The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:

Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2

for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:

target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)

RISC-V PR for 6.0

This PR includes:

- Fix for vector CSR access

- Improvements to the Ibex UART device

- PMP improvements and bug fixes

- Hypervisor extension bug fixes

- ramfb support for the virt machine

- Fast read support for SST flash

- Improvements to the microchip_pfsoc machine

Alexander Wagner (1):

hw/char: disable ibex uart receive if the buffer is full

Asherah Connor (2):

hw/riscv: Add fw_cfg support to virt

hw/riscv: allow ramfb on virt

Bin Meng (3):

hw/block: m25p80: Support fast read for SST flashes

hw/riscv: microchip_pfsoc: Map EMMC/SD mux register

docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine

Frank Chang (1):

target/riscv: fix vs() to return proper error code

Georg Kotheimer (6):

target/riscv: Adjust privilege level for HLV(X)/HSV instructions

target/riscv: Make VSTIP and VSEIP read-only in hip

target/riscv: Use background registers also for MSTATUS_MPV

target/riscv: Fix read and write accesses to vsip and vsie

target/riscv: Add proper two-stage lookup exception detection

target/riscv: Prevent lost illegal instruction exceptions

Jim Shu (3):

target/riscv: propagate PMP permission to TLB page

target/riscv: add log of PMP permission checking

target/riscv: flush TLB pages if PMP permission has been changed

docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++

docs/system/target-riscv.rst | 1 +

include/hw/char/ibex_uart.h | 4 +

include/hw/riscv/microchip_pfsoc.h | 1 +

include/hw/riscv/virt.h | 2 +

target/riscv/cpu.h | 4 +

target/riscv/pmp.h | 4 +-

hw/block/m25p80.c | 3 +

hw/char/ibex_uart.c | 23 +++-

hw/riscv/microchip_pfsoc.c | 6 +

hw/riscv/virt.c | 33 ++++++

target/riscv/cpu.c | 1 +

target/riscv/cpu_helper.c | 144 +++++++++++++++--------

target/riscv/csr.c | 77 +++++++------

target/riscv/pmp.c | 84 ++++++++++----

target/riscv/translate.c | 179 +----------------------------

hw/riscv/Kconfig | 1 +

17 files changed, 367 insertions(+), 289 deletions(-)

create mode 100644 docs/system/riscv/microchip-icicle-kit.rst

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current two-stage lookup detection in riscv_cpu_do_interrupt falls

short of its purpose, as all it checks is whether two-stage address

translation either via the hypervisor-load store instructions or the

MPRV feature would be allowed.

What we really need instead is whether two-stage address translation was

active when the exception was raised. However, in riscv_cpu_do_interrupt

we do not have the information to reliably detect this. Therefore, when

we raise a memory fault exception we have to record whether two-stage

address translation is active.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com

target/riscv/cpu.h | 4 ++++

target/riscv/cpu.c | 1 +

target/riscv/cpu_helper.c | 21 ++++++++-------------

3 files changed, 13 insertions(+), 13 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)

env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);

env->mcause = 0;

env->pc = env->resetvec;

+ env->two_stage_lookup = false;

#endif

cs->exception_index = EXCP_NONE;

env->load_res = -1;

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/riscv/cpu_helper.c

+++ b/target/riscv/cpu_helper.c

@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,

g_assert_not_reached();

}

env->badaddr = address;

+ env->two_stage_lookup = two_stage;

}

hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)

@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,

}

env->badaddr = addr;

+ env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||

+ riscv_cpu_two_stage_lookup(mmu_idx);

riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);

}

@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,

g_assert_not_reached();

}

env->badaddr = addr;

+ env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||

+ riscv_cpu_two_stage_lookup(mmu_idx);

riscv_raise_exception(env, cs->exception_index, retaddr);

}

#endif /* !CONFIG_USER_ONLY */

@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)

/* handle the trap in S-mode */

if (riscv_has_ext(env, RVH)) {

target_ulong hdeleg = async ? env->hideleg : env->hedeleg;

- bool two_stage_lookup = false;

- if (env->priv == PRV_M ||

- (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||

- (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&

- get_field(env->hstatus, HSTATUS_HU))) {

- two_stage_lookup = true;

- }

- if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {

+ if (env->two_stage_lookup && write_tval) {

/*

* If we are writing a guest virtual address to stval, set

* this to 1. If we are trapping to VS we will set this to 0

@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)

riscv_cpu_set_force_hs_excep(env, 0);

} else {

/* Trap into HS mode */

- if (!two_stage_lookup) {

- env->hstatus = set_field(env->hstatus, HSTATUS_SPV,

- riscv_cpu_virt_enabled(env));

- }

+ env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);

htval = env->guest_phys_fault_addr;

}

}

@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)

* RISC-V ISA Specification.

*/

+ env->two_stage_lookup = false;

#endif

cs->exception_index = EXCP_NONE; /* mark handled to qemu */

}

2.30.1