The following changes since commit 1ea06abceec61b6f3ab33dadb0510b6e09fb61e2:

Merge remote-tracking branch 'remotes/berrange-gitlab/tags/misc-fixes-pull-request' into staging (2021-06-14 15:59:13 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210615

for you to fetch changes up to c611c956c7fdce651e30687b1f5d19b4cab78b6a:

include/qemu/int128.h: Add function to create Int128 from int64_t (2021-06-15 16:18:50 +0100)

* hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes

* handle some UNALLOCATED decode cases correctly rather

than asserting

* hw: virt: consider hw_compat_6_0

* hw/arm: add quanta-gbs-bmc machine

* hw/intc/armv7m_nvic: Remove stale comment

* arm, acpi: Remove dependency on presence of 'virt' board

* target/arm: Fix mte page crossing test

* hw/arm: quanta-q71l add pca954x muxes

* target/arm: First few parts of MVE support

Heinrich Schuchardt (1):

hw: virt: consider hw_compat_6_0

Jean-Philippe Brucker (1):

hw/intc/arm_gicv3_cpuif: Tolerate spurious EOIR writes

Patrick Venture (5):

hw/arm: add quanta-gbs-bmc machine

hw/arm: quanta-gbs-bmc add i2c comments

hw/arm: gsj add i2c comments

hw/arm: gsj add pca9548

hw/arm: quanta-q71l add pca954x muxes

Peter Maydell (17):

hw/intc/armv7m_nvic: Remove stale comment

hw/acpi: Provide stub version of acpi_ghes_record_errors()

hw/acpi: Provide function acpi_ghes_present()

target/arm: Use acpi_ghes_present() to see if we report ACPI memory errors

target/arm: Provide and use H8 and H1_8 macros

target/arm: Enable FPSCR.QC bit for MVE

target/arm: Handle VPR semantics in existing code

target/arm: Add handling for PSR.ECI/ICI

target/arm: Let vfp_access_check() handle late NOCP checks

target/arm: Implement MVE LCTP

target/arm: Implement MVE WLSTP insn

target/arm: Implement MVE DLSTP

target/arm: Implement MVE LETP insn

target/arm: Add framework for MVE decode

target/arm: Move expand_pred_b() data to vec_helper.c

bitops.h: Provide hswap32(), hswap64(), wswap64() swapping operations

include/qemu/int128.h: Add function to create Int128 from int64_t

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Commit 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access

check logic") added an assert_not_reached() if the guest writes the EOIR

register while no interrupt is active.

It turns out some software does this: EDK2, in

GicV3ExitBootServicesEvent(), unconditionally write EOIR for all

interrupts that it manages. This now causes QEMU to abort when running

UEFI on a VM with GICv3. Although it is UNPREDICTABLE behavior and EDK2

does need fixing, the punishment seems a little harsh, especially since

icc_eoir_write() already tolerates writes of nonexistent interrupt

numbers. Display a guest error and tolerate spurious EOIR writes.

Fixes: 382c7160d1cd ("hw/intc/arm_gicv3_cpuif: Fix EOIR write access check logic")

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Tested-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20210604130352.1887560-1-jean-philippe@linaro.org

hw/intc/arm_gicv3_cpuif.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

#include "qemu/bitops.h"

+#include "qemu/log.h"

#include "qemu/main-loop.h"

#include "trace.h"

#include "gicv3_internal.h"

@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,

}

break;

default:

- g_assert_not_reached();

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: IRQ %d isn't active\n", __func__, irq);

+ return;

}

icc_drop_prio(cs, grp);

The default of this switch is truly unreachable.

The switch selector is 3 bits, and all 8 cases are present.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20210604183506.916654-3-richard.henderson@linaro.org

target/arm/translate-a64.c | 1 -

1 file changed, 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)

}

break;

default:

- fprintf(stderr, "%s: cmode_3_1: %x\n", __func__, cmode_3_1);

g_assert_not_reached();

}

This fprintf+assert has been in place since the beginning.

It is after to the fp_access_check, so we need to move the

check up. Fold that in to the pairwise filter.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20210604183506.916654-4-richard.henderson@linaro.org

target/arm/translate-a64.c | 82 +++++++++++++++++++++++---------------

1 file changed, 50 insertions(+), 32 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same(DisasContext *s, uint32_t insn)

*/

static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)

- int opcode, fpopcode;

- int is_q, u, a, rm, rn, rd;

- int datasize, elements;

- int pass;

+ int opcode = extract32(insn, 11, 3);

+ int u = extract32(insn, 29, 1);

+ int a = extract32(insn, 23, 1);

+ int is_q = extract32(insn, 30, 1);

+ int rm = extract32(insn, 16, 5);

+ int rn = extract32(insn, 5, 5);

+ int rd = extract32(insn, 0, 5);

+ /*

+ * For these floating point ops, the U, a and opcode bits

+ * together indicate the operation.

+ */

+ int fpopcode = opcode | (a << 3) | (u << 4);

+ int datasize = is_q ? 128 : 64;

+ int elements = datasize / 16;

+ bool pairwise;

TCGv_ptr fpst;

- bool pairwise = false;

+ int pass;

+

+ switch (fpopcode) {

+ case 0x0: /* FMAXNM */

+ case 0x1: /* FMLA */

+ case 0x2: /* FADD */

+ case 0x3: /* FMULX */

+ case 0x4: /* FCMEQ */

+ case 0x6: /* FMAX */

+ case 0x7: /* FRECPS */

+ case 0x8: /* FMINNM */

+ case 0x9: /* FMLS */

+ case 0xa: /* FSUB */

+ case 0xe: /* FMIN */

+ case 0xf: /* FRSQRTS */

+ case 0x13: /* FMUL */

+ case 0x14: /* FCMGE */

+ case 0x15: /* FACGE */

+ case 0x17: /* FDIV */

+ case 0x1a: /* FABD */

+ case 0x1c: /* FCMGT */

+ case 0x1d: /* FACGT */

+ pairwise = false;

+ break;

+ case 0x10: /* FMAXNMP */

+ case 0x12: /* FADDP */

+ case 0x16: /* FMAXP */

+ case 0x18: /* FMINNMP */

+ case 0x1e: /* FMINP */

+ pairwise = true;

+ break;

+ default:

+ unallocated_encoding(s);

+ return;

+ }

if (!dc_isar_feature(aa64_fp16, s)) {

@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)

- /* For these floating point ops, the U, a and opcode bits

- * together indicate the operation.

- */

- opcode = extract32(insn, 11, 3);

- u = extract32(insn, 29, 1);

- a = extract32(insn, 23, 1);

- is_q = extract32(insn, 30, 1);

- rm = extract32(insn, 16, 5);

- rn = extract32(insn, 5, 5);

- rd = extract32(insn, 0, 5);

-

- fpopcode = opcode | (a << 3) | (u << 4);

- datasize = is_q ? 128 : 64;

- elements = datasize / 16;

-

- switch (fpopcode) {

- case 0x10: /* FMAXNMP */

- case 0x12: /* FADDP */

- case 0x16: /* FMAXP */

- case 0x18: /* FMINNMP */

- case 0x1e: /* FMINP */

- pairwise = true;

- break;

- }

-

fpst = fpstatus_ptr(FPST_FPCR_F16);

if (pairwise) {

@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)

gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);

break;

default:

- fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",

- __func__, insn, fpopcode, s->pc_curr);

g_assert_not_reached();

}

The test was off-by-one, because tag_last points to the

last byte of the tag to check, thus tag_last - prev_page

will equal TARGET_PAGE_SIZE when we use the first byte

of the next page.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/403

Reported-by: Peter Collingbourne <pcc@google.com>

Message-id: 20210612195707.840217-1-richard.henderson@linaro.org

target/arm/mte_helper.c | 2 +-

tests/tcg/aarch64/mte-7.c | 31 +++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 2 +-

3 files changed, 33 insertions(+), 2 deletions(-)

create mode 100644 tests/tcg/aarch64/mte-7.c

diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c

--- a/target/arm/mte_helper.c

+++ b/target/arm/mte_helper.c

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

prev_page = ptr & TARGET_PAGE_MASK;

next_page = prev_page + TARGET_PAGE_SIZE;

- if (likely(tag_last - prev_page <= TARGET_PAGE_SIZE)) {

+ if (likely(tag_last - prev_page < TARGET_PAGE_SIZE)) {

/* Memory access stays on one page. */

tag_size = ((tag_byte_last - tag_byte_first) / (2 * TAG_GRANULE)) + 1;

mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, sizem1 + 1,

diff --git a/tests/tcg/aarch64/mte-7.c b/tests/tcg/aarch64/mte-7.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/aarch64/mte-7.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * Memory tagging, unaligned access crossing pages.

+ * https://gitlab.com/qemu-project/qemu/-/issues/403

+ *

+ * Copyright (c) 2021 Linaro Ltd

+ * SPDX-License-Identifier: GPL-2.0-or-later

+ */

+#include "mte.h"

+int main(int ac, char **av)

+{

+ void *p;

+

+ enable_mte(PR_MTE_TCF_SYNC);

+ p = alloc_mte_mem(2 * 0x1000);

+

+ /* Tag the pointer. */

+ p = (void *)((unsigned long)p | (1ul << 56));

+

+ /* Store tag in sequential granules. */

+ asm("stg %0, [%0]" : : "r"(p + 0x0ff0));

+ asm("stg %0, [%0]" : : "r"(p + 0x1000));

+

+ /*

+ * Perform an unaligned store with tag 1 crossing the pages.

+ * Failure dies with SIGSEGV.

+ */

+ asm("str %0, [%0]" : : "r"(p + 0x0ffc));

+ return 0;

+}

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/Makefile.target

+++ b/tests/tcg/aarch64/Makefile.target

@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += bti-2

# MTE Tests

ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_MTE),)

-AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6

+AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7

mte-%: CFLAGS += -march=armv8.5-a+memtag

endif