchg_i64(cmp, addr, cmp, val, memidx,
74
+ tcg_gen_atomic_cmpxchg_i64(cmp, clean_addr, cmp, val, memidx,
75
MO_64 | MO_ALIGN | s->be_data);
76
tcg_temp_free_i64(val);
77
78
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
79
if (HAVE_CMPXCHG128) {
80
TCGv_i32 tcg_rs = tcg_const_i32(rs);
81
if (s->be_data == MO_LE) {
82
- gen_helper_casp_le_parallel(cpu_env, tcg_rs, addr, t1, t2);
83
+ gen_helper_casp_le_parallel(cpu_env, tcg_rs,
84
+ clean_addr, t1, t2);
85
} else {
86
- gen_helper_casp_be_parallel(cpu_env, tcg_rs, addr, t1, t2);
87
+ gen_helper_casp_be_parallel(cpu_env, tcg_rs,
88
+ clean_addr, t1, t2);
89
}
90
tcg_temp_free_i32(tcg_rs);
91
} else {
92
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
93
TCGv_i64 zero = tcg_const_i64(0);
94
95
/* Load the two words, in memory order. */
96
- tcg_gen_qemu_ld_i64(d1, addr, memidx,
97
+ tcg_gen_qemu_ld_i64(d1, clean_addr, memidx,
98
MO_64 | MO_ALIGN_16 | s->be_data);
99
- tcg_gen_addi_i64(a2, addr, 8);
100
- tcg_gen_qemu_ld_i64(d2, addr, memidx, MO_64 | s->be_data);
101
+ tcg_gen_addi_i64(a2, clean_addr, 8);
102
+ tcg_gen_qemu_ld_i64(d2, clean_addr, memidx, MO_64 | s->be_data);
103
104
/* Compare the two words, also in memory order. */
105
tcg_gen_setcond_i64(TCG_COND_EQ, c1, d1, s1);
106
@@ -XXX,XX +XXX,XX @@ static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
107
/* If compare equal, write back new data, else write back old data. */
108
tcg_gen_movcond_i64(TCG_COND_NE, c1, c2, zero, t1, d1);
109
tcg_gen_movcond_i64(TCG_COND_NE, c2, c2, zero, t2, d2);
110
- tcg_gen_qemu_st_i64(c1, addr, memidx, MO_64 | s->be_data);
111
+ tcg_gen_qemu_st_i64(c1, clean_addr, memidx, MO_64 | s->be_data);
112
tcg_gen_qemu_st_i64(c2, a2, memidx, MO_64 | s->be_data);
113
tcg_temp_free_i64(a2);
114
tcg_temp_free_i64(c1);
115
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
116
int is_lasr = extract32(insn, 15, 1);
117
int o2_L_o1_o0 = extract32(insn, 21, 3) * 2 | is_lasr;
118
int size = extract32(insn, 30, 2);
119
- TCGv_i64 tcg_addr;
120
+ TCGv_i64 clean_addr;
121
122
switch (o2_L_o1_o0) {
123
case 0x0: /* STXR */
124
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
125
if (is_lasr) {
126
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
127
}
128
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
129
- gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, false);
130
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
131
+ gen_store_exclusive(s, rs, rt, rt2, clean_addr, size, false);
132
return;
133
134
case 0x4: /* LDXR */
135
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
136
if (rn == 31) {
137
gen_check_sp_alignment(s);
138
}
139
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
140
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
141
s->is_ldex = true;
142
- gen_load_exclusive(s, rt, rt2, tcg_addr, size, false);
143
+ gen_load_exclusive(s, rt, rt2, clean_addr, size, false);
144
if (is_lasr) {
145
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
146
}
147
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
148
gen_check_sp_alignment(s);
149
}
150
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
151
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
152
- do_gpr_st(s, cpu_reg(s, rt), tcg_addr, size, true, rt,
153
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
154
+ do_gpr_st(s, cpu_reg(s, rt), clean_addr, size, true, rt,
155
disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
156
return;
157
158
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
159
if (rn == 31) {
160
gen_check_sp_alignment(s);
161
}
162
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
163
- do_gpr_ld(s, cpu_reg(s, rt), tcg_addr, size, false, false, true, rt,
164
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
165
+ do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, false, true, rt,
166
disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
167
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
168
return;
169
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
170
if (is_lasr) {
171
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
172
}
173
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
174
- gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, true);
175
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
176
+ gen_store_exclusive(s, rs, rt, rt2, clean_addr, size, true);
177
return;
178
}
179
if (rt2 == 31
180
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
181
if (rn == 31) {
182
gen_check_sp_alignment(s);
183
}
184
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
185
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
186
s->is_ldex = true;
187
- gen_load_exclusive(s, rt, rt2, tcg_addr, size, true);
188
+ gen_load_exclusive(s, rt, rt2, clean_addr, size, true);
189
if (is_lasr) {
190
tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
191
}
192
@@ -XXX,XX +XXX,XX @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
193
int opc = extract32(insn, 30, 2);
194
bool is_signed = false;
195
int size = 2;
196
- TCGv_i64 tcg_rt, tcg_addr;
197
+ TCGv_i64 tcg_rt, clean_addr;
198
199
if (is_vector) {
200
if (opc == 3) {
201
@@ -XXX,XX +XXX,XX @@ static void disas_ld_lit(DisasContext *s, uint32_t insn)
202
203
tcg_rt = cpu_reg(s, rt);
204
205
- tcg_addr = tcg_const_i64((s->pc - 4) + imm);
206
+ clean_addr = tcg_const_i64((s->pc - 4) + imm);
207
if (is_vector) {
208
- do_fp_ld(s, rt, tcg_addr, size);
209
+ do_fp_ld(s, rt, clean_addr, size);
210
} else {
211
/* Only unsigned 32bit loads target 32bit registers. */
212
bool iss_sf = opc != 0;
213
214
- do_gpr_ld(s, tcg_rt, tcg_addr, size, is_signed, false,
215
+ do_gpr_ld(s, tcg_rt, clean_addr, size, is_signed, false,
216
true, rt, iss_sf, false);
217
}
218
- tcg_temp_free_i64(tcg_addr);
219
+ tcg_temp_free_i64(clean_addr);
220
}
221
222
/*
223
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pair(DisasContext *s, uint32_t insn)
224
bool postindex = false;
225
bool wback = false;
226
227
- TCGv_i64 tcg_addr; /* calculated address */
228
+ TCGv_i64 clean_addr, dirty_addr;
229
+
230
int size;
231
232
if (opc == 3) {
233
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pair(DisasContext *s, uint32_t insn)
234
gen_check_sp_alignment(s);
235
}
236
237
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
238
-
239
+ dirty_addr = read_cpu_reg_sp(s, rn, 1);
240
if (!postindex) {
241
- tcg_gen_addi_i64(tcg_addr, tcg_addr, offset);
242
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
243
}
244
+ clean_addr = clean_data_tbi(s, dirty_addr);
245
246
if (is_vector) {
247
if (is_load) {
248
- do_fp_ld(s, rt, tcg_addr, size);
249
+ do_fp_ld(s, rt, clean_addr, size);
250
} else {
251
- do_fp_st(s, rt, tcg_addr, size);
252
+ do_fp_st(s, rt, clean_addr, size);
253
}
254
- tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size);
255
+ tcg_gen_addi_i64(clean_addr, clean_addr, 1 << size);
256
if (is_load) {
257
- do_fp_ld(s, rt2, tcg_addr, size);
258
+ do_fp_ld(s, rt2, clean_addr, size);
259
} else {
260
- do_fp_st(s, rt2, tcg_addr, size);
261
+ do_fp_st(s, rt2, clean_addr, size);
262
}
263
} else {
264
TCGv_i64 tcg_rt = cpu_reg(s, rt);
265
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pair(DisasContext *s, uint32_t insn)
266
/* Do not modify tcg_rt before recognizing any exception
267
* from the second load.
268
*/
269
- do_gpr_ld(s, tmp, tcg_addr, size, is_signed, false,
270
+ do_gpr_ld(s, tmp, clean_addr, size, is_signed, false,
271
false, 0, false, false);
272
- tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size);
273
- do_gpr_ld(s, tcg_rt2, tcg_addr, size, is_signed, false,
274
+ tcg_gen_addi_i64(clean_addr, clean_addr, 1 << size);
275
+ do_gpr_ld(s, tcg_rt2, clean_addr, size, is_signed, false,
276
false, 0, false, false);
277
278
tcg_gen_mov_i64(tcg_rt, tmp);
279
tcg_temp_free_i64(tmp);
280
} else {
281
- do_gpr_st(s, tcg_rt, tcg_addr, size,
282
+ do_gpr_st(s, tcg_rt, clean_addr, size,
283
false, 0, false, false);
284
- tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size);
285
- do_gpr_st(s, tcg_rt2, tcg_addr, size,
286
+ tcg_gen_addi_i64(clean_addr, clean_addr, 1 << size);
287
+ do_gpr_st(s, tcg_rt2, clean_addr, size,
288
false, 0, false, false);
289
}
290
}
291
292
if (wback) {
293
if (postindex) {
294
- tcg_gen_addi_i64(tcg_addr, tcg_addr, offset - (1 << size));
295
- } else {
296
- tcg_gen_subi_i64(tcg_addr, tcg_addr, 1 << size);
297
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
298
}
299
- tcg_gen_mov_i64(cpu_reg_sp(s, rn), tcg_addr);
300
+ tcg_gen_mov_i64(cpu_reg_sp(s, rn), dirty_addr);
301
}
20
}
302
}
21
}
303
22
304
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
23
-static uint64_t
305
bool post_index;
24
-lqspi_read(void *opaque, hwaddr addr, unsigned int size)
306
bool writeback;
25
+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
307
26
+ unsigned size, MemTxAttrs attrs)
308
- TCGv_i64 tcg_addr;
27
{
309
+ TCGv_i64 clean_addr, dirty_addr;
28
- XilinxQSPIPS *q = opaque;
310
29
- uint32_t ret;
311
if (is_vector) {
30
+ XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
312
size |= (opc & 2) << 1;
31
313
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
32
if (addr >= q->lqspi_cached_addr &&
314
if (rn == 31) {
33
addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
315
gen_check_sp_alignment(s);
34
uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
35
- ret = cpu_to_le32(*(uint32_t *)retp);
36
- DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
37
- (unsigned)ret);
38
- return ret;
39
- } else {
40
- lqspi_load_cache(opaque, addr);
41
- return lqspi_read(opaque, addr, size);
42
+ *value = cpu_to_le32(*(uint32_t *)retp);
43
+ DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
44
+ addr, *value);
45
+ return MEMTX_OK;
316
}
46
}
317
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
47
+
318
48
+ lqspi_load_cache(opaque, addr);
319
+ dirty_addr = read_cpu_reg_sp(s, rn, 1);
49
+ return lqspi_read(opaque, addr, value, size, attrs);
320
if (!post_index) {
321
- tcg_gen_addi_i64(tcg_addr, tcg_addr, imm9);
322
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, imm9);
323
}
324
+ clean_addr = clean_data_tbi(s, dirty_addr);
325
326
if (is_vector) {
327
if (is_store) {
328
- do_fp_st(s, rt, tcg_addr, size);
329
+ do_fp_st(s, rt, clean_addr, size);
330
} else {
331
- do_fp_ld(s, rt, tcg_addr, size);
332
+ do_fp_ld(s, rt, clean_addr, size);
333
}
334
} else {
335
TCGv_i64 tcg_rt = cpu_reg(s, rt);
336
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
337
bool iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
338
339
if (is_store) {
340
- do_gpr_st_memidx(s, tcg_rt, tcg_addr, size, memidx,
341
+ do_gpr_st_memidx(s, tcg_rt, clean_addr, size, memidx,
342
iss_valid, rt, iss_sf, false);
343
} else {
344
- do_gpr_ld_memidx(s, tcg_rt, tcg_addr, size,
345
+ do_gpr_ld_memidx(s, tcg_rt, clean_addr, size,
346
is_signed, is_extended, memidx,
347
iss_valid, rt, iss_sf, false);
348
}
349
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
350
if (writeback) {
351
TCGv_i64 tcg_rn = cpu_reg_sp(s, rn);
352
if (post_index) {
353
- tcg_gen_addi_i64(tcg_addr, tcg_addr, imm9);
354
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, imm9);
355
}
356
- tcg_gen_mov_i64(tcg_rn, tcg_addr);
357
+ tcg_gen_mov_i64(tcg_rn, dirty_addr);
358
}
359
}
50
}
360
51
361
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_roffset(DisasContext *s, uint32_t insn,
52
static const MemoryRegionOps lqspi_ops = {
362
bool is_store = false;
53
- .read = lqspi_read,
363
bool is_extended = false;
54
+ .read_with_attrs = lqspi_read,
364
55
.endianness = DEVICE_NATIVE_ENDIAN,
365
- TCGv_i64 tcg_rm;
56
.valid = {
366
- TCGv_i64 tcg_addr;
57
.min_access_size = 1,
367
+ TCGv_i64 tcg_rm, clean_addr, dirty_addr;
368
369
if (extract32(opt, 1, 1) == 0) {
370
unallocated_encoding(s);
371
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_roffset(DisasContext *s, uint32_t insn,
372
if (rn == 31) {
373
gen_check_sp_alignment(s);
374
}
375
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
376
+ dirty_addr = read_cpu_reg_sp(s, rn, 1);
377
378
tcg_rm = read_cpu_reg(s, rm, 1);
379
ext_and_shift_reg(tcg_rm, tcg_rm, opt, shift ? size : 0);
380
381
- tcg_gen_add_i64(tcg_addr, tcg_addr, tcg_rm);
382
+ tcg_gen_add_i64(dirty_addr, dirty_addr, tcg_rm);
383
+ clean_addr = clean_data_tbi(s, dirty_addr);
384
385
if (is_vector) {
386
if (is_store) {
387
- do_fp_st(s, rt, tcg_addr, size);
388
+ do_fp_st(s, rt, clean_addr, size);
389
} else {
390
- do_fp_ld(s, rt, tcg_addr, size);
391
+ do_fp_ld(s, rt, clean_addr, size);
392
}
393
} else {
394
TCGv_i64 tcg_rt = cpu_reg(s, rt);
395
bool iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
396
if (is_store) {
397
- do_gpr_st(s, tcg_rt, tcg_addr, size,
398
+ do_gpr_st(s, tcg_rt, clean_addr, size,
399
true, rt, iss_sf, false);
400
} else {
401
- do_gpr_ld(s, tcg_rt, tcg_addr, size,
402
+ do_gpr_ld(s, tcg_rt, clean_addr, size,
403
is_signed, is_extended,
404
true, rt, iss_sf, false);
405
}
406
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_unsigned_imm(DisasContext *s, uint32_t insn,
407
unsigned int imm12 = extract32(insn, 10, 12);
408
unsigned int offset;
409
410
- TCGv_i64 tcg_addr;
411
+ TCGv_i64 clean_addr, dirty_addr;
412
413
bool is_store;
414
bool is_signed = false;
415
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_unsigned_imm(DisasContext *s, uint32_t insn,
416
if (rn == 31) {
417
gen_check_sp_alignment(s);
418
}
419
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
420
+ dirty_addr = read_cpu_reg_sp(s, rn, 1);
421
offset = imm12 << size;
422
- tcg_gen_addi_i64(tcg_addr, tcg_addr, offset);
423
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
424
+ clean_addr = clean_data_tbi(s, dirty_addr);
425
426
if (is_vector) {
427
if (is_store) {
428
- do_fp_st(s, rt, tcg_addr, size);
429
+ do_fp_st(s, rt, clean_addr, size);
430
} else {
431
- do_fp_ld(s, rt, tcg_addr, size);
432
+ do_fp_ld(s, rt, clean_addr, size);
433
}
434
} else {
435
TCGv_i64 tcg_rt = cpu_reg(s, rt);
436
bool iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
437
if (is_store) {
438
- do_gpr_st(s, tcg_rt, tcg_addr, size,
439
+ do_gpr_st(s, tcg_rt, clean_addr, size,
440
true, rt, iss_sf, false);
441
} else {
442
- do_gpr_ld(s, tcg_rt, tcg_addr, size, is_signed, is_extended,
443
+ do_gpr_ld(s, tcg_rt, clean_addr, size, is_signed, is_extended,
444
true, rt, iss_sf, false);
445
}
446
}
447
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
448
int rs = extract32(insn, 16, 5);
449
int rn = extract32(insn, 5, 5);
450
int o3_opc = extract32(insn, 12, 4);
451
- TCGv_i64 tcg_rn, tcg_rs;
452
+ TCGv_i64 tcg_rs, clean_addr;
453
AtomicThreeOpFn *fn;
454
455
if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
456
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
457
if (rn == 31) {
458
gen_check_sp_alignment(s);
459
}
460
- tcg_rn = cpu_reg_sp(s, rn);
461
+ clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
462
tcg_rs = read_cpu_reg(s, rs, true);
463
464
if (o3_opc == 1) { /* LDCLR */
465
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
466
/* The tcg atomic primitives are all full barriers. Therefore we
467
* can ignore the Acquire and Release bits of this instruction.
468
*/
469
- fn(cpu_reg(s, rt), tcg_rn, tcg_rs, get_mem_index(s),
470
+ fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
471
s->be_data | size | MO_ALIGN);
472
}
473
474
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pac(DisasContext *s, uint32_t insn,
475
bool is_wback = extract32(insn, 11, 1);
476
bool use_key_a = !extract32(insn, 23, 1);
477
int offset;
478
- TCGv_i64 tcg_addr, tcg_rt;
479
+ TCGv_i64 clean_addr, dirty_addr, tcg_rt;
480
481
if (size != 3 || is_vector || !dc_isar_feature(aa64_pauth, s)) {
482
unallocated_encoding(s);
483
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pac(DisasContext *s, uint32_t insn,
484
if (rn == 31) {
485
gen_check_sp_alignment(s);
486
}
487
- tcg_addr = read_cpu_reg_sp(s, rn, 1);
488
+ dirty_addr = read_cpu_reg_sp(s, rn, 1);
489
490
if (s->pauth_active) {
491
if (use_key_a) {
492
- gen_helper_autda(tcg_addr, cpu_env, tcg_addr, cpu_X[31]);
493
+ gen_helper_autda(dirty_addr, cpu_env, dirty_addr, cpu_X[31]);
494
} else {
495
- gen_helper_autdb(tcg_addr, cpu_env, tcg_addr, cpu_X[31]);
496
+ gen_helper_autdb(dirty_addr, cpu_env, dirty_addr, cpu_X[31]);
497
}
498
}
499
500
/* Form the 10-bit signed, scaled offset. */
501
offset = (extract32(insn, 22, 1) << 9) | extract32(insn, 12, 9);
502
offset = sextract32(offset << size, 0, 10 + size);
503
- tcg_gen_addi_i64(tcg_addr, tcg_addr, offset);
504
+ tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
505
+
506
+ /* Note that "clean" and "dirty" here refer to TBI not PAC. */
507
+ clean_addr = clean_data_tbi(s, dirty_addr);
508
509
tcg_rt = cpu_reg(s, rt);
510
-
511
- do_gpr_ld(s, tcg_rt, tcg_addr, size, /* is_signed */ false,
512
+ do_gpr_ld(s, tcg_rt, clean_addr, size, /* is_signed */ false,
513
/* extend */ false, /* iss_valid */ !is_wback,
514
/* iss_srt */ rt, /* iss_sf */ true, /* iss_ar */ false);
515
516
if (is_wback) {
517
- tcg_gen_mov_i64(cpu_reg_sp(s, rn), tcg_addr);
518
+ tcg_gen_mov_i64(cpu_reg_sp(s, rn), dirty_addr);
519
}
520
}
521
522
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
523
bool is_store = !extract32(insn, 22, 1);
524
bool is_postidx = extract32(insn, 23, 1);
525
bool is_q = extract32(insn, 30, 1);
526
- TCGv_i64 tcg_addr, tcg_rn, tcg_ebytes;
527
+ TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
528
TCGMemOp endian = s->be_data;
529
530
int ebytes; /* bytes per element */
531
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
532
elements = (is_q ? 16 : 8) / ebytes;
533
534
tcg_rn = cpu_reg_sp(s, rn);
535
- tcg_addr = tcg_temp_new_i64();
536
- tcg_gen_mov_i64(tcg_addr, tcg_rn);
537
+ clean_addr = clean_data_tbi(s, tcg_rn);
538
tcg_ebytes = tcg_const_i64(ebytes);
539
540
for (r = 0; r < rpt; r++) {
541
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
542
for (xs = 0; xs < selem; xs++) {
543
int tt = (rt + r + xs) % 32;
544
if (is_store) {
545
- do_vec_st(s, tt, e, tcg_addr, size, endian);
546
+ do_vec_st(s, tt, e, clean_addr, size, endian);
547
} else {
548
- do_vec_ld(s, tt, e, tcg_addr, size, endian);
549
+ do_vec_ld(s, tt, e, clean_addr, size, endian);
550
}
551
- tcg_gen_add_i64(tcg_addr, tcg_addr, tcg_ebytes);
552
+ tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
553
}
554
}
555
}
556
+ tcg_temp_free_i64(tcg_ebytes);
557
558
if (!is_store) {
559
/* For non-quad operations, setting a slice of the low
560
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
561
562
if (is_postidx) {
563
if (rm == 31) {
564
- tcg_gen_mov_i64(tcg_rn, tcg_addr);
565
+ tcg_gen_addi_i64(tcg_rn, tcg_rn, rpt * elements * selem * ebytes);
566
} else {
567
tcg_gen_add_i64(tcg_rn, tcg_rn, cpu_reg(s, rm));
568
}
569
}
570
- tcg_temp_free_i64(tcg_ebytes);
571
- tcg_temp_free_i64(tcg_addr);
572
}
573
574
/* AdvSIMD load/store single structure
575
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
576
bool replicate = false;
577
int index = is_q << 3 | S << 2 | size;
578
int ebytes, xs;
579
- TCGv_i64 tcg_addr, tcg_rn, tcg_ebytes;
580
+ TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;
581
582
if (extract32(insn, 31, 1)) {
583
unallocated_encoding(s);
584
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
585
}
586
587
tcg_rn = cpu_reg_sp(s, rn);
588
- tcg_addr = tcg_temp_new_i64();
589
- tcg_gen_mov_i64(tcg_addr, tcg_rn);
590
+ clean_addr = clean_data_tbi(s, tcg_rn);
591
tcg_ebytes = tcg_const_i64(ebytes);
592
593
for (xs = 0; xs < selem; xs++) {
594
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
595
/* Load and replicate to all elements */
596
TCGv_i64 tcg_tmp = tcg_temp_new_i64();
597
598
- tcg_gen_qemu_ld_i64(tcg_tmp, tcg_addr,
599
+ tcg_gen_qemu_ld_i64(tcg_tmp, clean_addr,
600
get_mem_index(s), s->be_data + scale);
601
tcg_gen_gvec_dup_i64(scale, vec_full_reg_offset(s, rt),
602
(is_q + 1) * 8, vec_full_reg_size(s),
603
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
604
} else {
605
/* Load/store one element per register */
606
if (is_load) {
607
- do_vec_ld(s, rt, index, tcg_addr, scale, s->be_data);
608
+ do_vec_ld(s, rt, index, clean_addr, scale, s->be_data);
609
} else {
610
- do_vec_st(s, rt, index, tcg_addr, scale, s->be_data);
611
+ do_vec_st(s, rt, index, clean_addr, scale, s->be_data);
612
}
613
}
614
- tcg_gen_add_i64(tcg_addr, tcg_addr, tcg_ebytes);
615
+ tcg_gen_add_i64(clean_addr, clean_addr, tcg_ebytes);
616
rt = (rt + 1) % 32;
617
}
618
+ tcg_temp_free_i64(tcg_ebytes);
619
620
if (is_postidx) {
621
if (rm == 31) {
622
- tcg_gen_mov_i64(tcg_rn, tcg_addr);
623
+ tcg_gen_addi_i64(tcg_rn, tcg_rn, selem * ebytes);
624
} else {
625
tcg_gen_add_i64(tcg_rn, tcg_rn, cpu_reg(s, rm));
626
}
627
}
628
- tcg_temp_free_i64(tcg_ebytes);
629
- tcg_temp_free_i64(tcg_addr);
630
}
631
632
/* Loads and stores */
633
--
58
--
634
2.20.1
59
2.20.1
635
60
636
61
diff view generated by jsdifflib
[Qemu-devel] [PULL 08/22] target/arm: Set btype for indirect branches
[Qemu-devel] [PULL 03/10] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
3
Lei Sun found while auditing the code that a CPU write would
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
4
trigger a NULL pointer dereference.
5
Message-id: 20190128223118.5255-9-richard.henderson@linaro.org
5
6
>From UG1085 datasheet [*] AXI writes in this region are ignored
7
and generates an AXI Slave Error (SLVERR).
8
9
Fix by implementing the write_with_attrs() handler.
10
Return MEMTX_ERROR when the region is accessed (this error maps
11
to an AXI slave error).
12
13
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
14
15
Reported-by: Lei Sun <slei.casper@gmail.com>
16
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
17
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
18
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
20
---
8
target/arm/translate-a64.c | 37 ++++++++++++++++++++++++++++++++++++-
21
hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
9
1 file changed, 36 insertions(+), 1 deletion(-)
22
1 file changed, 16 insertions(+)
10
23
11
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
24
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
12
index XXXXXXX..XXXXXXX 100644
25
index XXXXXXX..XXXXXXX 100644
13
--- a/target/arm/translate-a64.c
26
--- a/hw/ssi/xilinx_spips.c
14
+++ b/target/arm/translate-a64.c
27
+++ b/hw/ssi/xilinx_spips.c
15
@@ -XXX,XX +XXX,XX @@ static void reset_btype(DisasContext *s)
28
@@ -XXX,XX +XXX,XX @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
16
}
29
return lqspi_read(opaque, addr, value, size, attrs);
17
}
30
}
18
31
19
+static void set_btype(DisasContext *s, int val)
32
+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
33
+ unsigned size, MemTxAttrs attrs)
20
+{
34
+{
21
+ TCGv_i32 tcg_val;
35
+ /*
36
+ * From UG1085, Chapter 24 (Quad-SPI controllers):
37
+ * - Writes are ignored
38
+ * - AXI writes generate an external AXI slave error (SLVERR)
39
+ */
40
+ qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
41
+ " (value: 0x%" PRIx64 "\n",
42
+ __func__, size << 3, offset, value);
22
+
43
+
23
+ /* BTYPE is a 2-bit field, and 0 should be done with reset_btype. */
44
+ return MEMTX_ERROR;
24
+ tcg_debug_assert(val >= 1 && val <= 3);
25
+
26
+ tcg_val = tcg_const_i32(val);
27
+ tcg_gen_st_i32(tcg_val, cpu_env, offsetof(CPUARMState, btype));
28
+ tcg_temp_free_i32(tcg_val);
29
+ s->btype = -1;
30
+}
45
+}
31
+
46
+
32
void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
47
static const MemoryRegionOps lqspi_ops = {
33
fprintf_function cpu_fprintf, int flags)
48
.read_with_attrs = lqspi_read,
34
{
49
+ .write_with_attrs = lqspi_write,
35
@@ -XXX,XX +XXX,XX @@ static void disas_exc(DisasContext *s, uint32_t insn)
50
.endianness = DEVICE_NATIVE_ENDIAN,
36
static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
51
.valid = {
37
{
52
.min_access_size = 1,
38
unsigned int opc, op2, op3, rn, op4;
39
+ unsigned btype_mod = 2; /* 0: BR, 1: BLR, 2: other */
40
TCGv_i64 dst;
41
TCGv_i64 modifier;
42
43
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
44
case 0: /* BR */
45
case 1: /* BLR */
46
case 2: /* RET */
47
+ btype_mod = opc;
48
switch (op3) {
49
case 0:
50
/* BR, BLR, RET */
51
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
52
default:
53
goto do_unallocated;
54
}
55
-
56
gen_a64_set_pc(s, dst);
57
/* BLR also needs to load return address */
58
if (opc == 1) {
59
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
60
if ((op3 & ~1) != 2) {
61
goto do_unallocated;
62
}
63
+ btype_mod = opc & 1;
64
if (s->pauth_active) {
65
dst = new_tmp_a64(s);
66
modifier = cpu_reg_sp(s, op4);
67
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
68
return;
69
}
70
71
+ switch (btype_mod) {
72
+ case 0: /* BR */
73
+ if (dc_isar_feature(aa64_bti, s)) {
74
+ /* BR to {x16,x17} or !guard -> 1, else 3. */
75
+ set_btype(s, rn == 16 || rn == 17 || !s->guarded_page ? 1 : 3);
76
+ }
77
+ break;
78
+
79
+ case 1: /* BLR */
80
+ if (dc_isar_feature(aa64_bti, s)) {
81
+ /* BLR sets BTYPE to 2, regardless of source guarded page. */
82
+ set_btype(s, 2);
83
+ }
84
+ break;
85
+
86
+ default: /* RET or none of the above. */
87
+ /* BTYPE will be set to 0 by normal end-of-insn processing. */
88
+ break;
89
+ }
90
+
91
s->base.is_jmp = DISAS_JUMP;
92
}
93
94
--
53
--
95
2.20.1
54
2.20.1
96
55
97
56
diff view generated by jsdifflib
[Qemu-devel] [PULL 09/22] target/arm: Enable BTI for -cpu max
[Qemu-devel] [PULL 04/10] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
3
Both lqspi_read() and lqspi_load_cache() expect a 32-bit
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
4
aligned address.
5
Message-id: 20190128223118.5255-11-richard.henderson@linaro.org
5
6
>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':
7
8
Transfer Size Limitations
9
10
Because of the 32-bit wide TX, RX, and generic FIFO, all
11
APB/AXI transfers must be an integer multiple of 4-bytes.
12
Shorter transfers are not possible.
13
14
Set MemoryRegionOps.impl values to force 32-bit accesses,
15
this way we are sure we do not access the lqspi_buf[] array
16
out of bound.
17
18
[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
19
20
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
21
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
22
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
24
---
8
target/arm/cpu64.c | 4 ++++
25
hw/ssi/xilinx_spips.c | 4 ++++
9
1 file changed, 4 insertions(+)
26
1 file changed, 4 insertions(+)
10
27
11
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
28
diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
12
index XXXXXXX..XXXXXXX 100644
29
index XXXXXXX..XXXXXXX 100644
13
--- a/target/arm/cpu64.c
30
--- a/hw/ssi/xilinx_spips.c
14
+++ b/target/arm/cpu64.c
31
+++ b/hw/ssi/xilinx_spips.c
15
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
32
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps lqspi_ops = {
16
t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);
33
.read_with_attrs = lqspi_read,
17
cpu->isar.id_aa64pfr0 = t;
34
.write_with_attrs = lqspi_write,
18
35
.endianness = DEVICE_NATIVE_ENDIAN,
19
+ t = cpu->isar.id_aa64pfr1;
36
+ .impl = {
20
+ t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);
37
+ .min_access_size = 4,
21
+ cpu->isar.id_aa64pfr1 = t;
38
+ .max_access_size = 4,
22
+
39
+ },
23
t = cpu->isar.id_aa64mmfr1;
40
.valid = {
24
t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
41
.min_access_size = 1,
25
t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
42
.max_access_size = 4
26
--
43
--
27
2.20.1
44
2.20.1
28
45
29
46
diff view generated by jsdifflib
[Qemu-devel] [PULL 16/22] gdbstub: allow killing QEMU via vKill command
[Qemu-devel] [PULL 05/10] hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
1
From: Max Filippov <jcmvbkbc@gmail.com>
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
With multiprocess extensions gdb uses 'vKill' packet instead of 'k' to
3
Reading the RX_DATA register when the RX_FIFO is empty triggers
4
kill the inferior. Handle 'vKill' the same way 'k' was handled in the
4
an abort. This can be easily reproduced:
5
presence of single process.
6
5
7
Fixes: 7cf48f6752e5 ("gdbstub: add multiprocess support to
6
$ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
8
(f|s)ThreadInfo and ThreadExtraInfo")
7
QEMU 4.0.50 monitor - type 'help' for more information
8
(qemu) x 0x40001010
9
Aborted (core dumped)
9
10
10
Cc: Luc Michel <luc.michel@greensocs.com>
11
(gdb) bt
11
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
12
#1 0x00007f035874f895 in abort () at /lib64/libc.so.6
12
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
13
#2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
13
Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
14
#3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
14
Tested-by: KONRAD Frederic <frederic.konrad@adacore.com>
15
#4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
15
Message-id: 20190130192403.13754-1-jcmvbkbc@gmail.com
16
#5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
17
#6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
18
#7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
19
#8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
20
#9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
21
#10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
22
#11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
23
#12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
24
#13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
25
#14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
26
#15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
27
#16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082
28
29
From the datasheet "Actel SmartFusion Microcontroller Subsystem
30
User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
31
register has a reset value of 0.
32
33
Check the FIFO is not empty before accessing it, else log an
34
error message.
35
36
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
37
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
38
Message-id: 20190709113715.7761-3-philmd@redhat.com
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
39
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
---
40
---
18
gdbstub.c | 4 ++++
41
hw/ssi/mss-spi.c | 8 +++++++-
19
1 file changed, 4 insertions(+)
42
1 file changed, 7 insertions(+), 1 deletion(-)
20
43
21
diff --git a/gdbstub.c b/gdbstub.c
44
diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
22
index XXXXXXX..XXXXXXX 100644
45
index XXXXXXX..XXXXXXX 100644
23
--- a/gdbstub.c
46
--- a/hw/ssi/mss-spi.c
24
+++ b/gdbstub.c
47
+++ b/hw/ssi/mss-spi.c
25
@@ -XXX,XX +XXX,XX @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
48
@@ -XXX,XX +XXX,XX @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
26
49
case R_SPI_RX:
27
put_packet(s, buf);
50
s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
28
break;
51
s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
29
+ } else if (strncmp(p, "Kill;", 5) == 0) {
52
- ret = fifo32_pop(&s->rx_fifo);
30
+ /* Kill the target */
53
+ if (fifo32_is_empty(&s->rx_fifo)) {
31
+ error_report("QEMU: Terminated via GDBstub");
54
+ qemu_log_mask(LOG_GUEST_ERROR,
32
+ exit(0);
55
+ "%s: Reading empty RX_FIFO\n",
33
} else {
56
+ __func__);
34
goto unknown_command;
57
+ } else {
58
+ ret = fifo32_pop(&s->rx_fifo);
59
+ }
60
if (fifo32_is_empty(&s->rx_fifo)) {
61
s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
35
}
62
}
36
--
63
--
37
2.20.1
64
2.20.1
38
65
39
66
diff view generated by jsdifflib
[Qemu-devel] [PULL 14/22] target/arm: Compute TB_FLAGS for TBI for user-only
[Qemu-devel] [PULL 06/10] hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
1
Enables, but does not turn on, TBI for CONFIG_USER_ONLY.
1
From: Philippe Mathieu-Daudé <philmd@redhat.com>
2
2
3
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
3
In the previous commit we fixed a crash when the guest read a
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
4
register that pop from an empty FIFO.
5
Message-id: 20190204132126.3255-4-richard.henderson@linaro.org
5
By auditing the repository, we found another similar use with
6
[PMM: adjusted #ifdeffery to placate clang, which otherwise complains
6
an easy way to reproduce:
7
about static functions that are unused in the CONFIG_USER_ONLY build]
7
8
$ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
9
QEMU 4.0.50 monitor - type 'help' for more information
10
(qemu) xp/b 0xfd4a0134
11
Aborted (core dumped)
12
13
(gdb) bt
14
#0 0x00007f6936dea57f in raise () at /lib64/libc.so.6
15
#1 0x00007f6936dd4895 in abort () at /lib64/libc.so.6
16
#2 0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
17
#3 0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
18
#4 0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
19
#5 0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
20
#6 0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
21
#7 0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
22
#8 0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
23
#9 0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
24
#10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
25
#11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
26
#12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
27
#13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
28
#14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082
29
30
Fix by checking the FIFO is not empty before popping from it.
31
32
The datasheet is not clear about the reset value of this register,
33
we choose to return '0'.
34
35
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
36
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
37
Message-id: 20190709113715.7761-4-philmd@redhat.com
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
38
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
39
---
10
target/arm/internals.h | 21 --------------------
40
hw/display/xlnx_dp.c | 15 +++++++++++----
11
target/arm/helper.c | 45 ++++++++++++++++++++++--------------------
41
1 file changed, 11 insertions(+), 4 deletions(-)
12
2 files changed, 24 insertions(+), 42 deletions(-)
13
42
14
diff --git a/target/arm/internals.h b/target/arm/internals.h
43
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
15
index XXXXXXX..XXXXXXX 100644
44
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/internals.h
45
--- a/hw/display/xlnx_dp.c
17
+++ b/target/arm/internals.h
46
+++ b/hw/display/xlnx_dp.c
18
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
47
@@ -XXX,XX +XXX,XX @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
19
bool using64k : 1;
48
uint8_t ret;
20
} ARMVAParameters;
49
21
50
if (fifo8_is_empty(&s->rx_fifo)) {
22
-#ifdef CONFIG_USER_ONLY
51
- DPRINTF("rx_fifo underflow..\n");
23
-static inline ARMVAParameters aa64_va_parameters_both(CPUARMState *env,
52
- abort();
24
- uint64_t va,
53
+ qemu_log_mask(LOG_GUEST_ERROR,
25
- ARMMMUIdx mmu_idx)
54
+ "%s: Reading empty RX_FIFO\n",
26
-{
55
+ __func__);
27
- return (ARMVAParameters) {
56
+ /*
28
- /* 48-bit address space */
57
+ * The datasheet is not clear about the reset value, it seems
29
- .tsz = 16,
58
+ * to be unspecified. We choose to return '0'.
30
- /* We can't handle tagged addresses properly in user-only mode */
59
+ */
31
- .tbi = false,
60
+ ret = 0;
32
- };
61
+ } else {
33
-}
62
+ ret = fifo8_pop(&s->rx_fifo);
34
-
63
+ DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
35
-static inline ARMVAParameters aa64_va_parameters(CPUARMState *env,
36
- uint64_t va,
37
- ARMMMUIdx mmu_idx, bool data)
38
-{
39
- return aa64_va_parameters_both(env, va, mmu_idx);
40
-}
41
-#else
42
ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
43
ARMMMUIdx mmu_idx);
44
ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
45
ARMMMUIdx mmu_idx, bool data);
46
-#endif
47
48
#endif
49
diff --git a/target/arm/helper.c b/target/arm/helper.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/target/arm/helper.c
52
+++ b/target/arm/helper.c
53
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rbit)(uint32_t x)
54
return revbit32(x);
55
}
56
57
-#if defined(CONFIG_USER_ONLY)
58
+#ifdef CONFIG_USER_ONLY
59
60
/* These should probably raise undefined insn exceptions. */
61
void HELPER(v7m_msr)(CPUARMState *env, uint32_t reg, uint32_t val)
62
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
63
cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
64
}
64
}
65
}
65
- ret = fifo8_pop(&s->rx_fifo);
66
+#endif /* !CONFIG_USER_ONLY */
66
- DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
67
68
/* Return the exception level which controls this address translation regime */
69
static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
70
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
71
}
72
}
73
74
+#ifndef CONFIG_USER_ONLY
75
+
76
/* Return the SCTLR value which controls this address translation regime */
77
static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
78
{
79
@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_big_endian(CPUARMState *env,
80
return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
81
}
82
83
+/* Return the TTBR associated with this translation regime */
84
+static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
85
+ int ttbrn)
86
+{
87
+ if (mmu_idx == ARMMMUIdx_S2NS) {
88
+ return env->cp15.vttbr_el2;
89
+ }
90
+ if (ttbrn == 0) {
91
+ return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
92
+ } else {
93
+ return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
94
+ }
95
+}
96
+
97
+#endif /* !CONFIG_USER_ONLY */
98
+
99
/* Return the TCR controlling this translation regime */
100
static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
101
{
102
@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
103
return mmu_idx;
104
}
105
106
-/* Return the TTBR associated with this translation regime */
107
-static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
108
- int ttbrn)
109
-{
110
- if (mmu_idx == ARMMMUIdx_S2NS) {
111
- return env->cp15.vttbr_el2;
112
- }
113
- if (ttbrn == 0) {
114
- return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
115
- } else {
116
- return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
117
- }
118
-}
119
-
120
/* Return true if the translation regime is using LPAE format page tables */
121
static inline bool regime_using_lpae_format(CPUARMState *env,
122
ARMMMUIdx mmu_idx)
123
@@ -XXX,XX +XXX,XX @@ bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
124
return regime_using_lpae_format(env, mmu_idx);
125
}
126
127
+#ifndef CONFIG_USER_ONLY
128
static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
129
{
130
switch (mmu_idx) {
131
@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
132
133
return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
134
}
135
+#endif /* !CONFIG_USER_ONLY */
136
137
ARMVAParameters aa64_va_parameters_both(CPUARMState *env, uint64_t va,
138
ARMMMUIdx mmu_idx)
139
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
140
return ret;
67
return ret;
141
}
68
}
142
69
143
+#ifndef CONFIG_USER_ONLY
144
static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
145
ARMMMUIdx mmu_idx)
146
{
147
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
148
*pc = env->pc;
149
flags = FIELD_DP32(flags, TBFLAG_ANY, AARCH64_STATE, 1);
150
151
-#ifndef CONFIG_USER_ONLY
152
- /*
153
- * Get control bits for tagged addresses. Note that the
154
- * translator only uses this for instruction addresses.
155
- */
156
+ /* Get control bits for tagged addresses. */
157
{
158
ARMMMUIdx stage1 = stage_1_mmu_idx(mmu_idx);
159
ARMVAParameters p0 = aa64_va_parameters_both(env, 0, stage1);
160
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
161
flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
162
flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
163
}
164
-#endif
165
166
if (cpu_isar_feature(aa64_sve, cpu)) {
167
int sve_el = sve_exception_el(env, current_el);
168
--
70
--
169
2.20.1
71
2.20.1
170
72
171
73
diff view generated by jsdifflib
[Qemu-devel] [PULL 07/22] target/arm: Reset btype for direct branches
[Qemu-devel] [PULL 07/10] hw/arm/virt: Fix non-secure flash mode
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: David Engraf <david.engraf@sysgo.com>
2
2
3
This is all of the non-exception cases of DISAS_NORETURN.
3
Using the whole 128 MiB flash in non-secure mode is not working because
4
virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
5
This is not correctly handled by caller because it forwards NULL for
6
secure_sysmem in non-secure flash mode.
4
7
5
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Fixed by using sysmem when secure_sysmem is NULL.
9
10
Signed-off-by: David Engraf <david.engraf@sysgo.com>
11
Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Message-id: 20190128223118.5255-8-richard.henderson@linaro.org
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
14
---
10
target/arm/translate-a64.c | 6 ++++++
15
hw/arm/virt.c | 2 +-
11
1 file changed, 6 insertions(+)
16
1 file changed, 1 insertion(+), 1 deletion(-)
12
17
13
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
18
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
14
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
15
--- a/target/arm/translate-a64.c
20
--- a/hw/arm/virt.c
16
+++ b/target/arm/translate-a64.c
21
+++ b/hw/arm/virt.c
17
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_imm(DisasContext *s, uint32_t insn)
22
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
23
&machine->device_memory->mr);
18
}
24
}
19
25
20
/* B Branch / BL Branch with link */
26
- virt_flash_fdt(vms, sysmem, secure_sysmem);
21
+ reset_btype(s);
27
+ virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
22
gen_goto_tb(s, 0, addr);
28
23
}
29
create_gic(vms, pic);
24
30
25
@@ -XXX,XX +XXX,XX @@ static void disas_comp_b_imm(DisasContext *s, uint32_t insn)
26
tcg_cmp = read_cpu_reg(s, rt, sf);
27
label_match = gen_new_label();
28
29
+ reset_btype(s);
30
tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
31
tcg_cmp, 0, label_match);
32
33
@@ -XXX,XX +XXX,XX @@ static void disas_test_b_imm(DisasContext *s, uint32_t insn)
34
tcg_cmp = tcg_temp_new_i64();
35
tcg_gen_andi_i64(tcg_cmp, cpu_reg(s, rt), (1ULL << bit_pos));
36
label_match = gen_new_label();
37
+
38
+ reset_btype(s);
39
tcg_gen_brcondi_i64(op ? TCG_COND_NE : TCG_COND_EQ,
40
tcg_cmp, 0, label_match);
41
tcg_temp_free_i64(tcg_cmp);
42
@@ -XXX,XX +XXX,XX @@ static void disas_cond_b_imm(DisasContext *s, uint32_t insn)
43
addr = s->pc + sextract32(insn, 5, 19) * 4 - 4;
44
cond = extract32(insn, 0, 4);
45
46
+ reset_btype(s);
47
if (cond < 0x0e) {
48
/* genuinely conditional branches */
49
TCGLabel *label_match = gen_new_label();
50
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
51
* a self-modified code correctly and also to take
52
* any pending interrupts immediately.
53
*/
54
+ reset_btype(s);
55
gen_goto_tb(s, 0, s->pc);
56
return;
57
default:
58
--
31
--
59
2.20.1
32
2.20.1
60
33
61
34
diff view generated by jsdifflib
[Qemu-devel] [PULL 06/22] target/arm: Default handling of BTYPE during translation
[Qemu-devel] [PULL 08/10] pl031: Correctly migrate state when using -rtc clock=host
1
From: Richard Henderson <richard.henderson@linaro.org>
1
The PL031 RTC tracks the difference between the guest RTC
2
2
and the host RTC using a tick_offset field. For migration,
3
The branch target exception for guarded pages has high priority,
3
however, we currently always migrate the offset between
4
and only 8 instructions are valid for that case. Perform this
4
the guest and the vm_clock, even if the RTC clock is not
5
check before doing any other decode.
5
the same as the vm_clock; this was an attempt to retain
6
6
migration backwards compatibility.
7
Clear BTYPE after all insns that neither set BTYPE nor exit via
7
8
exception (DISAS_NORETURN).
8
Unfortunately this results in the RTC behaving oddly across
9
9
a VM state save and restore -- since the VM clock stands still
10
Not yet handled are insns that exit via DISAS_NORETURN for some
10
across save-then-restore, regardless of how much real world
11
other reason, like direct branches.
11
time has elapsed, the guest RTC ends up out of sync with the
12
12
host RTC in the restored VM.
13
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
13
14
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14
Fix this by migrating the raw tick_offset. To retain migration
15
Message-id: 20190128223118.5255-7-richard.henderson@linaro.org
15
compatibility as far as possible, we have a new property
16
migrate-tick-offset; by default this is 'true' and we will
17
migrate the true tick offset in a new subsection; if the
18
incoming data has no subsection we fall back to the old
19
vm_clock-based offset information, so old->new migration
20
compatibility is preserved. For complete new->old migration
21
compatibility, the property is set to 'false' for 4.0 and
22
earlier machine types (this will only affect 'virt-4.0'
23
and below, as none of the other pl031-using machines are
24
versioned).
25
26
Reported-by: Russell King <rmk@armlinux.org.uk>
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
28
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
29
Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
17
---
30
---
18
target/arm/internals.h | 6 ++
31
include/hw/timer/pl031.h | 2 +
19
target/arm/translate.h | 9 ++-
32
hw/core/machine.c | 1 +
20
target/arm/translate-a64.c | 139 +++++++++++++++++++++++++++++++++++++
33
hw/timer/pl031.c | 92 ++++++++++++++++++++++++++++++++++++++--
21
3 files changed, 152 insertions(+), 2 deletions(-)
34
3 files changed, 91 insertions(+), 4 deletions(-)
22
35
23
diff --git a/target/arm/internals.h b/target/arm/internals.h
36
diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
24
index XXXXXXX..XXXXXXX 100644
37
index XXXXXXX..XXXXXXX 100644
25
--- a/target/arm/internals.h
38
--- a/include/hw/timer/pl031.h
26
+++ b/target/arm/internals.h
39
+++ b/include/hw/timer/pl031.h
27
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
40
@@ -XXX,XX +XXX,XX @@ typedef struct PL031State {
28
EC_FPIDTRAP = 0x08,
41
*/
29
EC_PACTRAP = 0x09,
42
uint32_t tick_offset_vmstate;
30
EC_CP14RRTTRAP = 0x0c,
43
uint32_t tick_offset;
31
+ EC_BTITRAP = 0x0d,
44
+ bool tick_offset_migrated;
32
EC_ILLEGALSTATE = 0x0e,
45
+ bool migrate_tick_offset;
33
EC_AA32_SVC = 0x11,
46
34
EC_AA32_HVC = 0x12,
47
uint32_t mr;
35
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_pactrap(void)
48
uint32_t lr;
36
return EC_PACTRAP << ARM_EL_EC_SHIFT;
49
diff --git a/hw/core/machine.c b/hw/core/machine.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/hw/core/machine.c
52
+++ b/hw/core/machine.c
53
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_4_0[] = {
54
{ "virtio-gpu-pci", "edid", "false" },
55
{ "virtio-device", "use-started", "false" },
56
{ "virtio-balloon-device", "qemu-4-0-config-size", "true" },
57
+ { "pl031", "migrate-tick-offset", "false" },
58
};
59
const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
60
61
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
62
index XXXXXXX..XXXXXXX 100644
63
--- a/hw/timer/pl031.c
64
+++ b/hw/timer/pl031.c
65
@@ -XXX,XX +XXX,XX @@ static int pl031_pre_save(void *opaque)
66
{
67
PL031State *s = opaque;
68
69
- /* tick_offset is base_time - rtc_clock base time. Instead, we want to
70
- * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility. */
71
+ /*
72
+ * The PL031 device model code uses the tick_offset field, which is
73
+ * the offset between what the guest RTC should read and what the
74
+ * QEMU rtc_clock reads:
75
+ * guest_rtc = rtc_clock + tick_offset
76
+ * and so
77
+ * tick_offset = guest_rtc - rtc_clock
78
+ *
79
+ * We want to migrate this offset, which sounds straightforward.
80
+ * Unfortunately older versions of QEMU migrated a conversion of this
81
+ * offset into an offset from the vm_clock. (This was in turn an
82
+ * attempt to be compatible with even older QEMU versions, but it
83
+ * has incorrect behaviour if the rtc_clock is not the same as the
84
+ * vm_clock.) So we put the actual tick_offset into a migration
85
+ * subsection, and the backwards-compatible time-relative-to-vm_clock
86
+ * in the main migration state.
87
+ *
88
+ * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
89
+ */
90
int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
91
s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
92
93
return 0;
37
}
94
}
38
95
39
+static inline uint32_t syn_btitrap(int btype)
96
+static int pl031_pre_load(void *opaque)
40
+{
97
+{
41
+ return (EC_BTITRAP << ARM_EL_EC_SHIFT) | btype;
98
+ PL031State *s = opaque;
99
+
100
+ s->tick_offset_migrated = false;
101
+ return 0;
42
+}
102
+}
43
+
103
+
44
static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
104
static int pl031_post_load(void *opaque, int version_id)
45
{
105
{
46
return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
106
PL031State *s = opaque;
47
diff --git a/target/arm/translate.h b/target/arm/translate.h
107
48
index XXXXXXX..XXXXXXX 100644
108
- int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
49
--- a/target/arm/translate.h
109
- s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
50
+++ b/target/arm/translate.h
51
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
52
bool pauth_active;
53
/* True with v8.5-BTI and SCTLR_ELx.BT* set. */
54
bool bt;
55
- /* A copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI. */
56
- uint8_t btype;
57
+ /*
110
+ /*
58
+ * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
111
+ * If we got the tick_offset subsection, then we can just use
59
+ * < 0, set by the current instruction.
112
+ * the value in that. Otherwise the source is an older QEMU and
113
+ * has given us the offset from the vm_clock; convert it back to
114
+ * an offset from the rtc_clock. This will cause time to incorrectly
115
+ * go backwards compared to the host RTC, but this is unavoidable.
60
+ */
116
+ */
61
+ int8_t btype;
117
+
62
+ /* True if this page is guarded. */
118
+ if (!s->tick_offset_migrated) {
63
+ bool guarded_page;
119
+ int64_t delta = qemu_clock_get_ns(rtc_clock) -
64
/* Bottom two bits of XScale c15_cpar coprocessor access control reg */
120
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
65
int c15_cpar;
121
+ s->tick_offset = s->tick_offset_vmstate -
66
/* TCG op of the current insn_start. */
122
+ delta / NANOSECONDS_PER_SECOND;
67
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
123
+ }
68
index XXXXXXX..XXXXXXX 100644
124
pl031_set_alarm(s);
69
--- a/target/arm/translate-a64.c
125
return 0;
70
+++ b/target/arm/translate-a64.c
71
@@ -XXX,XX +XXX,XX @@ static inline int get_a64_user_mem_index(DisasContext *s)
72
return arm_to_core_mmu_idx(useridx);
73
}
126
}
74
127
75
+static void reset_btype(DisasContext *s)
128
+static int pl031_tick_offset_post_load(void *opaque, int version_id)
76
+{
129
+{
77
+ if (s->btype != 0) {
130
+ PL031State *s = opaque;
78
+ TCGv_i32 zero = tcg_const_i32(0);
131
+
79
+ tcg_gen_st_i32(zero, cpu_env, offsetof(CPUARMState, btype));
132
+ s->tick_offset_migrated = true;
80
+ tcg_temp_free_i32(zero);
133
+ return 0;
81
+ s->btype = 0;
134
+}
135
+
136
+static bool pl031_tick_offset_needed(void *opaque)
137
+{
138
+ PL031State *s = opaque;
139
+
140
+ return s->migrate_tick_offset;
141
+}
142
+
143
+static const VMStateDescription vmstate_pl031_tick_offset = {
144
+ .name = "pl031/tick-offset",
145
+ .version_id = 1,
146
+ .minimum_version_id = 1,
147
+ .needed = pl031_tick_offset_needed,
148
+ .post_load = pl031_tick_offset_post_load,
149
+ .fields = (VMStateField[]) {
150
+ VMSTATE_UINT32(tick_offset, PL031State),
151
+ VMSTATE_END_OF_LIST()
82
+ }
152
+ }
83
+}
153
+};
84
+
154
+
85
void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
155
static const VMStateDescription vmstate_pl031 = {
86
fprintf_function cpu_fprintf, int flags)
156
.name = "pl031",
157
.version_id = 1,
158
.minimum_version_id = 1,
159
.pre_save = pl031_pre_save,
160
+ .pre_load = pl031_pre_load,
161
.post_load = pl031_post_load,
162
.fields = (VMStateField[]) {
163
VMSTATE_UINT32(tick_offset_vmstate, PL031State),
164
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pl031 = {
165
VMSTATE_UINT32(im, PL031State),
166
VMSTATE_UINT32(is, PL031State),
167
VMSTATE_END_OF_LIST()
168
+ },
169
+ .subsections = (const VMStateDescription*[]) {
170
+ &vmstate_pl031_tick_offset,
171
+ NULL
172
}
173
};
174
175
+static Property pl031_properties[] = {
176
+ /*
177
+ * True to correctly migrate the tick offset of the RTC. False to
178
+ * obtain backward migration compatibility with older QEMU versions,
179
+ * at the expense of the guest RTC going backwards compared with the
180
+ * host RTC when the VM is saved/restored if using -rtc host.
181
+ * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
182
+ * 'false' also permits newer QEMU to migrate to older QEMU.)
183
+ */
184
+ DEFINE_PROP_BOOL("migrate-tick-offset",
185
+ PL031State, migrate_tick_offset, true),
186
+ DEFINE_PROP_END_OF_LIST()
187
+};
188
+
189
static void pl031_class_init(ObjectClass *klass, void *data)
87
{
190
{
88
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_simd_fp(DisasContext *s, uint32_t insn)
191
DeviceClass *dc = DEVICE_CLASS(klass);
89
}
192
193
dc->vmsd = &vmstate_pl031;
194
+ dc->props = pl031_properties;
90
}
195
}
91
196
92
+/**
197
static const TypeInfo pl031_info = {
93
+ * is_guarded_page:
94
+ * @env: The cpu environment
95
+ * @s: The DisasContext
96
+ *
97
+ * Return true if the page is guarded.
98
+ */
99
+static bool is_guarded_page(CPUARMState *env, DisasContext *s)
100
+{
101
+#ifdef CONFIG_USER_ONLY
102
+ return false; /* FIXME */
103
+#else
104
+ uint64_t addr = s->base.pc_first;
105
+ int mmu_idx = arm_to_core_mmu_idx(s->mmu_idx);
106
+ unsigned int index = tlb_index(env, mmu_idx, addr);
107
+ CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
108
+
109
+ /*
110
+ * We test this immediately after reading an insn, which means
111
+ * that any normal page must be in the TLB. The only exception
112
+ * would be for executing from flash or device memory, which
113
+ * does not retain the TLB entry.
114
+ *
115
+ * FIXME: Assume false for those, for now. We could use
116
+ * arm_cpu_get_phys_page_attrs_debug to re-read the page
117
+ * table entry even for that case.
118
+ */
119
+ return (tlb_hit(entry->addr_code, addr) &&
120
+ env->iotlb[mmu_idx][index].attrs.target_tlb_bit0);
121
+#endif
122
+}
123
+
124
+/**
125
+ * btype_destination_ok:
126
+ * @insn: The instruction at the branch destination
127
+ * @bt: SCTLR_ELx.BT
128
+ * @btype: PSTATE.BTYPE, and is non-zero
129
+ *
130
+ * On a guarded page, there are a limited number of insns
131
+ * that may be present at the branch target:
132
+ * - branch target identifiers,
133
+ * - paciasp, pacibsp,
134
+ * - BRK insn
135
+ * - HLT insn
136
+ * Anything else causes a Branch Target Exception.
137
+ *
138
+ * Return true if the branch is compatible, false to raise BTITRAP.
139
+ */
140
+static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
141
+{
142
+ if ((insn & 0xfffff01fu) == 0xd503201fu) {
143
+ /* HINT space */
144
+ switch (extract32(insn, 5, 7)) {
145
+ case 0b011001: /* PACIASP */
146
+ case 0b011011: /* PACIBSP */
147
+ /*
148
+ * If SCTLR_ELx.BT, then PACI*SP are not compatible
149
+ * with btype == 3. Otherwise all btype are ok.
150
+ */
151
+ return !bt || btype != 3;
152
+ case 0b100000: /* BTI */
153
+ /* Not compatible with any btype. */
154
+ return false;
155
+ case 0b100010: /* BTI c */
156
+ /* Not compatible with btype == 3 */
157
+ return btype != 3;
158
+ case 0b100100: /* BTI j */
159
+ /* Not compatible with btype == 2 */
160
+ return btype != 2;
161
+ case 0b100110: /* BTI jc */
162
+ /* Compatible with any btype. */
163
+ return true;
164
+ }
165
+ } else {
166
+ switch (insn & 0xffe0001fu) {
167
+ case 0xd4200000u: /* BRK */
168
+ case 0xd4400000u: /* HLT */
169
+ /* Give priority to the breakpoint exception. */
170
+ return true;
171
+ }
172
+ }
173
+ return false;
174
+}
175
+
176
/* C3.1 A64 instruction index by encoding */
177
static void disas_a64_insn(CPUARMState *env, DisasContext *s)
178
{
179
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
180
181
s->fp_access_checked = false;
182
183
+ if (dc_isar_feature(aa64_bti, s)) {
184
+ if (s->base.num_insns == 1) {
185
+ /*
186
+ * At the first insn of the TB, compute s->guarded_page.
187
+ * We delayed computing this until successfully reading
188
+ * the first insn of the TB, above. This (mostly) ensures
189
+ * that the softmmu tlb entry has been populated, and the
190
+ * page table GP bit is available.
191
+ *
192
+ * Note that we need to compute this even if btype == 0,
193
+ * because this value is used for BR instructions later
194
+ * where ENV is not available.
195
+ */
196
+ s->guarded_page = is_guarded_page(env, s);
197
+
198
+ /* First insn can have btype set to non-zero. */
199
+ tcg_debug_assert(s->btype >= 0);
200
+
201
+ /*
202
+ * Note that the Branch Target Exception has fairly high
203
+ * priority -- below debugging exceptions but above most
204
+ * everything else. This allows us to handle this now
205
+ * instead of waiting until the insn is otherwise decoded.
206
+ */
207
+ if (s->btype != 0
208
+ && s->guarded_page
209
+ && !btype_destination_ok(insn, s->bt, s->btype)) {
210
+ gen_exception_insn(s, 4, EXCP_UDEF, syn_btitrap(s->btype),
211
+ default_exception_el(s));
212
+ return;
213
+ }
214
+ } else {
215
+ /* Not the first insn: btype must be 0. */
216
+ tcg_debug_assert(s->btype == 0);
217
+ }
218
+ }
219
+
220
switch (extract32(insn, 25, 4)) {
221
case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
222
unallocated_encoding(s);
223
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
224
225
/* if we allocated any temporaries, free them here */
226
free_tmp_a64(s);
227
+
228
+ /*
229
+ * After execution of most insns, btype is reset to 0.
230
+ * Note that we set btype == -1 when the insn sets btype.
231
+ */
232
+ if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
233
+ reset_btype(s);
234
+ }
235
}
236
237
static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
238
--
198
--
239
2.20.1
199
2.20.1
240
200
241
201
diff view generated by jsdifflib
[Qemu-devel] [PULL 10/22] linux-user: Implement PR_PAC_RESET_KEYS
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5
Message-id: 20190201195404.30486-2-richard.henderson@linaro.org
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
8
linux-user/aarch64/target_syscall.h | 7 ++++++
9
linux-user/syscall.c | 36 +++++++++++++++++++++++++++++
10
2 files changed, 43 insertions(+)
11
12
diff --git a/linux-user/aarch64/target_syscall.h b/linux-user/aarch64/target_syscall.h
13
index XXXXXXX..XXXXXXX 100644
14
--- a/linux-user/aarch64/target_syscall.h
15
+++ b/linux-user/aarch64/target_syscall.h
16
@@ -XXX,XX +XXX,XX @@ struct target_pt_regs {
17
#define TARGET_PR_SVE_SET_VL 50
18
#define TARGET_PR_SVE_GET_VL 51
19
20
+#define TARGET_PR_PAC_RESET_KEYS 54
21
+# define TARGET_PR_PAC_APIAKEY (1 << 0)
22
+# define TARGET_PR_PAC_APIBKEY (1 << 1)
23
+# define TARGET_PR_PAC_APDAKEY (1 << 2)
24
+# define TARGET_PR_PAC_APDBKEY (1 << 3)
25
+# define TARGET_PR_PAC_APGAKEY (1 << 4)
26
+
27
void arm_init_pauth_key(ARMPACKey *key);
28
29
#endif /* AARCH64_TARGET_SYSCALL_H */
30
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
31
index XXXXXXX..XXXXXXX 100644
32
--- a/linux-user/syscall.c
33
+++ b/linux-user/syscall.c
34
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
35
}
36
}
37
return ret;
38
+ case TARGET_PR_PAC_RESET_KEYS:
39
+ {
40
+ CPUARMState *env = cpu_env;
41
+ ARMCPU *cpu = arm_env_get_cpu(env);
42
+
43
+ if (arg3 || arg4 || arg5) {
44
+ return -TARGET_EINVAL;
45
+ }
46
+ if (cpu_isar_feature(aa64_pauth, cpu)) {
47
+ int all = (TARGET_PR_PAC_APIAKEY | TARGET_PR_PAC_APIBKEY |
48
+ TARGET_PR_PAC_APDAKEY | TARGET_PR_PAC_APDBKEY |
49
+ TARGET_PR_PAC_APGAKEY);
50
+ if (arg2 == 0) {
51
+ arg2 = all;
52
+ } else if (arg2 & ~all) {
53
+ return -TARGET_EINVAL;
54
+ }
55
+ if (arg2 & TARGET_PR_PAC_APIAKEY) {
56
+ arm_init_pauth_key(&env->apia_key);
57
+ }
58
+ if (arg2 & TARGET_PR_PAC_APIBKEY) {
59
+ arm_init_pauth_key(&env->apib_key);
60
+ }
61
+ if (arg2 & TARGET_PR_PAC_APDAKEY) {
62
+ arm_init_pauth_key(&env->apda_key);
63
+ }
64
+ if (arg2 & TARGET_PR_PAC_APDBKEY) {
65
+ arm_init_pauth_key(&env->apdb_key);
66
+ }
67
+ if (arg2 & TARGET_PR_PAC_APGAKEY) {
68
+ arm_init_pauth_key(&env->apga_key);
69
+ }
70
+ return 0;
71
+ }
72
+ }
73
+ return -TARGET_EINVAL;
74
#endif /* AARCH64 */
75
case PR_GET_SECCOMP:
76
case PR_SET_SECCOMP:
77
--
78
2.20.1
79
80
diff view generated by jsdifflib
[Qemu-devel] [PULL 11/22] tests/tcg/aarch64: Add pauth smoke test
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
5
Message-id: 20190201195404.30486-3-richard.henderson@linaro.org
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
8
tests/tcg/aarch64/Makefile.target | 6 +++++-
9
tests/tcg/aarch64/pauth-1.c | 23 +++++++++++++++++++++++
10
2 files changed, 28 insertions(+), 1 deletion(-)
11
create mode 100644 tests/tcg/aarch64/pauth-1.c
12
13
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
14
index XXXXXXX..XXXXXXX 100644
15
--- a/tests/tcg/aarch64/Makefile.target
16
+++ b/tests/tcg/aarch64/Makefile.target
17
@@ -XXX,XX +XXX,XX @@ VPATH         += $(AARCH64_SRC)
18
# we don't build any of the ARM tests
19
AARCH64_TESTS=$(filter-out $(ARM_TESTS), $(TESTS))
20
AARCH64_TESTS+=fcvt
21
-TESTS:=$(AARCH64_TESTS)
22
23
fcvt: LDFLAGS+=-lm
24
25
run-fcvt: fcvt
26
    $(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")
27
    $(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
28
+
29
+AARCH64_TESTS += pauth-1
30
+run-pauth-%: QEMU += -cpu max
31
+
32
+TESTS:=$(AARCH64_TESTS)
33
diff --git a/tests/tcg/aarch64/pauth-1.c b/tests/tcg/aarch64/pauth-1.c
34
new file mode 100644
35
index XXXXXXX..XXXXXXX
36
--- /dev/null
37
+++ b/tests/tcg/aarch64/pauth-1.c
38
@@ -XXX,XX +XXX,XX @@
39
+#include <assert.h>
40
+#include <sys/prctl.h>
41
+
42
+asm(".arch armv8.4-a");
43
+
44
+#ifndef PR_PAC_RESET_KEYS
45
+#define PR_PAC_RESET_KEYS 54
46
+#define PR_PAC_APDAKEY (1 << 2)
47
+#endif
48
+
49
+int main()
50
+{
51
+ int x;
52
+ void *p0 = &x, *p1, *p2;
53
+
54
+ asm volatile("pacdza %0" : "=r"(p1) : "0"(p0));
55
+ prctl(PR_PAC_RESET_KEYS, PR_PAC_APDAKEY, 0, 0, 0);
56
+ asm volatile("pacdza %0" : "=r"(p2) : "0"(p0));
57
+
58
+ assert(p1 != p0);
59
+ assert(p1 != p2);
60
+ return 0;
61
+}
62
--
63
2.20.1
64
65
diff view generated by jsdifflib
[Qemu-devel] [PULL 12/22] target/arm: Add TBFLAG_A64_TBID, split out gen_top_byte_ignore
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Split out gen_top_byte_ignore in preparation of handling these
4
data accesses; the new tbflags field is not yet honored.
5
6
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20190204132126.3255-2-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/cpu.h | 1 +
12
target/arm/translate.h | 3 +-
13
target/arm/helper.c | 1 +
14
target/arm/translate-a64.c | 72 +++++++++++++++++++-------------------
15
4 files changed, 40 insertions(+), 37 deletions(-)
16
17
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/cpu.h
20
+++ b/target/arm/cpu.h
21
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, ZCR_LEN, 4, 4)
22
FIELD(TBFLAG_A64, PAUTH_ACTIVE, 8, 1)
23
FIELD(TBFLAG_A64, BT, 9, 1)
24
FIELD(TBFLAG_A64, BTYPE, 10, 2)
25
+FIELD(TBFLAG_A64, TBID, 12, 2)
26
27
static inline bool bswap_code(bool sctlr_b)
28
{
29
diff --git a/target/arm/translate.h b/target/arm/translate.h
30
index XXXXXXX..XXXXXXX 100644
31
--- a/target/arm/translate.h
32
+++ b/target/arm/translate.h
33
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
34
int user;
35
#endif
36
ARMMMUIdx mmu_idx; /* MMU index to use for normal loads/stores */
37
- uint8_t tbii; /* TBI1|TBI0 for EL0/1 or TBI for EL2/3 */
38
+ uint8_t tbii; /* TBI1|TBI0 for insns */
39
+ uint8_t tbid; /* TBI1|TBI0 for data */
40
bool ns; /* Use non-secure CPREG bank on access */
41
int fp_excp_el; /* FP exception EL or 0 if enabled */
42
int sve_excp_el; /* SVE exception EL or 0 if enabled */
43
diff --git a/target/arm/helper.c b/target/arm/helper.c
44
index XXXXXXX..XXXXXXX 100644
45
--- a/target/arm/helper.c
46
+++ b/target/arm/helper.c
47
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
48
}
49
50
flags = FIELD_DP32(flags, TBFLAG_A64, TBII, tbii);
51
+ flags = FIELD_DP32(flags, TBFLAG_A64, TBID, tbid);
52
}
53
#endif
54
55
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
56
index XXXXXXX..XXXXXXX 100644
57
--- a/target/arm/translate-a64.c
58
+++ b/target/arm/translate-a64.c
59
@@ -XXX,XX +XXX,XX @@ void gen_a64_set_pc_im(uint64_t val)
60
tcg_gen_movi_i64(cpu_pc, val);
61
}
62
63
-/* Load the PC from a generic TCG variable.
64
+/*
65
+ * Handle Top Byte Ignore (TBI) bits.
66
*
67
- * If address tagging is enabled via the TCR TBI bits, then loading
68
- * an address into the PC will clear out any tag in it:
69
+ * If address tagging is enabled via the TCR TBI bits:
70
* + for EL2 and EL3 there is only one TBI bit, and if it is set
71
* then the address is zero-extended, clearing bits [63:56]
72
* + for EL0 and EL1, TBI0 controls addresses with bit 55 == 0
73
@@ -XXX,XX +XXX,XX @@ void gen_a64_set_pc_im(uint64_t val)
74
* If the appropriate TBI bit is set for the address then
75
* the address is sign-extended from bit 55 into bits [63:56]
76
*
77
- * We can avoid doing this for relative-branches, because the
78
- * PC + offset can never overflow into the tag bits (assuming
79
- * that virtual addresses are less than 56 bits wide, as they
80
- * are currently), but we must handle it for branch-to-register.
81
+ * Here We have concatenated TBI{1,0} into tbi.
82
*/
83
-static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
84
+static void gen_top_byte_ignore(DisasContext *s, TCGv_i64 dst,
85
+ TCGv_i64 src, int tbi)
86
{
87
- /* Note that TBII is TBI1:TBI0. */
88
- int tbi = s->tbii;
89
-
90
- if (s->current_el <= 1) {
91
- if (tbi != 0) {
92
- /* Sign-extend from bit 55. */
93
- tcg_gen_sextract_i64(cpu_pc, src, 0, 56);
94
-
95
- if (tbi != 3) {
96
- TCGv_i64 tcg_zero = tcg_const_i64(0);
97
-
98
- /*
99
- * The two TBI bits differ.
100
- * If tbi0, then !tbi1: only use the extension if positive.
101
- * if !tbi0, then tbi1: only use the extension if negative.
102
- */
103
- tcg_gen_movcond_i64(tbi == 1 ? TCG_COND_GE : TCG_COND_LT,
104
- cpu_pc, cpu_pc, tcg_zero, cpu_pc, src);
105
- tcg_temp_free_i64(tcg_zero);
106
- }
107
- return;
108
- }
109
+ if (tbi == 0) {
110
+ /* Load unmodified address */
111
+ tcg_gen_mov_i64(dst, src);
112
+ } else if (s->current_el >= 2) {
113
+ /* FIXME: ARMv8.1-VHE S2 translation regime. */
114
+ /* Force tag byte to all zero */
115
+ tcg_gen_extract_i64(dst, src, 0, 56);
116
} else {
117
- if (tbi != 0) {
118
- /* Force tag byte to all zero */
119
- tcg_gen_extract_i64(cpu_pc, src, 0, 56);
120
- return;
121
+ /* Sign-extend from bit 55. */
122
+ tcg_gen_sextract_i64(dst, src, 0, 56);
123
+
124
+ if (tbi != 3) {
125
+ TCGv_i64 tcg_zero = tcg_const_i64(0);
126
+
127
+ /*
128
+ * The two TBI bits differ.
129
+ * If tbi0, then !tbi1: only use the extension if positive.
130
+ * if !tbi0, then tbi1: only use the extension if negative.
131
+ */
132
+ tcg_gen_movcond_i64(tbi == 1 ? TCG_COND_GE : TCG_COND_LT,
133
+ dst, dst, tcg_zero, dst, src);
134
+ tcg_temp_free_i64(tcg_zero);
135
}
136
}
137
+}
138
139
- /* Load unmodified address */
140
- tcg_gen_mov_i64(cpu_pc, src);
141
+static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
142
+{
143
+ /*
144
+ * If address tagging is enabled for instructions via the TCR TBI bits,
145
+ * then loading an address into the PC will clear out any tag.
146
+ */
147
+ gen_top_byte_ignore(s, cpu_pc, src, s->tbii);
148
}
149
150
typedef struct DisasCompare64 {
151
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
152
core_mmu_idx = FIELD_EX32(tb_flags, TBFLAG_ANY, MMUIDX);
153
dc->mmu_idx = core_to_arm_mmu_idx(env, core_mmu_idx);
154
dc->tbii = FIELD_EX32(tb_flags, TBFLAG_A64, TBII);
155
+ dc->tbid = FIELD_EX32(tb_flags, TBFLAG_A64, TBID);
156
dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
157
#if !defined(CONFIG_USER_ONLY)
158
dc->user = (dc->current_el == 0);
159
--
160
2.20.1
161
162
diff view generated by jsdifflib
[Qemu-devel] [PULL 17/22] hw/arm/boot: Fix block comment style in arm_load_kernel()
Deleted patch
1
Fix the block comment style in arm_load_kernel() to QEMU's
2
current style preferences. This will allow us to do some
3
refactoring of this function without checkpatch complaining
4
about the code-motion patches.
5
1
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
9
Message-id: 20190131112240.8395-2-peter.maydell@linaro.org
10
---
11
hw/arm/boot.c | 30 ++++++++++++++++++++----------
12
1 file changed, 20 insertions(+), 10 deletions(-)
13
14
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/arm/boot.c
17
+++ b/hw/arm/boot.c
18
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
19
static const ARMInsnFixup *primary_loader;
20
AddressSpace *as = arm_boot_address_space(cpu, info);
21
22
- /* CPU objects (unlike devices) are not automatically reset on system
23
+ /*
24
+ * CPU objects (unlike devices) are not automatically reset on system
25
* reset, so we must always register a handler to do so. If we're
26
* actually loading a kernel, the handler is also responsible for
27
* arranging that we start it correctly.
28
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
29
qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
30
}
31
32
- /* The board code is not supposed to set secure_board_setup unless
33
+ /*
34
+ * The board code is not supposed to set secure_board_setup unless
35
* running its code in secure mode is actually possible, and KVM
36
* doesn't support secure.
37
*/
38
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
39
if (!info->kernel_filename || info->firmware_loaded) {
40
41
if (have_dtb(info)) {
42
- /* If we have a device tree blob, but no kernel to supply it to (or
43
+ /*
44
+ * If we have a device tree blob, but no kernel to supply it to (or
45
* the kernel is supposed to be loaded by the bootloader), copy the
46
* DTB to the base of RAM for the bootloader to pick up.
47
*/
48
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
49
try_decompressing_kernel = arm_feature(&cpu->env,
50
ARM_FEATURE_AARCH64);
51
52
- /* Expose the kernel, the command line, and the initrd in fw_cfg.
53
+ /*
54
+ * Expose the kernel, the command line, and the initrd in fw_cfg.
55
* We don't process them here at all, it's all left to the
56
* firmware.
57
*/
58
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
59
}
60
}
61
62
- /* We will start from address 0 (typically a boot ROM image) in the
63
+ /*
64
+ * We will start from address 0 (typically a boot ROM image) in the
65
* same way as hardware.
66
*/
67
return;
68
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
69
if (info->nb_cpus == 0)
70
info->nb_cpus = 1;
71
72
- /* We want to put the initrd far enough into RAM that when the
73
+ /*
74
+ * We want to put the initrd far enough into RAM that when the
75
* kernel is uncompressed it will not clobber the initrd. However
76
* on boards without much RAM we must ensure that we still leave
77
* enough room for a decent sized initrd, and on boards with large
78
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
79
kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
80
&elf_high_addr, elf_machine, as);
81
if (kernel_size > 0 && have_dtb(info)) {
82
- /* If there is still some room left at the base of RAM, try and put
83
+ /*
84
+ * If there is still some room left at the base of RAM, try and put
85
* the DTB there like we do for images loaded with -bios or -pflash.
86
*/
87
if (elf_low_addr > info->loader_start
88
|| elf_high_addr < info->loader_start) {
89
- /* Set elf_low_addr as address limit for arm_load_dtb if it may be
90
+ /*
91
+ * Set elf_low_addr as address limit for arm_load_dtb if it may be
92
* pointing into RAM, otherwise pass '0' (no limit)
93
*/
94
if (elf_low_addr < info->loader_start) {
95
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
96
fixupcontext[FIXUP_BOARDID] = info->board_id;
97
fixupcontext[FIXUP_BOARD_SETUP] = info->board_setup_addr;
98
99
- /* for device tree boot, we pass the DTB directly in r2. Otherwise
100
+ /*
101
+ * for device tree boot, we pass the DTB directly in r2. Otherwise
102
* we point to the kernel args.
103
*/
104
if (have_dtb(info)) {
105
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
106
info->write_board_setup(cpu, info);
107
}
108
109
- /* Notify devices which need to fake up firmware initialization
110
+ /*
111
+ * Notify devices which need to fake up firmware initialization
112
* that we're doing a direct kernel boot.
113
*/
114
object_child_foreach_recursive(object_get_root(),
115
--
116
2.20.1
117
118
diff view generated by jsdifflib
[Qemu-devel] [PULL 18/22] hw/arm/boot: Factor out "direct kernel boot" code into its own function
Deleted patch
1
Factor out the "direct kernel boot" code path from arm_load_kernel()
2
into its own function; this function is getting long enough that
3
the code flow is a bit confusing.
4
1
5
This commit only moves code around; no semantic changes.
6
7
We leave the "load the dtb" code in arm_load_kernel() -- this
8
is currently only used by the "direct kernel boot" path, but
9
this is a bug which we will fix shortly.
10
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
13
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
14
Message-id: 20190131112240.8395-3-peter.maydell@linaro.org
15
---
16
hw/arm/boot.c | 150 +++++++++++++++++++++++++++-----------------------
17
1 file changed, 80 insertions(+), 70 deletions(-)
18
19
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
20
index XXXXXXX..XXXXXXX 100644
21
--- a/hw/arm/boot.c
22
+++ b/hw/arm/boot.c
23
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
24
return size;
25
}
26
27
-void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
28
+static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
29
+ struct arm_boot_info *info)
30
{
31
+ /* Set up for a direct boot of a kernel image file. */
32
CPUState *cs;
33
+ AddressSpace *as = arm_boot_address_space(cpu, info);
34
int kernel_size;
35
int initrd_size;
36
int is_linux = 0;
37
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
38
int elf_machine;
39
hwaddr entry;
40
static const ARMInsnFixup *primary_loader;
41
- AddressSpace *as = arm_boot_address_space(cpu, info);
42
-
43
- /*
44
- * CPU objects (unlike devices) are not automatically reset on system
45
- * reset, so we must always register a handler to do so. If we're
46
- * actually loading a kernel, the handler is also responsible for
47
- * arranging that we start it correctly.
48
- */
49
- for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
50
- qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
51
- }
52
-
53
- /*
54
- * The board code is not supposed to set secure_board_setup unless
55
- * running its code in secure mode is actually possible, and KVM
56
- * doesn't support secure.
57
- */
58
- assert(!(info->secure_board_setup && kvm_enabled()));
59
-
60
- info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");
61
- info->dtb_limit = 0;
62
-
63
- /* Load the kernel. */
64
- if (!info->kernel_filename || info->firmware_loaded) {
65
-
66
- if (have_dtb(info)) {
67
- /*
68
- * If we have a device tree blob, but no kernel to supply it to (or
69
- * the kernel is supposed to be loaded by the bootloader), copy the
70
- * DTB to the base of RAM for the bootloader to pick up.
71
- */
72
- info->dtb_start = info->loader_start;
73
- }
74
-
75
- if (info->kernel_filename) {
76
- FWCfgState *fw_cfg;
77
- bool try_decompressing_kernel;
78
-
79
- fw_cfg = fw_cfg_find();
80
- try_decompressing_kernel = arm_feature(&cpu->env,
81
- ARM_FEATURE_AARCH64);
82
-
83
- /*
84
- * Expose the kernel, the command line, and the initrd in fw_cfg.
85
- * We don't process them here at all, it's all left to the
86
- * firmware.
87
- */
88
- load_image_to_fw_cfg(fw_cfg,
89
- FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
90
- info->kernel_filename,
91
- try_decompressing_kernel);
92
- load_image_to_fw_cfg(fw_cfg,
93
- FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
94
- info->initrd_filename, false);
95
-
96
- if (info->kernel_cmdline) {
97
- fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
98
- strlen(info->kernel_cmdline) + 1);
99
- fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
100
- info->kernel_cmdline);
101
- }
102
- }
103
-
104
- /*
105
- * We will start from address 0 (typically a boot ROM image) in the
106
- * same way as hardware.
107
- */
108
- return;
109
- }
110
111
if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
112
primary_loader = bootloader_aarch64;
113
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
114
for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
115
ARM_CPU(cs)->env.boot_info = info;
116
}
117
+}
118
+
119
+void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
120
+{
121
+ CPUState *cs;
122
+ AddressSpace *as = arm_boot_address_space(cpu, info);
123
+
124
+ /*
125
+ * CPU objects (unlike devices) are not automatically reset on system
126
+ * reset, so we must always register a handler to do so. If we're
127
+ * actually loading a kernel, the handler is also responsible for
128
+ * arranging that we start it correctly.
129
+ */
130
+ for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
131
+ qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
132
+ }
133
+
134
+ /*
135
+ * The board code is not supposed to set secure_board_setup unless
136
+ * running its code in secure mode is actually possible, and KVM
137
+ * doesn't support secure.
138
+ */
139
+ assert(!(info->secure_board_setup && kvm_enabled()));
140
+
141
+ info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");
142
+ info->dtb_limit = 0;
143
+
144
+ /* Load the kernel. */
145
+ if (!info->kernel_filename || info->firmware_loaded) {
146
+
147
+ if (have_dtb(info)) {
148
+ /*
149
+ * If we have a device tree blob, but no kernel to supply it to (or
150
+ * the kernel is supposed to be loaded by the bootloader), copy the
151
+ * DTB to the base of RAM for the bootloader to pick up.
152
+ */
153
+ info->dtb_start = info->loader_start;
154
+ }
155
+
156
+ if (info->kernel_filename) {
157
+ FWCfgState *fw_cfg;
158
+ bool try_decompressing_kernel;
159
+
160
+ fw_cfg = fw_cfg_find();
161
+ try_decompressing_kernel = arm_feature(&cpu->env,
162
+ ARM_FEATURE_AARCH64);
163
+
164
+ /*
165
+ * Expose the kernel, the command line, and the initrd in fw_cfg.
166
+ * We don't process them here at all, it's all left to the
167
+ * firmware.
168
+ */
169
+ load_image_to_fw_cfg(fw_cfg,
170
+ FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
171
+ info->kernel_filename,
172
+ try_decompressing_kernel);
173
+ load_image_to_fw_cfg(fw_cfg,
174
+ FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
175
+ info->initrd_filename, false);
176
+
177
+ if (info->kernel_cmdline) {
178
+ fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
179
+ strlen(info->kernel_cmdline) + 1);
180
+ fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
181
+ info->kernel_cmdline);
182
+ }
183
+ }
184
+
185
+ /*
186
+ * We will start from address 0 (typically a boot ROM image) in the
187
+ * same way as hardware.
188
+ */
189
+ return;
190
+ } else {
191
+ arm_setup_direct_kernel_boot(cpu, info);
192
+ }
193
194
if (!info->skip_dtb_autoload && have_dtb(info)) {
195
if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
196
--
197
2.20.1
198
199
diff view generated by jsdifflib
[Qemu-devel] [PULL 19/22] hw/arm/boot: Factor out "set up firmware boot" code
Deleted patch
1
Factor out the "boot via firmware" code path from arm_load_kernel()
2
into its own function.
3
1
4
This commit only moves code around; no semantic changes.
5
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
9
Message-id: 20190131112240.8395-4-peter.maydell@linaro.org
10
---
11
hw/arm/boot.c | 92 +++++++++++++++++++++++++++------------------------
12
1 file changed, 49 insertions(+), 43 deletions(-)
13
14
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/arm/boot.c
17
+++ b/hw/arm/boot.c
18
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
19
}
20
}
21
22
+static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
23
+{
24
+ /* Set up for booting firmware (which might load a kernel via fw_cfg) */
25
+
26
+ if (have_dtb(info)) {
27
+ /*
28
+ * If we have a device tree blob, but no kernel to supply it to (or
29
+ * the kernel is supposed to be loaded by the bootloader), copy the
30
+ * DTB to the base of RAM for the bootloader to pick up.
31
+ */
32
+ info->dtb_start = info->loader_start;
33
+ }
34
+
35
+ if (info->kernel_filename) {
36
+ FWCfgState *fw_cfg;
37
+ bool try_decompressing_kernel;
38
+
39
+ fw_cfg = fw_cfg_find();
40
+ try_decompressing_kernel = arm_feature(&cpu->env,
41
+ ARM_FEATURE_AARCH64);
42
+
43
+ /*
44
+ * Expose the kernel, the command line, and the initrd in fw_cfg.
45
+ * We don't process them here at all, it's all left to the
46
+ * firmware.
47
+ */
48
+ load_image_to_fw_cfg(fw_cfg,
49
+ FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
50
+ info->kernel_filename,
51
+ try_decompressing_kernel);
52
+ load_image_to_fw_cfg(fw_cfg,
53
+ FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
54
+ info->initrd_filename, false);
55
+
56
+ if (info->kernel_cmdline) {
57
+ fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
58
+ strlen(info->kernel_cmdline) + 1);
59
+ fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
60
+ info->kernel_cmdline);
61
+ }
62
+ }
63
+
64
+ /*
65
+ * We will start from address 0 (typically a boot ROM image) in the
66
+ * same way as hardware.
67
+ */
68
+}
69
+
70
void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
71
{
72
CPUState *cs;
73
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
74
75
/* Load the kernel. */
76
if (!info->kernel_filename || info->firmware_loaded) {
77
-
78
- if (have_dtb(info)) {
79
- /*
80
- * If we have a device tree blob, but no kernel to supply it to (or
81
- * the kernel is supposed to be loaded by the bootloader), copy the
82
- * DTB to the base of RAM for the bootloader to pick up.
83
- */
84
- info->dtb_start = info->loader_start;
85
- }
86
-
87
- if (info->kernel_filename) {
88
- FWCfgState *fw_cfg;
89
- bool try_decompressing_kernel;
90
-
91
- fw_cfg = fw_cfg_find();
92
- try_decompressing_kernel = arm_feature(&cpu->env,
93
- ARM_FEATURE_AARCH64);
94
-
95
- /*
96
- * Expose the kernel, the command line, and the initrd in fw_cfg.
97
- * We don't process them here at all, it's all left to the
98
- * firmware.
99
- */
100
- load_image_to_fw_cfg(fw_cfg,
101
- FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
102
- info->kernel_filename,
103
- try_decompressing_kernel);
104
- load_image_to_fw_cfg(fw_cfg,
105
- FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
106
- info->initrd_filename, false);
107
-
108
- if (info->kernel_cmdline) {
109
- fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
110
- strlen(info->kernel_cmdline) + 1);
111
- fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
112
- info->kernel_cmdline);
113
- }
114
- }
115
-
116
- /*
117
- * We will start from address 0 (typically a boot ROM image) in the
118
- * same way as hardware.
119
- */
120
+ arm_setup_firmware_boot(cpu, info);
121
return;
122
} else {
123
arm_setup_direct_kernel_boot(cpu, info);
124
--
125
2.20.1
126
127
diff view generated by jsdifflib
[Qemu-devel] [PULL 20/22] hw/arm/boot: Clarify why arm_setup_firmware_boot() doesn't set env->boot_info
[Qemu-devel] [PULL 09/10] target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
1
The code path for booting firmware doesn't set env->boot_info. At
1
The ARMv5 architecture didn't specify detailed per-feature ID
2
first sight this looks odd, so add a comment saying why we don't.
2
registers. Now that we're using the MVFR0 register fields to
3
gate the existence of VFP instructions, we need to set up
4
the correct values in the cpu->isar structure so that we still
5
provide an FPU to the guest.
3
6
7
This fixes a regression in the arm926 and arm1026 CPUs, which
8
are the only ones that both have VFP and are ARMv5 or earlier.
9
This regression was introduced by the VFP refactoring, and more
10
specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
11
which accidentally disabled VFP short-vector support and
12
double-precision support on these CPUs.
13
14
Fixes: 1120827fa182f0e
15
Fixes: 266bd25c485597c
16
Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
17
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
4
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
5
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
19
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
6
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
20
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
7
Message-id: 20190131112240.8395-5-peter.maydell@linaro.org
21
Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
22
Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
8
---
23
---
9
hw/arm/boot.c | 3 ++-
24
target/arm/cpu.c | 12 ++++++++++++
10
1 file changed, 2 insertions(+), 1 deletion(-)
25
1 file changed, 12 insertions(+)
11
26
12
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
27
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
13
index XXXXXXX..XXXXXXX 100644
28
index XXXXXXX..XXXXXXX 100644
14
--- a/hw/arm/boot.c
29
--- a/target/arm/cpu.c
15
+++ b/hw/arm/boot.c
30
+++ b/target/arm/cpu.c
16
@@ -XXX,XX +XXX,XX @@ static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
31
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
17
32
* set the field to indicate Jazelle support within QEMU.
18
/*
19
* We will start from address 0 (typically a boot ROM image) in the
20
- * same way as hardware.
21
+ * same way as hardware. Leave env->boot_info NULL, so that
22
+ * do_cpu_reset() knows it does not need to alter the PC on reset.
23
*/
33
*/
34
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
35
+ /*
36
+ * Similarly, we need to set MVFR0 fields to enable double precision
37
+ * and short vector support even though ARMv5 doesn't have this register.
38
+ */
39
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
40
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
24
}
41
}
25
42
43
static void arm946_initfn(Object *obj)
44
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
45
* set the field to indicate Jazelle support within QEMU.
46
*/
47
cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
48
+ /*
49
+ * Similarly, we need to set MVFR0 fields to enable double precision
50
+ * and short vector support even though ARMv5 doesn't have this register.
51
+ */
52
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
53
+ cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
54
55
{
56
/* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
26
--
57
--
27
2.20.1
58
2.20.1
28
59
29
60
diff view generated by jsdifflib
[Qemu-devel] [PULL 21/22] hw/arm/boot: Support DTB autoload for firmware-only boots
[Qemu-devel] [PULL 10/10] target/arm: NS BusFault on vector table fetch escalates to NS HardFault
1
The arm_boot_info struct has a skip_dtb_autoload flag: if this is
1
In the M-profile architecture, when we do a vector table fetch and it
2
set to true by the board code then arm_load_kernel() will not
2
fails, we need to report a HardFault. Whether this is a Secure HF or
3
load the DTB itself, but will leave this for the board code to
3
a NonSecure HF depends on several things. If AIRCR.BFHFNMINS is 0
4
do itself later. However, the check for this is done in a
4
then HF is always Secure, because there is no NonSecure HardFault.
5
code path which is only executed for the case where we load
5
Otherwise, the answer depends on whether the 'underlying exception'
6
a kernel image file. If we're taking the "boot via firmware"
6
(MemManage, BusFault, SecureFault) targets Secure or NonSecure. (In
7
code path then the flag isn't honoured and the DTB is never
7
the pseudocode, this is handled in the Vector() function: the final
8
loaded.
8
exc.isSecure is calculated by looking at the exc.isSecure from the
9
exception returned from the memory access, not the isSecure input
10
argument.)
9
11
10
We didn't notice this because the only real user of "boot
12
We weren't doing this correctly, because we were looking at
11
via firmware" that cares about the DTB is the virt board
13
the target security domain of the exception we were trying to
12
(for UEFI boot), and that always wants skip_dtb_autoload
14
load the vector table entry for. This produces errors of two kinds:
13
anyway. But the SBSA reference board model we're planning to
15
* a load from the NS vector table which hits the "NS access
14
add will want the flag to behave correctly.
16
to S memory" SecureFault should end up as a Secure HardFault,
17
but we were raising an NS HardFault
18
* a load from the S vector table which causes a BusFault
19
should raise an NS HardFault if BFHFNMINS == 1 (because
20
in that case all BusFaults are NonSecure), but we were raising
21
a Secure HardFault
15
22
16
Now we've refactored the arm_load_kernel() function, the
23
Correct the logic.
17
fix is simple: drop the early 'return' so we fall into
24
18
the same "load the DTB" code the boot-direct-kernel path uses.
25
We also fix a comment error where we claimed that we might
26
be escalating MemManage to HardFault, and forgot about SecureFault.
27
(Vector loads can never hit MPU access faults, because they're
28
always aligned and always use the default address map.)
19
29
20
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
30
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
21
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
31
Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
22
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
23
Message-id: 20190131112240.8395-6-peter.maydell@linaro.org
24
---
32
---
25
hw/arm/boot.c | 1 -
33
target/arm/m_helper.c | 21 +++++++++++++++++----
26
1 file changed, 1 deletion(-)
34
1 file changed, 17 insertions(+), 4 deletions(-)
27
35
28
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
36
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
29
index XXXXXXX..XXXXXXX 100644
37
index XXXXXXX..XXXXXXX 100644
30
--- a/hw/arm/boot.c
38
--- a/target/arm/m_helper.c
31
+++ b/hw/arm/boot.c
39
+++ b/target/arm/m_helper.c
32
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
40
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
33
/* Load the kernel. */
41
if (sattrs.ns) {
34
if (!info->kernel_filename || info->firmware_loaded) {
42
attrs.secure = false;
35
arm_setup_firmware_boot(cpu, info);
43
} else if (!targets_secure) {
36
- return;
44
- /* NS access to S memory */
37
} else {
45
+ /*
38
arm_setup_direct_kernel_boot(cpu, info);
46
+ * NS access to S memory: the underlying exception which we escalate
47
+ * to HardFault is SecureFault, which always targets Secure.
48
+ */
49
+ exc_secure = true;
50
goto load_fail;
51
}
39
}
52
}
53
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
54
vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
55
attrs, &result);
56
if (result != MEMTX_OK) {
57
+ /*
58
+ * Underlying exception is BusFault: its target security state
59
+ * depends on BFHFNMINS.
60
+ */
61
+ exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
62
goto load_fail;
63
}
64
*pvec = vector_entry;
65
@@ -XXX,XX +XXX,XX @@ load_fail:
66
/*
67
* All vector table fetch fails are reported as HardFault, with
68
* HFSR.VECTTBL and .FORCED set. (FORCED is set because
69
- * technically the underlying exception is a MemManage or BusFault
70
+ * technically the underlying exception is a SecureFault or BusFault
71
* that is escalated to HardFault.) This is a terminal exception,
72
* so we will either take the HardFault immediately or else enter
73
* lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
74
+ * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
75
+ * secure); otherwise it targets the same security state as the
76
+ * underlying exception.
77
*/
78
- exc_secure = targets_secure ||
79
- !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
80
+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
81
+ exc_secure = true;
82
+ }
83
env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
84
armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
85
return false;
40
--
86
--
41
2.20.1
87
2.20.1
42
88
43
89
diff view generated by jsdifflib
[Qemu-devel] [PULL 22/22] target/arm: Make FPSCR/FPCR trapped-exception bits RAZ/WI
Deleted patch
1
The {IOE, DZE, OFE, UFE, IXE, IDE} bits in the FPSCR/FPCR are for
2
enabling trapped IEEE floating point exceptions (where IEEE exception
3
conditions cause a CPU exception rather than updating the FPSR status
4
bits). QEMU doesn't implement this (and nor does the hardware we're
5
modelling), but for implementations which don't implement trapped
6
exception handling these control bits are supposed to be RAZ/WI.
7
This allows guest code to test for whether the feature is present
8
by trying to write to the bit and checking whether it sticks.
9
1
10
QEMU is incorrectly making these bits read as written. Make them
11
RAZ/WI as the architecture requires.
12
13
In particular this was causing problems for the NetBSD automatic
14
test suite.
15
16
Reported-by: Martin Husemann <martin@netbsd.org>
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
19
Message-id: 20190131130700.28392-1-peter.maydell@linaro.org
20
---
21
target/arm/cpu.h | 6 ++++++
22
target/arm/helper.c | 6 ++++++
23
2 files changed, 12 insertions(+)
24
25
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
26
index XXXXXXX..XXXXXXX 100644
27
--- a/target/arm/cpu.h
28
+++ b/target/arm/cpu.h
29
@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
30
#define FPSR_MASK 0xf800009f
31
#define FPCR_MASK 0x07ff9f00
32
33
+#define FPCR_IOE (1 << 8) /* Invalid Operation exception trap enable */
34
+#define FPCR_DZE (1 << 9) /* Divide by Zero exception trap enable */
35
+#define FPCR_OFE (1 << 10) /* Overflow exception trap enable */
36
+#define FPCR_UFE (1 << 11) /* Underflow exception trap enable */
37
+#define FPCR_IXE (1 << 12) /* Inexact exception trap enable */
38
+#define FPCR_IDE (1 << 15) /* Input Denormal exception trap enable */
39
#define FPCR_FZ16 (1 << 19) /* ARMv8.2+, FP16 flush-to-zero */
40
#define FPCR_FZ (1 << 24) /* Flush-to-zero enable bit */
41
#define FPCR_DN (1 << 25) /* Default NaN enable bit */
42
diff --git a/target/arm/helper.c b/target/arm/helper.c
43
index XXXXXXX..XXXXXXX 100644
44
--- a/target/arm/helper.c
45
+++ b/target/arm/helper.c
46
@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
47
val &= ~FPCR_FZ16;
48
}
49
50
+ /*
51
+ * We don't implement trapped exception handling, so the
52
+ * trap enable bits are all RAZ/WI (not RES0!)
53
+ */
54
+ val &= ~(FPCR_IDE | FPCR_IXE | FPCR_UFE | FPCR_OFE | FPCR_DZE | FPCR_IOE);
55
+
56
changed = env->vfp.xregs[ARM_VFP_FPSCR];
57
env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
58
env->vfp.vec_len = (val >> 16) & 7;
59
--
60
2.20.1
61
62
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.