Arm queue; the big bit here is RTH's MTE for user-mode series.

The following changes since commit 83339e21d05c824ebc9131d644f25c23d0e41ecf:

Merge remote-tracking branch 'remotes/stefanha-gitlab/tags/block-pull-request' into staging (2021-02-10 15:42:20 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210211

for you to fetch changes up to 5213c78932ecf4bae18d62baf8735724e25fb478:

target/arm: Correctly initialize MDCR_EL2.HPMN (2021-02-11 11:50:16 +0000)

* Correctly initialize MDCR_EL2.HPMN

* versal: Use nr_apu_cpus in favor of hard coding 2

* npcm7xx: Add ethernet device

* Enable ARMv8.4-MemTag for user-mode emulation

* accel/tcg: Add URL of clang bug to comment about our workaround

* Add support for FEAT_DIT, Data Independent Timing

* Remove GPIO from unimplemented NPCM7XX

* Fix SCR RES1 handling

* Don't migrate CPUARMState.features

Aaron Lindsay (1):

target/arm: Don't migrate CPUARMState.features

Daniel Müller (1):

target/arm: Correctly initialize MDCR_EL2.HPMN

Doug Evans (3):

hw/net: Add npcm7xx emc model

hw/arm: Add npcm7xx emc model

tests/qtests: Add npcm7xx emc model test

Edgar E. Iglesias (1):

hw/arm: versal: Use nr_apu_cpus in favor of hard coding 2

From: Mike Nawrocki <michael.nawrocki@gtri.gatech.edu>

The FW and AW bits of SCR_EL3 are RES1 only in some contexts. Force them

to 1 only when there is no support for AArch32 at EL1 or above.

The reset value will be 0x30 only if the CPU is AArch64-only; if there

is support for AArch32 at EL1 or above, it will be reset to 0.

Also adds helper function isar_feature_aa64_aa32_el1 to check if AArch32

is supported at EL1 or above.

Signed-off-by: Mike Nawrocki <michael.nawrocki@gtri.gatech.edu>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20210203165552.16306-2-michael.nawrocki@gtri.gatech.edu

target/arm/cpu.h | 5 +++++

target/arm/helper.c | 16 ++++++++++++++--

2 files changed, 19 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_aa32(const ARMISARegisters *id)

return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL0) >= 2;

}

+static inline bool isar_feature_aa64_aa32_el1(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL1) >= 2;

+}

+

static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)

{

return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;

@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

ARMCPU *cpu = env_archcpu(env);

if (ri->state == ARM_CP_STATE_AA64) {

- value |= SCR_FW | SCR_AW; /* these two bits are RES1. */

+ if (arm_feature(env, ARM_FEATURE_AARCH64) &&

+ !cpu_isar_feature(aa64_aa32_el1, cpu)) {

+ value |= SCR_FW | SCR_AW; /* these two bits are RES1. */

+ }

valid_mask &= ~SCR_NET;

if (cpu_isar_feature(aa64_lor, cpu)) {

@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

raw_write(env, ri, value);

}

+static void scr_reset(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ * scr_write will set the RES1 bits on an AArch64-only CPU.

+ * The reset value will be 0x30 on an AArch64-only CPU and 0 otherwise.

+ scr_write(env, ri, 0);

+}

static CPAccessResult access_aa64_tid2(CPUARMState *env,

const ARMCPRegInfo *ri,

bool isread)

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {

{ .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,

.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),

- .resetvalue = 0, .writefn = scr_write },

+ .resetfn = scr_reset, .writefn = scr_write },

{ .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL,

.cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,

.access = PL1_RW, .accessfn = access_trap_aa32s_el1,

From: Rebecca Cran <rebecca@nuviainc.com>

Add support for FEAT_DIT. DIT (Data Independent Timing) is a required

feature for ARMv8.4. Since virtual machine execution is largely

nondeterministic and TCG is outside of the security domain, it's

implemented as a NOP.

Signed-off-by: Rebecca Cran <rebecca@nuviainc.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20210208065700.19454-2-rebecca@nuviainc.com

target/arm/cpu.h | 12 ++++++++++++

target/arm/internals.h | 6 ++++++

target/arm/helper.c | 22 ++++++++++++++++++++++

target/arm/translate-a64.c | 12 ++++++++++++

4 files changed, 52 insertions(+)

@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);

#define CPSR_IT_2_7 (0xfc00U)

#define CPSR_GE (0xfU << 16)

#define CPSR_IL (1U << 20)

+#define CPSR_DIT (1U << 21)

#define CPSR_PAN (1U << 22)

#define CPSR_J (1U << 24)

#define CPSR_IT_0_1 (3U << 25)

@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);

#define PSTATE_SS (1U << 21)

#define PSTATE_PAN (1U << 22)

#define PSTATE_UAO (1U << 23)

+#define PSTATE_DIT (1U << 24)

#define PSTATE_TCO (1U << 25)

#define PSTATE_V (1U << 28)

#define PSTATE_C (1U << 29)

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_tts2uxn(const ARMISARegisters *id)

return FIELD_EX32(id->id_mmfr4, ID_MMFR4, XNX) != 0;

}

+static inline bool isar_feature_aa32_dit(const ARMISARegisters *id)

+{

+ return FIELD_EX32(id->id_pfr0, ID_PFR0, DIT) != 0;

+}

+

/*

* 64-bit feature tests via id registers.

*/

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)

return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;

}

+static inline bool isar_feature_aa64_dit(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, DIT) != 0;

+}

+

/*

* Feature tests for "does this exist in either 32-bit or 64-bit?"

*/

diff --git a/target/arm/internals.h b/target/arm/internals.h

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch32_cpsr_valid_mask(uint64_t features,

if (isar_feature_aa32_pan(id)) {

valid |= CPSR_PAN;

}

+ if (isar_feature_aa32_dit(id)) {

+ valid |= CPSR_DIT;

+ }

return valid;

}

@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)

if (isar_feature_aa64_uao(id)) {

valid |= PSTATE_UAO;

}

+ if (isar_feature_aa64_dit(id)) {

+ valid |= PSTATE_DIT;

+ }

if (isar_feature_aa64_mte(id)) {

valid |= PSTATE_TCO;

}

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo uao_reginfo = {

.readfn = aa64_uao_read, .writefn = aa64_uao_write

};

+static uint64_t aa64_dit_read(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ return env->pstate & PSTATE_DIT;

+}

+static void aa64_dit_write(CPUARMState *env, const ARMCPRegInfo *ri,

+ uint64_t value)

+{

+ env->pstate = (env->pstate & ~PSTATE_DIT) | (value & PSTATE_DIT);

+}

+

+static const ARMCPRegInfo dit_reginfo = {

+ .name = "DIT", .state = ARM_CP_STATE_AA64,

+ .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 5,

+ .type = ARM_CP_NO_RAW, .access = PL0_RW,

+ .readfn = aa64_dit_read, .writefn = aa64_dit_write

+};

+

static CPAccessResult aa64_cacheop_poc_access(CPUARMState *env,

const ARMCPRegInfo *ri,

bool isread)

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

define_one_arm_cp_reg(cpu, &uao_reginfo);

}

+ if (cpu_isar_feature(aa64_dit, cpu)) {

+ define_one_arm_cp_reg(cpu, &dit_reginfo);

+ }

+

if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {

define_arm_cp_regs(cpu, vhe_reginfo);

}

@@ -XXX,XX +XXX,XX @@ static void handle_msr_i(DisasContext *s, uint32_t insn,

tcg_temp_free_i32(t1);

break;

+ case 0x1a: /* DIT */

+ if (!dc_isar_feature(aa64_dit, s)) {

+ goto do_unallocated;

+ }

+ if (crm & 1) {

+ set_pstate_bits(PSTATE_DIT);

+ } else {

+ clear_pstate_bits(PSTATE_DIT);

+ }

+ /* There's no need to rebuild hflags because DIT is a nop */

+ break;

+

case 0x1e: /* DAIFSet */

t1 = tcg_const_i32(crm);

gen_helper_msr_i_daifset(cpu_env, t1);

From: Rebecca Cran <rebecca@nuviainc.com>

cpsr has been treated as being the same as spsr, but it isn't.

Since PSTATE_SS isn't in cpsr, remove it and move it into env->pstate.

target/arm/helper-a64.c | 27 +++++++++++++++++++++++----

target/arm/helper.c | 24 ++++++++++++++++++------

target/arm/op_helper.c | 9 +--------

3 files changed, 42 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c

--- a/target/arm/helper-a64.c

+++ b/target/arm/helper-a64.c

@@ -XXX,XX +XXX,XX @@ static int el_from_spsr(uint32_t spsr)

+static void cpsr_write_from_spsr_elx(CPUARMState *env,

+ uint32_t val)

+ uint32_t mask;

+ /* Save SPSR_ELx.SS into PSTATE. */

+ env->pstate = (env->pstate & ~PSTATE_SS) | (val & PSTATE_SS);

+ val &= ~PSTATE_SS;

+

+ /* Move DIT to the correct location for CPSR */

+ if (val & PSTATE_DIT) {

+ val &= ~PSTATE_DIT;

+ val |= CPSR_DIT;

+ mask = aarch32_cpsr_valid_mask(env->features, \

+ &env_archcpu(env)->isar);

+ cpsr_write(env, val, mask, CPSRWriteRaw);

void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)

int cur_el = arm_current_el(env);

unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);

- uint32_t mask, spsr = env->banked_spsr[spsr_idx];

+ uint32_t spsr = env->banked_spsr[spsr_idx];

int new_el;

bool return_to_aa64 = (spsr & PSTATE_nRW) == 0;

@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)

* will sort the register banks out for us, and we've already

* caught all the bad-mode cases in el_from_spsr().

*/

- mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar);

- cpsr_write(env, spsr, mask, CPSRWriteRaw);

+ cpsr_write_from_spsr_elx(env, spsr);

if (!arm_singlestep_active(env)) {

- env->uncached_cpsr &= ~PSTATE_SS;

+ env->pstate &= ~PSTATE_SS;

}

aarch64_sync_64_to_32(env);

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,

* For exceptions taken to AArch32 we must clear the SS bit in both

* PSTATE and in the old-state value we save to SPSR_<mode>, so zero it now.

*/

- env->uncached_cpsr &= ~PSTATE_SS;

+ env->pstate &= ~PSTATE_SS;

env->spsr = cpsr_read(env);

/* Clear IT bits. */

env->condexec_bits = 0;

@@ -XXX,XX +XXX,XX @@ static int aarch64_regnum(CPUARMState *env, int aarch32_reg)

}

}

+static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env)

+{

+ uint32_t ret = cpsr_read(env);

+

+ /* Move DIT to the correct location for SPSR_ELx */

+ if (ret & CPSR_DIT) {

+ ret &= ~CPSR_DIT;

+ ret |= PSTATE_DIT;

+ }

+ /* Merge PSTATE.SS into SPSR_ELx */

+ ret |= env->pstate & PSTATE_SS;

+

+ return ret;

+}

+

/* Handle exception entry to a target EL which is using AArch64 */

static void arm_cpu_do_interrupt_aarch64(CPUState *cs)

{

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)

aarch64_save_sp(env, arm_current_el(env));

env->elr_el[new_el] = env->pc;

- old_mode = cpsr_read(env);

+ old_mode = cpsr_read_for_spsr_elx(env);

env->elr_el[new_el] = env->regs[15];

aarch64_sync_32_to_64(env);

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

target_ulong *cs_base, uint32_t *pflags)

{

uint32_t flags = env->hflags;

- uint32_t pstate_for_ss;

*cs_base = 0;

assert_hflags_rebuild_correctly(env);

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

if (cpu_isar_feature(aa64_bti, env_archcpu(env))) {

flags = FIELD_DP32(flags, TBFLAG_A64, BTYPE, env->btype);

}

- pstate_for_ss = env->pstate;

} else {

*pc = env->regs[15];

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

flags = FIELD_DP32(flags, TBFLAG_AM32, THUMB, env->thumb);

flags = FIELD_DP32(flags, TBFLAG_AM32, CONDEXEC, env->condexec_bits);

- pstate_for_ss = env->uncached_cpsr;

}

/*

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

* SS_ACTIVE is set in hflags; PSTATE_SS is computed every TB.

*/

if (FIELD_EX32(flags, TBFLAG_ANY, SS_ACTIVE) &&

- (pstate_for_ss & PSTATE_SS)) {

+ (env->pstate & PSTATE_SS)) {

flags = FIELD_DP32(flags, TBFLAG_ANY, PSTATE_SS, 1);

}

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(exception_bkpt_insn)(CPUARMState *env, uint32_t syndrome)

uint32_t HELPER(cpsr_read)(CPUARMState *env)

{

- /*

- * We store the ARMv8 PSTATE.SS bit in env->uncached_cpsr.

- * This is convenient for populating SPSR_ELx, but must be

- * hidden from aarch32 mode, where it is not visible.

- *

- * TODO: ARMv8.4-DIT -- need to move SS somewhere else.

- */

- return cpsr_read(env) & ~(CPSR_EXEC | PSTATE_SS);

+ return cpsr_read(env) & ~CPSR_EXEC;

}

void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)

From: Rebecca Cran <rebecca@nuviainc.com>

Enable FEAT_DIT for the "max" AARCH64 CPU.

Signed-off-by: Rebecca Cran <rebecca@nuviainc.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20210208065700.19454-4-rebecca@nuviainc.com

target/arm/cpu64.c | 5 +++++

1 file changed, 5 insertions(+)

t = cpu->isar.id_aa64pfr1;

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

u = FIELD_DP32(u, ID_ISAR6, SPECRES, 1);

cpu->isar.id_isar6 = u;

+ u = cpu->isar.id_pfr0;

+ u = FIELD_DP32(u, ID_PFR0, DIT, 1);

+ cpu->isar.id_pfr0 = u;

u = cpu->isar.id_mmfr3;

u = FIELD_DP32(u, ID_MMFR3, PAN, 2); /* ATS1E1 */

cpu->isar.id_mmfr3 = u;

From: Rebecca Cran <rebecca@nuviainc.com>

Enable FEAT_DIT for the "max" 32-bit CPU.

Signed-off-by: Rebecca Cran <rebecca@nuviainc.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20210208065700.19454-5-rebecca@nuviainc.com

target/arm/cpu.c | 4 ++++

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)

t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */

t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */

cpu->isar.id_mmfr4 = t;

+

+ t = cpu->isar.id_pfr0;

+ t = FIELD_DP32(t, ID_PFR0, DIT, 1);

+ cpu->isar.id_pfr0 = t;

}

#endif

}

Update infocenter.arm.com URLs for various pieces of Arm

documentation to the new developer.arm.com equivalents. (There is a

redirection in place from the old URLs, but we might as well update

our comments in case the redirect ever disappears in future.)

This patch covers all the URLs which are not MPS2/SSE-200/IoTKit

related (those are dealt with in a different patch).

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20210205171456.19939-1-peter.maydell@linaro.org

include/hw/dma/pl080.h | 7 ++++---

include/hw/misc/arm_integrator_debug.h | 2 +-

include/hw/ssi/pl022.h | 5 +++--

hw/arm/aspeed_ast2600.c | 2 +-

hw/arm/musca.c | 4 ++--

hw/misc/arm_integrator_debug.c | 2 +-

hw/timer/arm_timer.c | 7 ++++---

7 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h

--- a/include/hw/dma/pl080.h

+++ b/include/hw/dma/pl080.h

@@ -XXX,XX +XXX,XX @@

* (at your option) any later version.

*/

-/* This is a model of the Arm PrimeCell PL080/PL081 DMA controller:

+/*

+ * This is a model of the Arm PrimeCell PL080/PL081 DMA controller:

* The PL080 TRM is:

- * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0196g/DDI0196.pdf

+ * https://developer.arm.com/documentation/ddi0196/latest

* and the PL081 TRM is:

- * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0218e/DDI0218.pdf

+ * https://developer.arm.com/documentation/ddi0218/latest

*

* QEMU interface:

* + sysbus IRQ 0: DMACINTR combined interrupt line

diff --git a/include/hw/misc/arm_integrator_debug.h b/include/hw/misc/arm_integrator_debug.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/arm_integrator_debug.h

+++ b/include/hw/misc/arm_integrator_debug.h

@@ -XXX,XX +XXX,XX @@

*

* Browse the data sheet:

*

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0159b/Babbfijf.html

+ * https://developer.arm.com/documentation/dui0159/b/peripherals-and-interfaces/debug-leds-and-dip-switch-interface

*

* Copyright (c) 2013 Alex Bennée <alex@bennee.com>

*

diff --git a/include/hw/ssi/pl022.h b/include/hw/ssi/pl022.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/ssi/pl022.h

+++ b/include/hw/ssi/pl022.h

@@ -XXX,XX +XXX,XX @@

* (at your option) any later version.

*/

-/* This is a model of the Arm PrimeCell PL022 synchronous serial port.

+/*

+ * This is a model of the Arm PrimeCell PL022 synchronous serial port.

* The PL022 TRM is:

- * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0194h/DDI0194H_ssp_pl022_trm.pdf

+ * https://developer.arm.com/documentation/ddi0194/latest

*

* QEMU interface:

* + sysbus IRQ: SSPINTR combined interrupt line

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed_ast2600.c

+++ b/hw/arm/aspeed_ast2600.c

@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)

/*

* ASPEED ast2600 has 0xf as cluster ID

*

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0388e/CIHEBGFG.html

+ * https://developer.arm.com/documentation/ddi0388/e/the-system-control-coprocessors/summary-of-system-control-coprocessor-registers/multiprocessor-affinity-register

*/

static uint64_t aspeed_calc_affinity(int cpu)

{

diff --git a/hw/arm/musca.c b/hw/arm/musca.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/musca.c

+++ b/hw/arm/musca.c

@@ -XXX,XX +XXX,XX @@

* https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-a-test-chip-board

* https://developer.arm.com/products/system-design/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board

* We model the A and B1 variants of this board, as described in the TRMs:

- * http://infocenter.arm.com/help/topic/com.arm.doc.101107_0000_00_en/index.html

- * http://infocenter.arm.com/help/topic/com.arm.doc.101312_0000_00_en/index.html

+ * https://developer.arm.com/documentation/101107/latest/

+ * https://developer.arm.com/documentation/101312/latest/

*/

#include "qemu/osdep.h"

diff --git a/hw/misc/arm_integrator_debug.c b/hw/misc/arm_integrator_debug.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/arm_integrator_debug.c

+++ b/hw/misc/arm_integrator_debug.c

@@ -XXX,XX +XXX,XX @@

* to this area.

*

* The real h/w is described at:

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0159b/Babbfijf.html

+ * https://developer.arm.com/documentation/dui0159/b/peripherals-and-interfaces/debug-leds-and-dip-switch-interface

*

* Copyright (c) 2013 Alex Bennée <alex@bennee.com>

*

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/arm_timer.c

+++ b/hw/timer/arm_timer.c

@@ -XXX,XX +XXX,XX @@ static arm_timer_state *arm_timer_init(uint32_t freq)

return s;

In cpu_exec() we have a longstanding workaround for compilers which

do not correctly implement the part of the sigsetjmp()/siglongjmp()

spec which requires that local variables which are not changed

between the setjmp and the longjmp retain their value.

I recently ran across the upstream clang bug report for this; add a

link to it to the comment describing the workaround, and generally

expand the comment, so that we have a reasonable chance in future of

understanding why it's there and determining when we can remove it,

assuming clang eventually fixes the bug.

Remove the /* buggy compiler */ comments on the #else and #endif:

they don't add anything to understanding and are somewhat misleading

since they're sandwiching the code path for *non*-buggy compilers.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20210129130330.30820-1-peter.maydell@linaro.org

accel/tcg/cpu-exec.c | 25 +++++++++++++++++++------

1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c

--- a/accel/tcg/cpu-exec.c

+++ b/accel/tcg/cpu-exec.c

@@ -XXX,XX +XXX,XX @@ int cpu_exec(CPUState *cpu)

/* prepare setjmp context for exception handling */

if (sigsetjmp(cpu->jmp_env, 0) != 0) {

#if defined(__clang__)

- /* Some compilers wrongly smash all local variables after

- * siglongjmp. There were bug reports for gcc 4.5.0 and clang.

+ /*

+ * Some compilers wrongly smash all local variables after

+ * siglongjmp (the spec requires that only non-volatile locals

+ * which are changed between the sigsetjmp and siglongjmp are

+ * permitted to be trashed). There were bug reports for gcc

+ * 4.5.0 and clang. The bug is fixed in all versions of gcc

+ * that we support, but is still unfixed in clang:

+ * https://bugs.llvm.org/show_bug.cgi?id=21183

+ *

* Reload essential local variables here for those compilers.

- * Newer versions of gcc would complain about this code (-Wclobbered). */

+ * Newer versions of gcc would complain about this code (-Wclobbered),

+ * so we only perform the workaround for clang.

+ */

cpu = current_cpu;

cc = CPU_GET_CLASS(cpu);

-#else /* buggy compiler */

- /* Assert that the compiler does not smash local variables. */

+#else

+ /*

+ * Non-buggy compilers preserve these locals; assert that

+ * they have the correct value.

+ */

g_assert(cpu == current_cpu);

g_assert(cc == CPU_GET_CLASS(cpu));

-#endif /* buggy compiler */

+#endif

+

#ifndef CONFIG_SOFTMMU

tcg_debug_assert(!have_mmap_lock());

#endif

This data can be allocated by page_alloc_target_data() and

released by page_set_flags(start, end, prot | PAGE_RESET).

This data will be used to hold tag memory for AArch64 MTE.

Message-id: 20210210000223.884088-2-richard.henderson@linaro.org

include/exec/cpu-all.h | 42 +++++++++++++++++++++++++++++++++------

accel/tcg/translate-all.c | 28 ++++++++++++++++++++++++++

linux-user/mmap.c | 4 +++-

linux-user/syscall.c | 4 ++--

4 files changed, 69 insertions(+), 9 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h

--- a/include/exec/cpu-all.h

+++ b/include/exec/cpu-all.h

@@ -XXX,XX +XXX,XX @@ extern intptr_t qemu_host_page_mask;

#define PAGE_EXEC 0x0004

#define PAGE_BITS (PAGE_READ | PAGE_WRITE | PAGE_EXEC)

#define PAGE_VALID 0x0008

-/* original state of the write flag (used when tracking self-modifying

- code */

+/*

+ * Original state of the write flag (used when tracking self-modifying code)

+ */

#define PAGE_WRITE_ORG 0x0010

-/* Invalidate the TLB entry immediately, helpful for s390x

- * Low-Address-Protection. Used with PAGE_WRITE in tlb_set_page_with_attrs() */

-#define PAGE_WRITE_INV 0x0040

+/*

+ * Invalidate the TLB entry immediately, helpful for s390x

+ * Low-Address-Protection. Used with PAGE_WRITE in tlb_set_page_with_attrs()

+ */

+#define PAGE_WRITE_INV 0x0020

+/* For use with page_set_flags: page is being replaced; target_data cleared. */

+#define PAGE_RESET 0x0040

#if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY)

/* FIXME: Code that sets/uses this is broken and needs to go away. */

-#define PAGE_RESERVED 0x0020

+#define PAGE_RESERVED 0x0100

#endif

/* Target-specific bits that will be used via page_get_flags(). */

#define PAGE_TARGET_1 0x0080

@@ -XXX,XX +XXX,XX @@ int walk_memory_regions(void *, walk_memory_regions_fn);

int page_get_flags(target_ulong address);

void page_set_flags(target_ulong start, target_ulong end, int flags);

int page_check_range(target_ulong start, target_ulong len, int flags);

+

+/**

+ * page_alloc_target_data(address, size)

+ * @address: guest virtual address

+ * @size: size of data to allocate

+ *

+ * Allocate @size bytes of out-of-band data to associate with the

+ * guest page at @address. If the page is not mapped, NULL will

+ * be returned. If there is existing data associated with @address,

+ * no new memory will be allocated.

+ *

+ * The memory will be freed when the guest page is deallocated,

+ * e.g. with the munmap system call.

+ */

+void *page_alloc_target_data(target_ulong address, size_t size);

+

+/**

+ * page_get_target_data(address)

+ * @address: guest virtual address

+ *

+ * Return any out-of-bound memory assocated with the guest page

+ * at @address, as per page_alloc_target_data.

+ */

+void *page_get_target_data(target_ulong address);

#endif

CPUArchState *cpu_copy(CPUArchState *env);

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ typedef struct PageDesc {

unsigned int code_write_count;

#else

unsigned long flags;

+ void *target_data;

#endif

#ifndef CONFIG_USER_ONLY

QemuSpin lock;

@@ -XXX,XX +XXX,XX @@ int page_get_flags(target_ulong address)

void page_set_flags(target_ulong start, target_ulong end, int flags)

{

target_ulong addr, len;

+ bool reset_target_data;

/* This function should never be called with addresses outside the

guest address space. If this assert fires, it probably indicates

@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)

if (flags & PAGE_WRITE) {

flags |= PAGE_WRITE_ORG;

}

+ reset_target_data = !(flags & PAGE_VALID) || (flags & PAGE_RESET);

+ flags &= ~PAGE_RESET;

for (addr = start, len = end - start;

len != 0;

@@ -XXX,XX +XXX,XX @@ void page_set_flags(target_ulong start, target_ulong end, int flags)

p->first_tb) {

tb_invalidate_phys_page(addr, 0);

}

+ if (reset_target_data && p->target_data) {

+ g_free(p->target_data);

+ p->target_data = NULL;

+ }

p->flags = flags;

}

+void *page_get_target_data(target_ulong address)

+ PageDesc *p = page_find(address >> TARGET_PAGE_BITS);

+ return p ? p->target_data : NULL;

+void *page_alloc_target_data(target_ulong address, size_t size)

+{

+ PageDesc *p = page_find(address >> TARGET_PAGE_BITS);

+ void *ret = NULL;

+

+ if (p->flags & PAGE_VALID) {

+ ret = p->target_data;

+ if (!ret) {

+ p->target_data = ret = g_malloc0(size);

+ }

+ }

+ return ret;

+}

+

int page_check_range(target_ulong start, target_ulong len, int flags)

{

PageDesc *p;

diff --git a/linux-user/mmap.c b/linux-user/mmap.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/mmap.c

+++ b/linux-user/mmap.c

@@ -XXX,XX +XXX,XX @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,

}

}

the_end1:

+ page_flags |= PAGE_RESET;

page_set_flags(start, start + len, page_flags);

the_end:

trace_target_mmap_complete(start);

@@ -XXX,XX +XXX,XX @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,

new_addr = h2g(host_addr);

prot = page_get_flags(old_addr);

page_set_flags(old_addr, old_addr + old_size, 0);

- page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);

+ page_set_flags(new_addr, new_addr + new_size,

+ prot | PAGE_VALID | PAGE_RESET);

}

tb_invalidate_phys_range(new_addr, new_addr + new_size);

mmap_unlock();

diff --git a/linux-user/syscall.c b/linux-user/syscall.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/syscall.c

+++ b/linux-user/syscall.c

@@ -XXX,XX +XXX,XX @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,

raddr=h2g((unsigned long)host_raddr);

page_set_flags(raddr, raddr + shm_info.shm_segsz,

- PAGE_VALID | PAGE_READ |

- ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));

+ PAGE_VALID | PAGE_RESET | PAGE_READ |

+ (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));

for (i = 0; i < N_SHM_REGIONS; i++) {

if (!shm_regions[i].in_use) {