Mostly straightforward bugfixes. The new Xilinx devices are

arguably 'new feature', but they're fixing a regression where

our changes to PSCI in commit 3f37979bf mean that EL3 guest

code now needs to talk to a proper emulated power-controller

device to turn on secondary CPUs; and it's not yet rc1 and

they only affect the Xilinx board, so it seems OK to me.

The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:

Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318

for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:

util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)

* Fix sve2 ldnt1 and stnt1

* Fix pauth_check_trap vs SEL2

* Fix handling of LPAE block descriptors

* hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size

* hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()

* nsis installer: List emulators in alphabetical order

* nsis installer: Suppress "ANSI targets are deprecated" warning

* nsis installer: Fix mouse-over descriptions for emulators

* hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

* Improve M-profile vector table access logging

* Xilinx ZynqMP: model CRF and APU control

* Fix compile issues on modern Solaris

Andrew Deason (3):

util/osdep: Avoid madvise proto on modern Solaris

hw/i386/acpi-build: Avoid 'sun' identifier

util/osdep: Remove some early cruft

Edgar E. Iglesias (6):

hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area

target/arm: Make rvbar settable after realize

hw/misc: Add a model of the Xilinx ZynqMP CRF

hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF

hw/misc: Add a model of the Xilinx ZynqMP APU Control

hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control

Eric Auger (2):

hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG

hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

Peter Maydell (8):

target/arm: Fix handling of LPAE block descriptors

hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size

hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()

nsis installer: List emulators in alphabetical order

nsis installer: Suppress "ANSI targets are deprecated" warning

nsis installer: Fix mouse-over descriptions for emulators

target/arm: Log M-profile vector table accesses

target/arm: Log fault address for M-profile faults

Richard Henderson (2):

target/arm: Fix sve2 ldnt1 and stnt1

target/arm: Fix pauth_check_trap vs SEL2

meson.build | 23 ++-

include/hw/arm/xlnx-zynqmp.h | 4 +

include/hw/misc/xlnx-zynqmp-apu-ctrl.h | 93 ++++++++++++

include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++++

include/qemu/osdep.h | 8 +

target/arm/cpu.h | 3 +-

target/arm/sve.decode | 5 +-

hw/arm/virt.c | 7 +-

hw/arm/xlnx-zynqmp.c | 46 +++++-

hw/dma/xlnx_csu_dma.c | 1 +

hw/i386/acpi-build.c | 4 +-

hw/misc/npcm7xx_clk.c | 4 +-

hw/misc/xlnx-zynqmp-apu-ctrl.c | 253 +++++++++++++++++++++++++++++++

hw/misc/xlnx-zynqmp-crf.c | 266 +++++++++++++++++++++++++++++++++

target/arm/cpu.c | 17 ++-

target/arm/helper.c | 20 ++-

target/arm/m_helper.c | 11 ++

target/arm/pauth_helper.c | 2 +-

target/arm/translate-sve.c | 51 ++++++-

tests/tcg/aarch64/test-826.c | 50 +++++++

util/osdep.c | 10 --

hw/intc/Kconfig | 2 +-

hw/intc/meson.build | 4 +-

hw/misc/meson.build | 2 +

qemu.nsi | 8 +-

scripts/nsis.py | 17 ++-

tests/tcg/aarch64/Makefile.target | 4 +

tests/tcg/configure.sh | 4 +

28 files changed, 1084 insertions(+), 46 deletions(-)

create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h

create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h

create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c

create mode 100644 hw/misc/xlnx-zynqmp-crf.c

create mode 100644 tests/tcg/aarch64/test-826.c

From: Richard Henderson <richard.henderson@linaro.org>

For both ldnt1 and stnt1, the meaning of the Rn and Rm are different

from ld1 and st1: the vector and integer registers are reversed, and

the integer register 31 refers to XZR instead of SP.

Secondly, the 64-bit version of ldnt1 was being interpreted as

32-bit unpacked unscaled offset instead of 64-bit unscaled offset,

which discarded the upper 32 bits of the address coming from

the vector argument.

Thirdly, validate that the memory element size is in range for the

vector element size for ldnt1. For ld1, we do this via independent

decode patterns, but for ldnt1 we need to do it manually.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

target/arm/sve.decode | 5 ++-

target/arm/translate-sve.c | 51 +++++++++++++++++++++++++++++--

tests/tcg/aarch64/test-826.c | 50 ++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 4 +++

tests/tcg/configure.sh | 4 +++

5 files changed, 109 insertions(+), 5 deletions(-)

create mode 100644 tests/tcg/aarch64/test-826.c

diff --git a/target/arm/sve.decode b/target/arm/sve.decode

--- a/target/arm/sve.decode

+++ b/target/arm/sve.decode

@@ -XXX,XX +XXX,XX @@ USDOT_zzzz 01000100 .. 0 ..... 011 110 ..... ..... @rda_rn_rm

### SVE2 Memory Gather Load Group

-# SVE2 64-bit gather non-temporal load

-# (scalar plus unpacked 32-bit unscaled offsets)

+# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)

LDNT1_zprz 1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \

- &rprr_gather_load xs=0 esz=3 scale=0 ff=0

+ &rprr_gather_load xs=2 esz=3 scale=0 ff=0

# SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)

LDNT1_zprz 1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)

static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)

{

+ gen_helper_gvec_mem_scatter *fn = NULL;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz + !a->u) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

return false;

}

- return trans_LD1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];

+ break;

+ case MO_64:

+ fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];

+ break;

+ }

+ assert(fn != NULL);

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, false, fn);

+ return true;

/* Indexed by [mte][be][xs][msz]. */

@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)

static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)

{

+ gen_helper_gvec_mem_scatter *fn;

+ bool be = s->be_data == MO_BE;

+ bool mte = s->mte_active[0];

+

+ if (a->esz < a->msz) {

+ return false;

+ }

if (!dc_isar_feature(aa64_sve2, s)) {

return false;

}

- return trans_ST1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = scatter_store_fn32[mte][be][0][a->msz];

+ break;

+ case MO_64:

+ fn = scatter_store_fn64[mte][be][2][a->msz];

+ break;

+ default:

+ g_assert_not_reached();

+ }

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, true, fn);

+ return true;

}

/*

diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/aarch64/test-826.c

@@ -XXX,XX +XXX,XX @@

+#include <sys/mman.h>

+#include <unistd.h>

+#include <signal.h>

+#include <stdlib.h>

+#include <stdio.h>

+#include <assert.h>

+

+static void *expected;

+

+void sigsegv(int sig, siginfo_t *info, void *vuc)

+ ucontext_t *uc = vuc;

+

+ assert(info->si_addr == expected);

+ uc->uc_mcontext.pc += 4;

+int main()

+{

+ struct sigaction sa = {

+ .sa_sigaction = sigsegv,

+ .sa_flags = SA_SIGINFO

+ };

+

+ void *page;

+ long ofs;

+

+ if (sigaction(SIGSEGV, &sa, NULL) < 0) {

+ perror("sigaction");

+ return EXIT_FAILURE;

+ }

+

+ page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);

+ if (page == MAP_FAILED) {

+ perror("mmap");

+ return EXIT_FAILURE;

+ }

+

+ ofs = 0x124;

+ expected = page + ofs;

+

+ asm("ptrue p0.d, vl1\n\t"

+ "dup z0.d, %0\n\t"

+ "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"

+ "dup z1.d, %1\n\t"

+ "ldnt1h {z0.d}, p0/z, [z1.d, %0]"

+ : : "r"(page), "r"(ofs) : "v0", "v1");

+

+ return EXIT_SUCCESS;

+}

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/Makefile.target

+++ b/tests/tcg/aarch64/Makefile.target

@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls

EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls

endif

+endif

+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)

+AARCH64_TESTS += test-826

+test-826: CFLAGS+=-march=armv8.1-a+sve2

endif

TESTS += $(AARCH64_TESTS)

diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh

index XXXXXXX..XXXXXXX 100755

--- a/tests/tcg/configure.sh

+++ b/tests/tcg/configure.sh

@@ -XXX,XX +XXX,XX @@ for target in $target_list; do

-march=armv8.1-a+sve -o $TMPE $TMPC; then

echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak

fi

+ if do_compiler "$target_compiler" $target_compiler_cflags \

+ -march=armv8.1-a+sve2 -o $TMPE $TMPC; then

+ echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak

+ fi

if do_compiler "$target_compiler" $target_compiler_cflags \

-march=armv8.3-a -o $TMPE $TMPC; then

echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak

2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When arm_is_el2_enabled was introduced, we missed

updating pauth_check_trap.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788

Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20220315021205.342768-1-richard.henderson@linaro.org

target/arm/pauth_helper.c | 2 +-

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c

--- a/target/arm/pauth_helper.c

+++ b/target/arm/pauth_helper.c

@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,

static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)

{

- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {

+ if (el < 2 && arm_is_el2_enabled(env)) {

uint64_t hcr = arm_hcr_el2_eff(env);

bool trap = !(hcr & HCR_API);

if (el == 0) {

2.25.1

LPAE descriptors come in three forms:

* table descriptors, giving the address of the next level page table

* page descriptors, which occur only at level 3 and describe the

mapping of one page (which might be 4K, 16K or 64K)

* block descriptors, which occur at higher page table levels, and

describe the mapping of huge pages

QEMU's page-table-walk code treats block and page entries

identically, simply ORing in a number of bits from the input virtual

address that depends on the level of the page table that we stopped

at; we depend on the previous masking of descaddr with descaddrmask

to have already cleared out the low bits of the descriptor word.

This is not quite right: the address field in a block descriptor is

smaller, and so there are bits which are valid address bits in a page

descriptor or a table descriptor but which are not supposed to be

part of the address in a block descriptor, and descaddrmask does not

clear them. We previously mostly got away with this because those

descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)

block descriptor bit 16 is defined to be the nT bit. No emulated

QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might

see it when using KVM or hvf.

Explicitly zero out all the descaddr bits we're about to OR vaddr

bits into.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790

target/arm/helper.c | 10 ++++++++--

1 file changed, 8 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,

indexmask = indexmask_grainsize;

continue;

2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its

own class struct, but forgot to update the TypeInfo::class_size

accordingly. This meant that not enough memory was allocated for the

class struct, and the initialization of xcdc->read in the class init

function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang

address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8

WRITE of size 8 at 0x61000000ab00 thread T0

#0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16

#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)

#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5

#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5

#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24

#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35

#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5

#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5

#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)

allocated by thread T0 here:

#0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)

#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org

---

hw/dma/xlnx_csu_dma.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c

--- a/hw/dma/xlnx_csu_dma.c

+++ b/hw/dma/xlnx_csu_dma.c

@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(XlnxCSUDMA),

.class_init = xlnx_csu_dma_class_init,

+ .class_size = sizeof(XlnxCSUDMAClass),

.instance_init = xlnx_csu_dma_init,

.interfaces = (InterfaceInfo[]) {

{ TYPE_STREAM_SINK },

2.25.1

In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().

Use g_autofree so we free it rather than leaking it.

(Detected with the clang leak sanitizer.)

Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org

hw/misc/npcm7xx_clk.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c

--- a/hw/misc/npcm7xx_clk.c

+++ b/hw/misc/npcm7xx_clk.c

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)

NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);

for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {

- sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),

- g_strdup_printf("clock-in[%d]", i),

+ g_autofree char *s = g_strdup_printf("clock-in[%d]", i);

+ sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,

npcm7xx_clk_update_sel_cb, sel, ClockUpdate);

}

sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");

2.25.1

We currently list the emulators in the Windows installer's dialog

in an essentially random order (it's whatever glob.glob() returns

them to, which is filesystem-implementation-dependent). Add a

call to sorted() so they appear in alphabetical order.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Reviewed-by: John Snow <jsnow@redhat.com>

Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org

scripts/nsis.py | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py

--- a/scripts/nsis.py

+++ b/scripts/nsis.py

@@ -XXX,XX +XXX,XX @@ def main():

with open(

os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"

) as nsh:

- for exe in glob.glob(

+ for exe in sorted(glob.glob(

os.path.join(destdir + args.prefix, "qemu-system-*.exe")

- ):

+ )):

exe = os.path.basename(exe)

arch = exe[12:-4]

nsh.write(

2.25.1

When we build our Windows installer, it emits the warning:

warning 7998: ANSI targets are deprecated

Fix this by making our installer a Unicode installer instead. These

won't work on Win95/98/ME, but we already do not support those.

See

https://nsis.sourceforge.io/Docs/Chapter4.html#aunicodetarget

for the documentation of the Unicode directive.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Message-id: 20220305105743.2384766-3-peter.maydell@linaro.org