Olivier Hériveaux (1):

Fix STM32F2XX USART data register readout

Patrick Venture (1):

hw/net: npcm7xx_emc fix missing queue_flush

Peter Maydell (6):

target/i386: Use assert() to sanity-check b1 in SSE decode

include/hw/i386: Don't include qemu-common.h in .h files

target/hexagon/cpu.h: don't include qemu-common.h

target/rx/cpu.h: Don't include qemu-common.h

hw/arm: Don't include qemu-common.h unnecessarily

target/arm: Correct calculation of tlb range invalidate length

Philippe Mathieu-Daudé (2):

hw/intc/arm_gicv3: Extract gicv3_set_gicv3state from arm_gicv3_cpuif.c

hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector

Richard Henderson (10):

target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn

target/arm: Hoist pc_next to a local variable in arm_tr_translate_insn

target/arm: Hoist pc_next to a local variable in thumb_tr_translate_insn

target/arm: Split arm_pre_translate_insn

target/arm: Advance pc for arch single-step exception

target/arm: Split compute_fsr_fsc out of arm_deliver_fault

target/arm: Take an exception if PC is misaligned

target/arm: Assert thumb pc is aligned

target/arm: Suppress bp for exceptions with more priority

tests/tcg: Add arm and aarch64 pc alignment tests

docs/system/arm/aspeed.rst | 26 ++++++++++++----

include/hw/i386/microvm.h | 1 -

include/hw/i386/x86.h | 1 -

target/arm/helper.h | 1 +

target/arm/syndrome.h | 5 +++

target/hexagon/cpu.h | 1 -

target/rx/cpu.h | 1 -

hw/arm/boot.c | 1 -

hw/arm/digic_boards.c | 1 -

hw/arm/highbank.c | 1 -

hw/arm/npcm7xx_boards.c | 1 -

hw/arm/sbsa-ref.c | 1 -

hw/arm/stm32f405_soc.c | 1 -

hw/arm/vexpress.c | 1 -

hw/arm/virt-acpi-build.c | 7 +++++

hw/arm/virt.c | 21 ++++++-------

hw/char/stm32f2xx_usart.c | 3 +-

hw/intc/arm_gicv3.c | 2 +-

hw/intc/arm_gicv3_cpuif.c | 10 +-----

hw/intc/arm_gicv3_cpuif_common.c | 22 +++++++++++++

hw/intc/arm_gicv3_its.c | 39 +++++++++++++++--------

hw/net/npcm7xx_emc.c | 18 +++++------

hw/virtio/virtio-iommu-pci.c | 12 ++------

linux-user/aarch64/cpu_loop.c | 46 ++++++++++++++++------------

linux-user/hexagon/cpu_loop.c | 1 +

target/arm/debug_helper.c | 23 ++++++++++++++

target/arm/gdbstub.c | 9 ++++--

target/arm/helper.c | 6 ++--

target/arm/machine.c | 10 ++++++

target/arm/tlb_helper.c | 63 ++++++++++++++++++++++++++++----------

target/arm/translate-a64.c | 23 ++++++++++++--

target/arm/translate.c | 58 ++++++++++++++++++++++++++---------

target/i386/tcg/translate.c | 12 ++------

tests/qtest/bios-tables-test.c | 38 +++++++++++++++++++++++

tests/tcg/aarch64/pcalign-a64.c | 37 ++++++++++++++++++++++

tests/tcg/arm/pcalign-a32.c | 46 ++++++++++++++++++++++++++++

hw/arm/Kconfig | 1 +

hw/intc/Kconfig | 5 +++

hw/intc/meson.build | 11 ++++---

tests/data/acpi/q35/DSDT.viot | Bin 0 -> 9398 bytes

tests/data/acpi/q35/VIOT.viot | Bin 0 -> 112 bytes

tests/data/acpi/virt/VIOT | Bin 0 -> 88 bytes

tests/tcg/aarch64/Makefile.target | 4 +--

tests/tcg/arm/Makefile.target | 4 +++

44 files changed, 429 insertions(+), 145 deletions(-)

create mode 100644 hw/intc/arm_gicv3_cpuif_common.c

create mode 100644 tests/tcg/aarch64/pcalign-a64.c

create mode 100644 tests/tcg/arm/pcalign-a32.c

create mode 100644 tests/data/acpi/q35/DSDT.viot

create mode 100644 tests/data/acpi/q35/VIOT.viot

create mode 100644 tests/data/acpi/virt/VIOT

From: Alex Bennée <alex.bennee@linaro.org>

While trying to debug a GIC ITS failure I saw some guest errors that

had poor formatting as well as leaving me confused as to what failed.

As most of the checks aren't possible without a valid dte split that

check apart and then check the other conditions in steps. This avoids

us relying on undefined data.

I still get a failure with the current kvm-unit-tests but at least I

know (partially) why now:

Exception return from AArch64 EL1 to AArch64 EL1 PC 0x40080588

PASS: gicv3: its-trigger: inv/invall: dev2/eventid=20 now triggers an LPI

ITS: MAPD devid=2 size = 0x8 itt=0x40430000 valid=0

INT dev_id=2 event_id=20

process_its_cmd: invalid command attributes: invalid dte: 0 for 2 (MEM_TX: 0)

PASS: gicv3: its-trigger: mapd valid=false: no LPI after device unmap

SUMMARY: 6 tests, 1 unexpected failures

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20211112170454.3158925-1-alex.bennee@linaro.org

Cc: Shashi Mallela <shashi.mallela@linaro.org>

Cc: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gicv3_its.c | 39 +++++++++++++++++++++++++++------------

1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3_its.c

+++ b/hw/intc/arm_gicv3_its.c

@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,

if (res != MEMTX_OK) {

return result;

}

+ } else {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: "

+ "invalid dte: %"PRIx64" for %d (MEM_TX: %d)\n",

+ __func__, dte, devid, res);

+ return result;

}

- if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||

- !cte_valid || (eventid > max_eventid)) {

+

+ /*

+ * In this implementation, in case of guest errors we ignore the

+ * command and move onto the next command in the queue.

+ */

+ if (devid > s->dt.maxids.max_devids) {

qemu_log_mask(LOG_GUEST_ERROR,

- "%s: invalid command attributes "

- "devid %d or eventid %d or invalid dte %d or"

- "invalid cte %d or invalid ite %d\n",

- __func__, devid, eventid, dte_valid, cte_valid,

- ite_valid);

- /*

- * in this implementation, in case of error

- * we ignore this command and move onto the next

- * command in the queue

- */

+ "%s: invalid command attributes: devid %d>%d",

+ __func__, devid, s->dt.maxids.max_devids);

+

+ } else if (!dte_valid || !ite_valid || !cte_valid) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: "

+ "dte: %s, ite: %s, cte: %s\n",

+ __func__,

+ dte_valid ? "valid" : "invalid",

+ ite_valid ? "valid" : "invalid",

+ cte_valid ? "valid" : "invalid");

+ } else if (eventid > max_eventid) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: eventid %d > %d\n",

+ __func__, eventid, max_eventid);

} else {

/*

* Current implementation only supports rdbase == procnum

--

2.25.1

From: Joel Stanley <joel@jms.id.au>

Add X11, FP5280G2, G220A, Rainier and Fuji. Mention that Swift will be

removed in v7.0.

Signed-off-by: Joel Stanley <joel@jms.id.au>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20211117065752.330632-2-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/aspeed.rst | 7 ++++++-

1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/aspeed.rst

+++ b/docs/system/arm/aspeed.rst

@@ -XXX,XX +XXX,XX @@ AST2400 SoC based machines :

- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC

- ``quanta-q71l-bmc`` OpenBMC Quanta BMC

+- ``supermicrox11-bmc`` Supermicro X11 BMC

AST2500 SoC based machines :

@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :

- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC

- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC

- ``sonorapass-bmc`` OCP SonoraPass BMC

-- ``swift-bmc`` OpenPOWER Swift BMC POWER9

+- ``swift-bmc`` OpenPOWER Swift BMC POWER9 (to be removed in v7.0)

+- ``fp5280g2-bmc`` Inspur FP5280G2 BMC

+- ``g220a-bmc`` Bytedance G220A BMC

AST2600 SoC based machines :

- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7)

- ``tacoma-bmc`` OpenPOWER Witherspoon POWER9 AST2600 BMC

+- ``rainier-bmc`` IBM Rainier POWER10 BMC

+- ``fuji-bmc`` Facebook Fuji BMC

Supported devices

-----------------

--

2.25.1

From: Joel Stanley <joel@jms.id.au>

This is the latest URL for the OpenBMC CI. The old URL still works, but

redirects.

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Joel Stanley <joel@jms.id.au>

Message-id: 20211117065752.330632-3-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/aspeed.rst | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/aspeed.rst

+++ b/docs/system/arm/aspeed.rst

@@ -XXX,XX +XXX,XX @@ The Aspeed machines can be started using the ``-kernel`` option to

load a Linux kernel or from a firmware. Images can be downloaded from

the OpenBMC jenkins :

- https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/distro=ubuntu,label=docker-builder

+ https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/

or directly from the OpenBMC GitHub release repository :

--

2.25.1

From: Joel Stanley <joel@jms.id.au>

A common use case for the ASPEED machine is to boot a Linux kernel.

Provide a full example command line.

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Joel Stanley <joel@jms.id.au>

Message-id: 20211117065752.330632-4-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/aspeed.rst | 15 ++++++++++++---

1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/aspeed.rst

+++ b/docs/system/arm/aspeed.rst

@@ -XXX,XX +XXX,XX @@ Missing devices

Boot options

------------

-The Aspeed machines can be started using the ``-kernel`` option to

-load a Linux kernel or from a firmware. Images can be downloaded from

-the OpenBMC jenkins :

+The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options

+to load a Linux kernel or from a firmware. Images can be downloaded from the

+OpenBMC jenkins :

https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/

@@ -XXX,XX +XXX,XX @@ or directly from the OpenBMC GitHub release repository :

https://github.com/openbmc/openbmc/releases

+To boot a kernel directly from a Linux build tree:

+

+.. code-block:: bash

+

+ $ qemu-system-arm -M ast2600-evb -nographic \

+ -kernel arch/arm/boot/zImage \

+ -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \

+ -initrd rootfs.cpio

+

The image should be attached as an MTD drive. Run :

.. code-block:: bash

--

2.25.1

From: Olivier Hériveaux <olivier.heriveaux@ledger.fr>

Fix issue where the data register may be overwritten by next character

reception before being read and returned.

Signed-off-by: Olivier Hériveaux <olivier.heriveaux@ledger.fr>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20211128120723.4053-1-olivier.heriveaux@ledger.fr

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/char/stm32f2xx_usart.c | 3 ++-

1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/stm32f2xx_usart.c

+++ b/hw/char/stm32f2xx_usart.c

@@ -XXX,XX +XXX,XX @@ static uint64_t stm32f2xx_usart_read(void *opaque, hwaddr addr,

return retvalue;

case USART_DR:

DB_PRINT("Value: 0x%" PRIx32 ", %c\n", s->usart_dr, (char) s->usart_dr);

+ retvalue = s->usart_dr & 0x3FF;

s->usart_sr &= ~USART_SR_RXNE;

qemu_chr_fe_accept_input(&s->chr);

qemu_set_irq(s->irq, 0);

- return s->usart_dr & 0x3FF;

+ return retvalue;

case USART_BRR:

return s->usart_brr;

case USART_CR1:

--

2.25.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

gicv3_set_gicv3state() is used by arm_gicv3_common.c in

arm_gicv3_common_realize(). Since we want to restrict

arm_gicv3_cpuif.c to TCG, extract gicv3_set_gicv3state()

to a new file. Add this file to the meson 'specific'

source set, since it needs access to "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20211115223619.2599282-2-philmd@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gicv3_cpuif.c | 10 +---------

hw/intc/arm_gicv3_cpuif_common.c | 22 ++++++++++++++++++++++

hw/intc/meson.build | 1 +

3 files changed, 24 insertions(+), 9 deletions(-)

create mode 100644 hw/intc/arm_gicv3_cpuif_common.c

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

@@ -XXX,XX +XXX,XX @@

/*

- * ARM Generic Interrupt Controller v3

+ * ARM Generic Interrupt Controller v3 (emulation)

*

* Copyright (c) 2016 Linaro Limited

* Written by Peter Maydell

@@ -XXX,XX +XXX,XX @@

#include "hw/irq.h"

#include "cpu.h"

-void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)

-{

- ARMCPU *arm_cpu = ARM_CPU(cpu);

- CPUARMState *env = &arm_cpu->env;

-

- env->gicv3state = (void *)s;

-};

-

static GICv3CPUState *icc_cs_from_env(CPUARMState *env)

{

return env->gicv3state;

diff --git a/hw/intc/arm_gicv3_cpuif_common.c b/hw/intc/arm_gicv3_cpuif_common.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/intc/arm_gicv3_cpuif_common.c

@@ -XXX,XX +XXX,XX @@

+/* SPDX-License-Identifier: GPL-2.0-or-later */

+/*

+ * ARM Generic Interrupt Controller v3

+ *

+ * Copyright (c) 2016 Linaro Limited

+ * Written by Peter Maydell

+ *

+ * This code is licensed under the GPL, version 2 or (at your option)

+ * any later version.

+ */

+

+#include "qemu/osdep.h"

+#include "gicv3_internal.h"

+#include "cpu.h"

+

+void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)

+{

+ ARMCPU *arm_cpu = ARM_CPU(cpu);

+ CPUARMState *env = &arm_cpu->env;

+

+ env->gicv3state = (void *)s;

+};

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

+specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

--

2.25.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The TYPE_ARM_GICV3 device is an emulated one. When using

KVM, it is recommended to use the TYPE_KVM_ARM_GICV3 device

(which uses in-kernel support).

When using --with-devices-FOO, it is possible to build a

binary with a specific set of devices. When this binary is

restricted to KVM accelerator, the TYPE_ARM_GICV3 device is

irrelevant, and it is desirable to remove it from the binary.

Therefore introduce the CONFIG_ARM_GIC_TCG Kconfig selector

which select the files required to have the TYPE_ARM_GICV3

device, but also allowing to de-select this device.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20211115223619.2599282-3-philmd@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gicv3.c | 2 +-

hw/intc/Kconfig | 5 +++++

hw/intc/meson.build | 10 ++++++----

3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3.c

+++ b/hw/intc/arm_gicv3.c

@@ -XXX,XX +XXX,XX @@

/*

- * ARM Generic Interrupt Controller v3

+ * ARM Generic Interrupt Controller v3 (emulation)

*

* Copyright (c) 2015 Huawei.

* Copyright (c) 2016 Linaro Limited

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/Kconfig

+++ b/hw/intc/Kconfig

@@ -XXX,XX +XXX,XX @@ config APIC

select MSI_NONBROKEN

select I8259

+config ARM_GIC_TCG

+ bool

+ default y

+ depends on ARM_GIC && TCG

+

config ARM_GIC_KVM

bool

default y

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(

'arm_gic.c',

'arm_gic_common.c',

'arm_gicv2m.c',

- 'arm_gicv3.c',

'arm_gicv3_common.c',

- 'arm_gicv3_dist.c',

'arm_gicv3_its_common.c',

- 'arm_gicv3_redist.c',

+))

+softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(

+ 'arm_gicv3.c',

+ 'arm_gicv3_dist.c',

'arm_gicv3_its.c',

+ 'arm_gicv3_redist.c',

))

softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))

softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

-specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))

+specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate-a64.c | 7 ++++---

1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

{

DisasContext *s = container_of(dcbase, DisasContext, base);

CPUARMState *env = cpu->env_ptr;

+ uint64_t pc = s->base.pc_next;

uint32_t insn;

if (s->ss_active && !s->pstate_ss) {

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

return;

}

- s->pc_curr = s->base.pc_next;

- insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);

+ s->pc_curr = pc;

+ insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);

s->insn = insn;

- s->base.pc_next += 4;

+ s->base.pc_next = pc + 4;

s->fp_access_checked = false;

s->sve_access_checked = false;

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate.c | 9 +++++----

1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

{

DisasContext *dc = container_of(dcbase, DisasContext, base);

CPUARMState *env = cpu->env_ptr;

+ uint32_t pc = dc->base.pc_next;

unsigned int insn;

if (arm_pre_translate_insn(dc)) {

- dc->base.pc_next += 4;

+ dc->base.pc_next = pc + 4;

return;

}

- dc->pc_curr = dc->base.pc_next;

- insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);

+ dc->pc_curr = pc;

+ insn = arm_ldl_code(env, &dc->base, pc, dc->sctlr_b);

dc->insn = insn;

- dc->base.pc_next += 4;

+ dc->base.pc_next = pc + 4;

disas_arm_insn(dc, insn);

arm_post_translate_insn(dc);

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate.c | 16 ++++++++--------

1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

{

DisasContext *dc = container_of(dcbase, DisasContext, base);

CPUARMState *env = cpu->env_ptr;

+ uint32_t pc = dc->base.pc_next;

uint32_t insn;

bool is_16bit;

if (arm_pre_translate_insn(dc)) {

- dc->base.pc_next += 2;

+ dc->base.pc_next = pc + 2;

return;

}

- dc->pc_curr = dc->base.pc_next;

- insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);

+ dc->pc_curr = pc;

+ insn = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);

is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);

- dc->base.pc_next += 2;

+ pc += 2;

if (!is_16bit) {

- uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,

- dc->sctlr_b);

-

+ uint32_t insn2 = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);

insn = insn << 16 | insn2;

- dc->base.pc_next += 2;

+ pc += 2;

}

+ dc->base.pc_next = pc;

dc->insn = insn;

if (dc->pstate_il) {

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create arm_check_ss_active and arm_check_kernelpage.

Reverse the order of the tests. While it doesn't matter in practice,

because only user-only has a kernel page and user-only never sets

ss_active, ss_active has priority over execution exceptions and it

is best to keep them in the proper order.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate.c | 10 +++++++---

1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)

dc->insn_start = tcg_last_op();

}

-static bool arm_pre_translate_insn(DisasContext *dc)

+static bool arm_check_kernelpage(DisasContext *dc)

{

#ifdef CONFIG_USER_ONLY

/* Intercept jump to the magic kernel page. */

@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)

return true;

}

#endif

+ return false;

+}

+static bool arm_check_ss_active(DisasContext *dc)

+{

if (dc->ss_active && !dc->pstate_ss) {

/* Singlestep state is Active-pending.

* If we're in this state at the start of a TB then either

@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t pc = dc->base.pc_next;

unsigned int insn;

- if (arm_pre_translate_insn(dc)) {

+ if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {

dc->base.pc_next = pc + 4;

return;

}

@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t insn;

bool is_16bit;

- if (arm_pre_translate_insn(dc)) {

+ if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {

dc->base.pc_next = pc + 2;

return;

}

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The size of the code covered by a TranslationBlock cannot be 0;

this is checked via assert in tb_gen_code.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate-a64.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

assert(s->base.num_insns == 1);

gen_swstep_exception(s, 0, 0);

s->base.is_jmp = DISAS_NORETURN;

+ s->base.pc_next = pc + 4;

return;

}

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We will reuse this section of arm_deliver_fault for

raising pc alignment faults.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/tlb_helper.c | 45 +++++++++++++++++++++++++----------------

1 file changed, 28 insertions(+), 17 deletions(-)

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tlb_helper.c

+++ b/target/arm/tlb_helper.c

@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,

return syn;

}

-static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,

- MMUAccessType access_type,

- int mmu_idx, ARMMMUFaultInfo *fi)

+static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,

+ int target_el, int mmu_idx, uint32_t *ret_fsc)

{

- CPUARMState *env = &cpu->env;

- int target_el;

- bool same_el;

- uint32_t syn, exc, fsr, fsc;

ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);

-

- target_el = exception_target_el(env);

- if (fi->stage2) {

- target_el = 2;

- env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;

- if (arm_is_secure_below_el3(env) && fi->s1ns) {

- env->cp15.hpfar_el2 |= HPFAR_NS;

- }

- }

- same_el = (arm_current_el(env) == target_el);

+ uint32_t fsr, fsc;

if (target_el == 2 || arm_el_is_aa64(env, target_el) ||

arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {

@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,

fsc = 0x3f;

}

+ *ret_fsc = fsc;

+ return fsr;

+}

+

+static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,

+ MMUAccessType access_type,

+ int mmu_idx, ARMMMUFaultInfo *fi)

+{

+ CPUARMState *env = &cpu->env;

+ int target_el;

+ bool same_el;

+ uint32_t syn, exc, fsr, fsc;

+

+ target_el = exception_target_el(env);

+ if (fi->stage2) {

+ target_el = 2;

+ env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;

+ if (arm_is_secure_below_el3(env) && fi->s1ns) {

+ env->cp15.hpfar_el2 |= HPFAR_NS;

+ }

+ }

+ same_el = (arm_current_el(env) == target_el);

+

+ fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);

+

if (access_type == MMU_INST_FETCH) {

syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);

exc = EXCP_PREFETCH_ABORT;

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Misaligned thumb PC is architecturally impossible.

Assert is better than proceeding, in case we've missed

something somewhere.

Expand a comment about aligning the pc in gdbstub.

Fail an incoming migrate if a thumb pc is misaligned.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/gdbstub.c | 9 +++++++--

target/arm/machine.c | 10 ++++++++++

target/arm/translate.c | 3 +++

3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/gdbstub.c

+++ b/target/arm/gdbstub.c

@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)

tmp = ldl_p(mem_buf);

- /* Mask out low bit of PC to workaround gdb bugs. This will probably

- cause problems if we ever implement the Jazelle DBX extensions. */

+ /*

+ * Mask out low bits of PC to workaround gdb bugs.

+ * This avoids an assert in thumb_tr_translate_insn, because it is

+ * architecturally impossible to misalign the pc.

+ * This will probably cause problems if we ever implement the

+ * Jazelle DBX extensions.

+ */

if (n == 15) {

tmp &= ~1;

}

diff --git a/target/arm/machine.c b/target/arm/machine.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/machine.c

+++ b/target/arm/machine.c

@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)

return -1;

}

}

+

+ /*

+ * Misaligned thumb pc is architecturally impossible.

+ * We have an assert in thumb_tr_translate_insn to verify this.

+ * Fail an incoming migrate to avoid this assert.

+ */

+ if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {

+ return -1;

+ }

+

if (!kvm_enabled()) {

pmu_op_finish(&cpu->env);

}

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t insn;

bool is_16bit;

+ /* Misaligned thumb PC is architecturally impossible. */

+ assert((dc->base.pc_next & 1) == 0);

+

if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {

dc->base.pc_next = pc + 2;

return;

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Both single-step and pc alignment faults have priority over

breakpoint exceptions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/debug_helper.c | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/debug_helper.c

+++ b/target/arm/debug_helper.c

@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)

{

ARMCPU *cpu = ARM_CPU(cs);

CPUARMState *env = &cpu->env;

+ target_ulong pc;

int n;

/*

@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)

return false;

}

+ /*

+ * Single-step exceptions have priority over breakpoint exceptions.

+ * If single-step state is active-pending, suppress the bp.

+ */

+ if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {

+ return false;

+ }

+

+ /*

+ * PC alignment faults have priority over breakpoint exceptions.

+ */

+ pc = is_a64(env) ? env->pc : env->regs[15];

+ if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {

+ return false;

+ }

+

+ /*

+ * Instruction aborts have priority over breakpoint exceptions.

+ * TODO: We would need to look up the page for PC and verify that

+ * it is present and executable.

+ */

+

for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {

if (bp_wp_matches(cpu, n, false)) {

return true;

--

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

tests/tcg/aarch64/pcalign-a64.c | 37 +++++++++++++++++++++++++