arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length

patches, which are somewhere between a bugfix and a new feature.

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

* hw/arm/smmuv3: Check 31st bit to see if CD is valid

* qemu-options.hx: Fix formatting of -machine memory-backend option

* hw: aspeed_gpio: Fix memory size

* hw/arm/nseries: Display hexadecimal value with '0x' prefix

* Add sve-default-vector-length cpu property

* docs: Update path that mentions deprecated.rst

* hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

* hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING

* hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts

* target/arm: Report M-profile alignment faults correctly to the guest

* target/arm: Add missing 'return's after calling v7m_exception_taken()

* target/arm: Enforce that M-profile SP low 2 bits are always zero

Joe Komlodi (1):

hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):

hw: aspeed_gpio: Fix memory size

From: Joe Komlodi <joe.komlodi@xilinx.com>

hw/arm/smmuv3-internal.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h

--- a/hw/arm/smmuv3-internal.h

+++ b/hw/arm/smmuv3-internal.h

@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)

/* CD fields */

-#define CD_VALID(x) extract32((x)->word[0], 30, 1)

+#define CD_VALID(x) extract32((x)->word[0], 31, 1)

#define CD_ASID(x) extract32((x)->word[1], 16, 16)

#define CD_TTB(x, sel) \

({ \

The documentation of the -machine memory-backend has some minor

formatting errors:

* Misindentation of the initial line meant that the whole option

section is incorrectly indented in the HTML output compared to

the other -machine options

* The examples weren't indented, which meant that they were formatted

as plain run-on text including outputting the "::" as text.

* The a) b) list has no rst-format markup so it is rendered as

a single run-on paragraph

Fix the formatting.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

Message-id: 20210719105257.3599-1-peter.maydell@linaro.org

qemu-options.hx | 30 +++++++++++++++++-------------

1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx

--- a/qemu-options.hx

+++ b/qemu-options.hx

@@ -XXX,XX +XXX,XX @@ SRST

Enables or disables ACPI Heterogeneous Memory Attribute Table

(HMAT) support. The default is off.

- ``memory-backend='id'``

+ ``memory-backend='id'``

An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.

Allows to use a memory backend as main RAM.

For example:

::

- -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on

- -machine memory-backend=pc.ram

- -m 512M

+

+ -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on

+ -machine memory-backend=pc.ram

+ -m 512M

Migration compatibility note:

- a) as backend id one shall use value of 'default-ram-id', advertised by

- machine type (available via ``query-machines`` QMP command), if migration

- to/from old QEMU (<5.0) is expected.

- b) for machine types 4.0 and older, user shall

- use ``x-use-canonical-path-for-ramblock-id=off`` backend option

- if migration to/from old QEMU (<5.0) is expected.

+

+ * as backend id one shall use value of 'default-ram-id', advertised by

+ machine type (available via ``query-machines`` QMP command), if migration

+ to/from old QEMU (<5.0) is expected.

+ * for machine types 4.0 and older, user shall

+ use ``x-use-canonical-path-for-ramblock-id=off`` backend option

+ if migration to/from old QEMU (<5.0) is expected.

+

For example:

::

- -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off

- -machine memory-backend=pc.ram

- -m 512M

+

+ -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off

+ -machine memory-backend=pc.ram

+ -m 512M

ERST

HXCOMM Deprecated by -machine

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be

RES0H, which is to say that they must be hardwired to zero so that

guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:

* for writes to r13 by the gdbstub

* for writes to any of the various flavours of SP via MSR

* for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places

where the register is definitely not r13 (usually because that has

been checked for as an UNDEFINED or UNPREDICTABLE case and handled as

UNDEF).

All the other writes to regs[13] in C code are either:

* A-profile only code

* writes of values we can guarantee to be aligned, such as

- writes of previous-SP-value plus or minus a 4-aligned constant

- writes of the value in an SP limit register (which we already

enforce to be aligned)

Message-id: 20210723162146.5167-2-peter.maydell@linaro.org

target/arm/gdbstub.c | 4 ++++

target/arm/m_helper.c | 14 ++++++++------

target/arm/translate.c | 3 +++

3 files changed, 15 insertions(+), 6 deletions(-)

@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)

*/

tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);

s->base.is_jmp = DISAS_JUMP;

+ } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {

+ /* For M-profile SP bits [1:0] are always zero */

+ tcg_gen_andi_i32(var, var, ~3);

}

tcg_gen_mov_i32(cpu_R[reg], var);

tcg_temp_free_i32(var);

In do_v7m_exception_exit(), we perform various checks as part of

performing the exception return. If one of these checks fails, the

architecture requires that we take an appropriate exception on the

existing stackframe. We implement this by calling

v7m_exception_taken() to set up to take the new exception, and then

immediately returning from do_v7m_exception_exit() without proceeding

any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"

statement, with the effect that if bad code in the guest tripped over

these checks we would set up to take a UsageFault exception but then

blunder on trying to also unstack and return from the original

exception, with the probable result that the guest would crash.

Add the missing return statements.

Message-id: 20210723162146.5167-3-peter.maydell@linaro.org

target/arm/m_helper.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "

"stackframe: NSACR prevents clearing FPU registers\n");

v7m_exception_taken(cpu, excret, true, false);

+ return;

} else if (!cpacr_pass) {

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,

exc_secure);

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "

"stackframe: CPACR prevents clearing FPU registers\n");

v7m_exception_taken(cpu, excret, true, false);

+ return;

For M-profile, we weren't reporting alignment faults triggered by the

generic TCG code correctly to the guest. These get passed into

arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile

style exception.fsr value of 1. We didn't check for this, and so

they fell through into the default of "assume this is an MPU fault"

and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED

bit in the UFSR.

Message-id: 20210723162146.5167-4-peter.maydell@linaro.org

target/arm/m_helper.c | 8 ++++++++

1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;

break;

case EXCP_UNALIGNED:

+ /* Unaligned faults reported by M-profile aware code */

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;

break;

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

}

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);

break;

+ case 0x1: /* Alignment fault reported by generic code */

+ qemu_log_mask(CPU_LOG_INT,

+ "...really UsageFault with UFSR.UNALIGNED\n");

+ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;

+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,

+ env->v7m.secure);

+ break;

default:

/*

* All other FSR values are either MPU faults or "can't happen

The ISCR.ISRPENDING bit is set when an external interrupt is pending.

This is true whether that external interrupt is enabled or not.

This means that we can't use 's->vectpending == 0' as a shortcut to

"ISRPENDING is zero", because s->vectpending indicates only the

highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending

enabled interrupt we fall through to scanning through the whole

interrupt array.

Message-id: 20210723162146.5167-5-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 9 ++++-----

1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)

{

int irq;

- /* We can shortcut if the highest priority pending interrupt

- * happens to be external or if there is nothing pending.

+ /*

+ * We can shortcut if the highest priority pending interrupt

+ * happens to be external; if not we need to check the whole

+ * vectors[] array.

*/

if (s->vectpending > NVIC_FIRST_IRQ) {

- if (s->vectpending == 0) {

- return false;

- }

for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {

if (s->vectors[irq].pending) {

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of

the register. We were incorrectly masking it to 8 bits, so it would

report the wrong value if the pending exception was greater than 256.

Fix the bug.

Message-id: 20210723162146.5167-6-peter.maydell@linaro.org