Mostly straightforward bugfixes. The new Xilinx devices are

arguably 'new feature', but they're fixing a regression where

our changes to PSCI in commit 3f37979bf mean that EL3 guest

code now needs to talk to a proper emulated power-controller

device to turn on secondary CPUs; and it's not yet rc1 and

they only affect the Xilinx board, so it seems OK to me.

The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:

Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318

for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:

util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)

* Fix sve2 ldnt1 and stnt1

* Fix pauth_check_trap vs SEL2

* Fix handling of LPAE block descriptors

* hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size

* hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()

* nsis installer: List emulators in alphabetical order

* nsis installer: Suppress "ANSI targets are deprecated" warning

* nsis installer: Fix mouse-over descriptions for emulators

* hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

* Improve M-profile vector table access logging

* Xilinx ZynqMP: model CRF and APU control

* Fix compile issues on modern Solaris

Andrew Deason (3):

util/osdep: Avoid madvise proto on modern Solaris

hw/i386/acpi-build: Avoid 'sun' identifier

util/osdep: Remove some early cruft

Edgar E. Iglesias (6):

hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area

target/arm: Make rvbar settable after realize

hw/misc: Add a model of the Xilinx ZynqMP CRF

hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF

hw/misc: Add a model of the Xilinx ZynqMP APU Control

hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control

Eric Auger (2):

hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG

hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

Peter Maydell (8):

target/arm: Fix handling of LPAE block descriptors

hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size

hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()

nsis installer: List emulators in alphabetical order

nsis installer: Suppress "ANSI targets are deprecated" warning

nsis installer: Fix mouse-over descriptions for emulators

target/arm: Log M-profile vector table accesses

target/arm: Log fault address for M-profile faults

Richard Henderson (2):

target/arm: Fix sve2 ldnt1 and stnt1

target/arm: Fix pauth_check_trap vs SEL2

meson.build | 23 ++-

include/hw/arm/xlnx-zynqmp.h | 4 +

include/hw/misc/xlnx-zynqmp-apu-ctrl.h | 93 ++++++++++++

include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++++

include/qemu/osdep.h | 8 +

target/arm/cpu.h | 3 +-

target/arm/sve.decode | 5 +-

hw/arm/virt.c | 7 +-

hw/arm/xlnx-zynqmp.c | 46 +++++-

hw/dma/xlnx_csu_dma.c | 1 +

hw/i386/acpi-build.c | 4 +-

hw/misc/npcm7xx_clk.c | 4 +-

hw/misc/xlnx-zynqmp-apu-ctrl.c | 253 +++++++++++++++++++++++++++++++

hw/misc/xlnx-zynqmp-crf.c | 266 +++++++++++++++++++++++++++++++++

target/arm/cpu.c | 17 ++-

target/arm/helper.c | 20 ++-

target/arm/m_helper.c | 11 ++

target/arm/pauth_helper.c | 2 +-

target/arm/translate-sve.c | 51 ++++++-

tests/tcg/aarch64/test-826.c | 50 +++++++

util/osdep.c | 10 --

hw/intc/Kconfig | 2 +-

hw/intc/meson.build | 4 +-

hw/misc/meson.build | 2 +

qemu.nsi | 8 +-

scripts/nsis.py | 17 ++-

tests/tcg/aarch64/Makefile.target | 4 +

tests/tcg/configure.sh | 4 +

28 files changed, 1084 insertions(+), 46 deletions(-)

create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h

create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h

create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c

create mode 100644 hw/misc/xlnx-zynqmp-crf.c

create mode 100644 tests/tcg/aarch64/test-826.c

For both ldnt1 and stnt1, the meaning of the Rn and Rm are different

from ld1 and st1: the vector and integer registers are reversed, and

the integer register 31 refers to XZR instead of SP.

Secondly, the 64-bit version of ldnt1 was being interpreted as

32-bit unpacked unscaled offset instead of 64-bit unscaled offset,

which discarded the upper 32 bits of the address coming from

the vector argument.

Thirdly, validate that the memory element size is in range for the

vector element size for ldnt1. For ld1, we do this via independent

decode patterns, but for ldnt1 we need to do it manually.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826

target/arm/sve.decode | 5 ++-

target/arm/translate-sve.c | 51 +++++++++++++++++++++++++++++--

tests/tcg/aarch64/test-826.c | 50 ++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 4 +++

tests/tcg/configure.sh | 4 +++

5 files changed, 109 insertions(+), 5 deletions(-)

create mode 100644 tests/tcg/aarch64/test-826.c

diff --git a/target/arm/sve.decode b/target/arm/sve.decode

--- a/target/arm/sve.decode

+++ b/target/arm/sve.decode

@@ -XXX,XX +XXX,XX @@ USDOT_zzzz 01000100 .. 0 ..... 011 110 ..... ..... @rda_rn_rm

### SVE2 Memory Gather Load Group

-# SVE2 64-bit gather non-temporal load

-# (scalar plus unpacked 32-bit unscaled offsets)

+# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)

LDNT1_zprz 1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \

- &rprr_gather_load xs=0 esz=3 scale=0 ff=0

+ &rprr_gather_load xs=2 esz=3 scale=0 ff=0

# SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)

LDNT1_zprz 1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)

static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)

+ gen_helper_gvec_mem_scatter *fn = NULL;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz + !a->u) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

- return trans_LD1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];

+ break;

+ case MO_64:

+ fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];

+ break;

+ }

+ assert(fn != NULL);

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, false, fn);

+ return true;

}

/* Indexed by [mte][be][xs][msz]. */

@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)

static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)

{

+ gen_helper_gvec_mem_scatter *fn;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

return false;

- return trans_ST1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = scatter_store_fn32[mte][be][0][a->msz];

+ break;

+ case MO_64:

+ fn = scatter_store_fn64[mte][be][2][a->msz];

+ break;

+ default:

+ g_assert_not_reached();

+ }

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, true, fn);

+ return true;

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When arm_is_el2_enabled was introduced, we missed

updating pauth_check_trap.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788

Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20220315021205.342768-1-richard.henderson@linaro.org

target/arm/pauth_helper.c | 2 +-

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c

--- a/target/arm/pauth_helper.c

+++ b/target/arm/pauth_helper.c

@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,

static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)

{

- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {

+ if (el < 2 && arm_is_el2_enabled(env)) {

uint64_t hcr = arm_hcr_el2_eff(env);

bool trap = !(hcr & HCR_API);

if (el == 0) {

2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its

own class struct, but forgot to update the TypeInfo::class_size

accordingly. This meant that not enough memory was allocated for the

class struct, and the initialization of xcdc->read in the class init

function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang

address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8

WRITE of size 8 at 0x61000000ab00 thread T0

#0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16

#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)

#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5

#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5

#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24

#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35

#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5

#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5

#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)

allocated by thread T0 here:

#0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)

#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")

hw/dma/xlnx_csu_dma.c | 1 +

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c

--- a/hw/dma/xlnx_csu_dma.c

+++ b/hw/dma/xlnx_csu_dma.c

@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(XlnxCSUDMA),

.class_init = xlnx_csu_dma_class_init,

+ .class_size = sizeof(XlnxCSUDMAClass),

.instance_init = xlnx_csu_dma_init,

.interfaces = (InterfaceInfo[]) {

{ TYPE_STREAM_SINK },

2.25.1

In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().

Use g_autofree so we free it rather than leaking it.

(Detected with the clang leak sanitizer.)

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org

hw/misc/npcm7xx_clk.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c

--- a/hw/misc/npcm7xx_clk.c

+++ b/hw/misc/npcm7xx_clk.c

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)

NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);

for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {

- sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),

- g_strdup_printf("clock-in[%d]", i),

+ g_autofree char *s = g_strdup_printf("clock-in[%d]", i);

+ sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,

npcm7xx_clk_update_sel_cb, sel, ClockUpdate);

sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");

2.25.1

We currently list the emulators in the Windows installer's dialog

in an essentially random order (it's whatever glob.glob() returns

them to, which is filesystem-implementation-dependent). Add a

call to sorted() so they appear in alphabetical order.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Reviewed-by: John Snow <jsnow@redhat.com>

Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org

---

scripts/nsis.py | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py

--- a/scripts/nsis.py

+++ b/scripts/nsis.py

@@ -XXX,XX +XXX,XX @@ def main():

with open(

os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"

) as nsh:

- for exe in glob.glob(

+ for exe in sorted(glob.glob(

os.path.join(destdir + args.prefix, "qemu-system-*.exe")

- ):

+ )):

exe = os.path.basename(exe)

arch = exe[12:-4]

nsh.write(

2.25.1

We use the nsis.py script to write out an installer script Section

for each emulator executable, so the exact set of Sections depends on

which executables were built. However the part of qemu.nsi which

specifies mouse-over descriptions for each Section still has a

hard-coded and very outdated list (with just i386 and alpha). This

causes two problems. Firstly, if you build the installer for a

configuration where you didn't build the i386 binaries you get

warnings like this:

warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)

warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)

(this happens in our gitlab CI jobs, for instance).

Secondly, most of the emulators in the generated installer don't have

any mouseover text.

Make nsis.py generate a second output file which has the necessary

MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can

include that at the right point in qemu.nsi to set the mouse-over

text.

qemu.nsi | 5 +----

scripts/nsis.py | 13 ++++++++++++-

2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/qemu.nsi b/qemu.nsi

--- a/qemu.nsi

+++ b/qemu.nsi

@@ -XXX,XX +XXX,XX @@ SectionEnd

; Descriptions (mouse-over).

!insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN

!insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem} "System emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha} "Alpha system emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386} "PC i386 system emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w} "PC i386 system emulation (GUI)."

+!include "${BINDIR}\system-mui-text.nsh"

!insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."

!ifdef DLLDIR

!insertmacro MUI_DESCRIPTION_TEXT ${SectionDll} "Runtime Libraries (DLL)."

diff --git a/scripts/nsis.py b/scripts/nsis.py

--- a/scripts/nsis.py

+++ b/scripts/nsis.py

@@ -XXX,XX +XXX,XX @@ def main():

subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])

with open(

os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"

- ) as nsh:

+ ) as nsh, open(

+ os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"

+ ) as muinsh:

for exe in sorted(glob.glob(

os.path.join(destdir + args.prefix, "qemu-system-*.exe")

)):

@@ -XXX,XX +XXX,XX @@ def main():

arch, exe

)

)

+ if arch.endswith('w'):

+ desc = arch[:-1] + " emulation (GUI)."

+ else:

+ desc = arch + " emulation."

+

+ muinsh.write(

+ """

+ !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"

+ """.format(arch, desc))

for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):

signcode(exe)

2.25.1

From: Eric Auger <eric.auger@redhat.com>

CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3

specific files. So let's rename it into CONFIG_ARM_GICV3_TCG

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20220308182452.223473-2-eric.auger@redhat.com

hw/intc/Kconfig | 2 +-

hw/intc/meson.build | 4 ++--

2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig

--- a/hw/intc/Kconfig

+++ b/hw/intc/Kconfig

@@ -XXX,XX +XXX,XX @@ config APIC

select MSI_NONBROKEN

select I8259

-config ARM_GIC_TCG

+config ARM_GICV3_TCG

bool

default y

depends on ARM_GIC && TCG

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(

'arm_gicv3_common.c',

'arm_gicv3_its_common.c',

))

-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(

+softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(

'arm_gicv3.c',

'arm_gicv3_dist.c',

'arm_gicv3_its.c',

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))

+specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))

2.25.1

From: Eric Auger <eric.auger@redhat.com>

In TCG mode, if gic-version=max we always select GICv3 even if

CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.

This also brings the benefit of fixing qos tests errors for tests

using gic-version=max with CONFIG_ARM_GICV3_TCG unset.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20220308182452.223473-3-eric.auger@redhat.com

hw/arm/virt.c | 7 ++++++-

1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)

vms->gic_version = VIRT_GIC_VERSION_2;

break;

case VIRT_GIC_VERSION_MAX:

- vms->gic_version = VIRT_GIC_VERSION_3;

+ if (module_object_class_by_name("arm-gicv3")) {

+ /* CONFIG_ARM_GICV3_TCG was set */

+ vms->gic_version = VIRT_GIC_VERSION_3;

+ } else {

+ vms->gic_version = VIRT_GIC_VERSION_2;

+ }

break;

case VIRT_GIC_VERSION_HOST:

error_report("gic-version=host requires KVM");

2.25.1

Currently the CPU_LOG_INT logging misses some useful information

about loads from the vector table. Add logging where we load vector

table entries. This is particularly helpful for cases where the user

has accidentally not put a vector table in their image at all, which

can result in confusing guest crashes at startup.

Here's an example of the new logging for a case where

the vector table contains garbage:

Loaded reset SP 0x0 PC 0x0 from vector table

Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table

Taking exception 3 [Prefetch Abort] on CPU 0

...with CFSR.IACCVIOL

...BusFault with BFSR.STKERR

...taking pending nonsecure exception 3

...loading from element 3 of non-secure vector table at 0xc

...loaded new PC 0x20000558

----------------

IN:

0x20000558: 08000079 stmdaeq r0, {r0, r3, r4, r5, r6}

(The double reset logging is the result of our long-standing

"CPUs all get reset twice" weirdness; it looks a bit ugly

but it'll go away if we ever fix that :-))

target/arm/cpu.c | 5 +++++

target/arm/m_helper.c | 5 +++++

2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "qemu/qemu-print.h"

#include "qemu/timer.h"

+#include "qemu/log.h"

#include "qemu-common.h"

#include "target/arm/idau.h"

#include "qemu/module.h"

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)

initial_pc = ldl_phys(s->as, vecbase + 4);

+ qemu_log_mask(CPU_LOG_INT,

+ "Loaded reset SP 0x%x PC 0x%x from vector table\n",

+ initial_msp, initial_pc);

+

env->regs[13] = initial_msp & 0xFFFFFFFC;

env->regs[15] = initial_pc & ~1;

env->thumb = initial_pc & 1;

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,

ARMMMUIdx mmu_idx;

bool exc_secure;

+ qemu_log_mask(CPU_LOG_INT,

+ "...loading from element %d of %s vector table at 0x%x\n",

+ exc, targets_secure ? "secure" : "non-secure", addr);

+

mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);

/*

@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,

goto load_fail;

}

*pvec = vector_entry;

+ qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);

return true;

load_fail:

2.25.1

For M-profile, the fault address is not always exposed to the guest

in a fault register (for instance the BFAR bus fault address register

is only updated for bus faults on data accesses, not instruction

accesses). Currently we log the address only if we're putting it

into a particular guest-visible register. Since we always have it,

log it generically, to make logs of i-side faults a bit clearer.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org

target/arm/m_helper.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

* Note that for M profile we don't have a guest facing FSR, but

* the env->exception.fsr will be populated by the code that

* raises the fault, in the A profile short-descriptor format.

+ *

+ * Log the exception.vaddress now regardless of subtype, because

+ * logging below only logs it when it goes into a guest visible

+ * register.

*/

+ qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",

+ (uint32_t)env->exception.vaddress);

switch (env->exception.fsr & 0xf) {

case M_FAKE_FSR_NSC_EXEC:

/*

2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add an unimplemented SERDES (Serializer/Deserializer) area.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com

include/hw/arm/xlnx-zynqmp.h | 2 +-

hw/arm/xlnx-zynqmp.c | 5 +++++

2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h

--- a/include/hw/arm/xlnx-zynqmp.h

+++ b/include/hw/arm/xlnx-zynqmp.h

@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)

/*

* Unimplemented mmio regions needed to boot some images.

*/

-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1

+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2

struct XlnxZynqMPState {

/*< private >*/

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-zynqmp.c

+++ b/hw/arm/xlnx-zynqmp.c

@@ -XXX,XX +XXX,XX @@

#define QSPI_DMA_ADDR 0xff0f0800

#define NUM_QSPI_IRQ_LINES 2

+/* Serializer/Deserializer. */

+#define SERDES_ADDR 0xfd400000

+#define SERDES_SIZE 0x20000

+

#define DP_ADDR 0xfd4a0000

#define DP_IRQ 113

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)

hwaddr size;

} unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {

{ .name = "apu", APU_ADDR, APU_SIZE },

+ { .name = "serdes", SERDES_ADDR, SERDES_SIZE },

};

unsigned int nr;

2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make the rvbar property settable after realize. This is done

in preparation to model the ZynqMP's runtime configurable rvbar.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com

target/arm/cpu.h | 3 ++-

target/arm/cpu.c | 12 +++++++-----

target/arm/helper.c | 10 +++++++---

3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {

uint64_t vbar_el[4];

};

uint32_t mvbar; /* (monitor) vector base address register */

+ uint64_t rvbar; /* rvbar sampled from rvbar property at reset */

struct { /* FCSE PID. */

uint32_t fcseidr_ns;

uint32_t fcseidr_s;

@@ -XXX,XX +XXX,XX @@ struct ArchCPU {

/* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */

uint32_t dcz_blocksize;

- uint64_t rvbar;

+ uint64_t rvbar_prop; /* Property/input signals. */

/* Configurable aspects of GIC cpu interface (which is part of the CPU) */

int gic_num_lrs; /* number of list registers */

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)

} else {

env->pstate = PSTATE_MODE_EL1h;

}

- env->pc = cpu->rvbar;

+

+ /* Sample rvbar at reset. */

+ env->cp15.rvbar = cpu->rvbar_prop;

+ env->pc = env->cp15.rvbar;

#endif

} else {

#if defined(CONFIG_USER_ONLY)