Peter Maydell (8):

target/arm: Fix handling of LPAE block descriptors

hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size

hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()

nsis installer: List emulators in alphabetical order

nsis installer: Suppress "ANSI targets are deprecated" warning

nsis installer: Fix mouse-over descriptions for emulators

target/arm: Log M-profile vector table accesses

target/arm: Log fault address for M-profile faults

Richard Henderson (2):

target/arm: Fix sve2 ldnt1 and stnt1

target/arm: Fix pauth_check_trap vs SEL2

meson.build | 23 ++-

include/hw/arm/xlnx-zynqmp.h | 4 +

include/hw/misc/xlnx-zynqmp-apu-ctrl.h | 93 ++++++++++++

include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++++

include/qemu/osdep.h | 8 +

target/arm/cpu.h | 3 +-

target/arm/sve.decode | 5 +-

hw/arm/virt.c | 7 +-

hw/arm/xlnx-zynqmp.c | 46 +++++-

hw/dma/xlnx_csu_dma.c | 1 +

hw/i386/acpi-build.c | 4 +-

hw/misc/npcm7xx_clk.c | 4 +-

hw/misc/xlnx-zynqmp-apu-ctrl.c | 253 +++++++++++++++++++++++++++++++

hw/misc/xlnx-zynqmp-crf.c | 266 +++++++++++++++++++++++++++++++++

target/arm/cpu.c | 17 ++-

target/arm/helper.c | 20 ++-

target/arm/m_helper.c | 11 ++

target/arm/pauth_helper.c | 2 +-

target/arm/translate-sve.c | 51 ++++++-

tests/tcg/aarch64/test-826.c | 50 +++++++

util/osdep.c | 10 --

hw/intc/Kconfig | 2 +-

hw/intc/meson.build | 4 +-

hw/misc/meson.build | 2 +

qemu.nsi | 8 +-

scripts/nsis.py | 17 ++-

tests/tcg/aarch64/Makefile.target | 4 +

tests/tcg/configure.sh | 4 +

28 files changed, 1084 insertions(+), 46 deletions(-)

create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h

create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h

create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c

create mode 100644 hw/misc/xlnx-zynqmp-crf.c

create mode 100644 tests/tcg/aarch64/test-826.c

- return trans_LD1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];

+ break;

+ case MO_64:

+ fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];

+ break;

+ }

+ assert(fn != NULL);

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, false, fn);

+ return true;

- return trans_ST1_zprz(s, a);

+ if (!sve_access_check(s)) {

+ return true;

+ }

+

+ switch (a->esz) {

+ case MO_32:

+ fn = scatter_store_fn32[mte][be][0][a->msz];

+ break;

+ case MO_64:

+ fn = scatter_store_fn64[mte][be][2][a->msz];

+ break;

+ default:

+ g_assert_not_reached();

+ }

+

+ do_mem_zpz(s, a->rd, a->pg, a->rn, 0,

+ cpu_reg(s, a->rm), a->msz, true, fn);

+ return true;

LPAE descriptors come in three forms:

* table descriptors, giving the address of the next level page table

* page descriptors, which occur only at level 3 and describe the

mapping of one page (which might be 4K, 16K or 64K)

* block descriptors, which occur at higher page table levels, and

describe the mapping of huge pages

QEMU's page-table-walk code treats block and page entries

identically, simply ORing in a number of bits from the input virtual

address that depends on the level of the page table that we stopped

at; we depend on the previous masking of descaddr with descaddrmask

to have already cleared out the low bits of the descriptor word.

This is not quite right: the address field in a block descriptor is

smaller, and so there are bits which are valid address bits in a page

descriptor or a table descriptor but which are not supposed to be

part of the address in a block descriptor, and descaddrmask does not

clear them. We previously mostly got away with this because those

descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)

block descriptor bit 16 is defined to be the nT bit. No emulated

QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might

see it when using KVM or hvf.

Explicitly zero out all the descaddr bits we're about to OR vaddr

bits into.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org

---

target/arm/helper.c | 10 ++++++++--

1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,

indexmask = indexmask_grainsize;

continue;

}

- /* Block entry at level 1 or 2, or page entry at level 3.

+ /*

+ * Block entry at level 1 or 2, or page entry at level 3.

* These are basically the same thing, although the number

- * of bits we pull in from the vaddr varies.

+ * of bits we pull in from the vaddr varies. Note that although

+ * descaddrmask masks enough of the low bits of the descriptor

+ * to give a correct page or table address, the address field

+ * in a block descriptor is smaller; so we need to explicitly

+ * clear the lower bits here before ORing in the low vaddr bits.

*/

page_size = (1ULL << ((stride * (4 - level)) + 3));

+ descaddr &= ~(page_size - 1);

descaddr |= (address & (page_size - 1));

/* Extract attributes from the descriptor */

attrs = extract64(descriptor, 2, 10)

--

2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its

own class struct, but forgot to update the TypeInfo::class_size

accordingly. This meant that not enough memory was allocated for the

class struct, and the initialization of xcdc->read in the class init

function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang

address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8

WRITE of size 8 at 0x61000000ab00 thread T0

#0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16

#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)

#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5

#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5

#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24

#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35

#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5

#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5

#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16

#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)

allocated by thread T0 here:

#0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)

#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)

#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org

---

hw/dma/xlnx_csu_dma.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/dma/xlnx_csu_dma.c

+++ b/hw/dma/xlnx_csu_dma.c

@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(XlnxCSUDMA),

.class_init = xlnx_csu_dma_class_init,

+ .class_size = sizeof(XlnxCSUDMAClass),

.instance_init = xlnx_csu_dma_init,

.interfaces = (InterfaceInfo[]) {

{ TYPE_STREAM_SINK },

--

2.25.1

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org

We currently list the emulators in the Windows installer's dialog

in an essentially random order (it's whatever glob.glob() returns

them to, which is filesystem-implementation-dependent). Add a

call to sorted() so they appear in alphabetical order.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Reviewed-by: John Snow <jsnow@redhat.com>

Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org

---

scripts/nsis.py | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py

index XXXXXXX..XXXXXXX 100644

--- a/scripts/nsis.py

+++ b/scripts/nsis.py

@@ -XXX,XX +XXX,XX @@ def main():

with open(

os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"

) as nsh:

- for exe in glob.glob(

+ for exe in sorted(glob.glob(

os.path.join(destdir + args.prefix, "qemu-system-*.exe")

- ):

+ )):

exe = os.path.basename(exe)

arch = exe[12:-4]

nsh.write(

--

2.25.1

When we build our Windows installer, it emits the warning:

warning 7998: ANSI targets are deprecated

Fix this by making our installer a Unicode installer instead. These

won't work on Win95/98/ME, but we already do not support those.

See

https://nsis.sourceforge.io/Docs/Chapter4.html#aunicodetarget

for the documentation of the Unicode directive.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Stefan Weil <sw@weilnetz.de>

Message-id: 20220305105743.2384766-3-peter.maydell@linaro.org

---

qemu.nsi | 3 +++

1 file changed, 3 insertions(+)

diff --git a/qemu.nsi b/qemu.nsi

index XXXXXXX..XXXXXXX 100644

--- a/qemu.nsi

+++ b/qemu.nsi

@@ -XXX,XX +XXX,XX @@

!define OUTFILE "qemu-setup.exe"

!endif

+; Build a unicode installer

+Unicode true

+

; Use maximum compression.

SetCompressor /SOLID lzma

--

2.25.1

We use the nsis.py script to write out an installer script Section

for each emulator executable, so the exact set of Sections depends on

which executables were built. However the part of qemu.nsi which

specifies mouse-over descriptions for each Section still has a

hard-coded and very outdated list (with just i386 and alpha). This

causes two problems. Firstly, if you build the installer for a

configuration where you didn't build the i386 binaries you get

warnings like this:

warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)

warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)

(this happens in our gitlab CI jobs, for instance).

Secondly, most of the emulators in the generated installer don't have

any mouseover text.

Make nsis.py generate a second output file which has the necessary

MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can

include that at the right point in qemu.nsi to set the mouse-over

text.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: John Snow <jsnow@redhat.com>

Message-id: 20220305105743.2384766-4-peter.maydell@linaro.org

---

qemu.nsi | 5 +----

scripts/nsis.py | 13 ++++++++++++-

2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/qemu.nsi b/qemu.nsi

index XXXXXXX..XXXXXXX 100644

--- a/qemu.nsi

+++ b/qemu.nsi

@@ -XXX,XX +XXX,XX @@ SectionEnd

; Descriptions (mouse-over).

!insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN

!insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem} "System emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha} "Alpha system emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386} "PC i386 system emulation."

- !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w} "PC i386 system emulation (GUI)."

+!include "${BINDIR}\system-mui-text.nsh"

!insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."

!ifdef DLLDIR

!insertmacro MUI_DESCRIPTION_TEXT ${SectionDll} "Runtime Libraries (DLL)."

diff --git a/scripts/nsis.py b/scripts/nsis.py

index XXXXXXX..XXXXXXX 100644

--- a/scripts/nsis.py

+++ b/scripts/nsis.py

@@ -XXX,XX +XXX,XX @@ def main():

subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])

with open(

os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"

- ) as nsh:

+ ) as nsh, open(

+ os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"

+ ) as muinsh:

for exe in sorted(glob.glob(

os.path.join(destdir + args.prefix, "qemu-system-*.exe")

)):

@@ -XXX,XX +XXX,XX @@ def main():

arch, exe

)

)

+ if arch.endswith('w'):

+ desc = arch[:-1] + " emulation (GUI)."

+ else:

+ desc = arch + " emulation."

+

+ muinsh.write(

+ """

+ !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"

+ """.format(arch, desc))

for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):

signcode(exe)

--

2.25.1

From: Eric Auger <eric.auger@redhat.com>

CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3

specific files. So let's rename it into CONFIG_ARM_GICV3_TCG

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20220308182452.223473-2-eric.auger@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/Kconfig | 2 +-

hw/intc/meson.build | 4 ++--

2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/Kconfig

+++ b/hw/intc/Kconfig

@@ -XXX,XX +XXX,XX @@ config APIC

select MSI_NONBROKEN

select I8259

-config ARM_GIC_TCG

+config ARM_GICV3_TCG

bool

default y

depends on ARM_GIC && TCG

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(

'arm_gicv3_common.c',

'arm_gicv3_its_common.c',

))

-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(

+softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(

'arm_gicv3.c',

'arm_gicv3_dist.c',

'arm_gicv3_its.c',

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))

+specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))

--

2.25.1

From: Eric Auger <eric.auger@redhat.com>

In TCG mode, if gic-version=max we always select GICv3 even if

CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.

This also brings the benefit of fixing qos tests errors for tests

using gic-version=max with CONFIG_ARM_GICV3_TCG unset.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20220308182452.223473-3-eric.auger@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/virt.c | 7 ++++++-

1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)

vms->gic_version = VIRT_GIC_VERSION_2;

break;

case VIRT_GIC_VERSION_MAX:

- vms->gic_version = VIRT_GIC_VERSION_3;

+ if (module_object_class_by_name("arm-gicv3")) {

+ /* CONFIG_ARM_GICV3_TCG was set */

+ vms->gic_version = VIRT_GIC_VERSION_3;

+ } else {

+ vms->gic_version = VIRT_GIC_VERSION_2;

+ }

break;

case VIRT_GIC_VERSION_HOST:

error_report("gic-version=host requires KVM");

--

2.25.1

Currently the CPU_LOG_INT logging misses some useful information

about loads from the vector table. Add logging where we load vector

table entries. This is particularly helpful for cases where the user

has accidentally not put a vector table in their image at all, which

can result in confusing guest crashes at startup.

Here's an example of the new logging for a case where

the vector table contains garbage:

Loaded reset SP 0x0 PC 0x0 from vector table

Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table

Taking exception 3 [Prefetch Abort] on CPU 0

...with CFSR.IACCVIOL

...BusFault with BFSR.STKERR

...taking pending nonsecure exception 3

...loading from element 3 of non-secure vector table at 0xc

...loaded new PC 0x20000558

----------------

IN:

0x20000558: 08000079 stmdaeq r0, {r0, r3, r4, r5, r6}

(The double reset logging is the result of our long-standing

"CPUs all get reset twice" weirdness; it looks a bit ugly

but it'll go away if we ever fix that :-))

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20220315204306.2797684-2-peter.maydell@linaro.org

---

target/arm/cpu.c | 5 +++++

target/arm/m_helper.c | 5 +++++

2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "qemu/qemu-print.h"

#include "qemu/timer.h"

+#include "qemu/log.h"

#include "qemu-common.h"

#include "target/arm/idau.h"

#include "qemu/module.h"

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)

initial_pc = ldl_phys(s->as, vecbase + 4);

}

+ qemu_log_mask(CPU_LOG_INT,

+ "Loaded reset SP 0x%x PC 0x%x from vector table\n",

+ initial_msp, initial_pc);

+

env->regs[13] = initial_msp & 0xFFFFFFFC;

env->regs[15] = initial_pc & ~1;

env->thumb = initial_pc & 1;

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,

ARMMMUIdx mmu_idx;

bool exc_secure;

+ qemu_log_mask(CPU_LOG_INT,

+ "...loading from element %d of %s vector table at 0x%x\n",

+ exc, targets_secure ? "secure" : "non-secure", addr);

+

mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);

/*

@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,

goto load_fail;

}

*pvec = vector_entry;

+ qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);

return true;

load_fail:

--

2.25.1

For M-profile, the fault address is not always exposed to the guest

in a fault register (for instance the BFAR bus fault address register

is only updated for bus faults on data accesses, not instruction

accesses). Currently we log the address only if we're putting it

into a particular guest-visible register. Since we always have it,

log it generically, to make logs of i-side faults a bit clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org

---

target/arm/m_helper.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/m_helper.c

+++ b/target/arm/m_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

* Note that for M profile we don't have a guest facing FSR, but

* the env->exception.fsr will be populated by the code that

* raises the fault, in the A profile short-descriptor format.

+ *

+ * Log the exception.vaddress now regardless of subtype, because

+ * logging below only logs it when it goes into a guest visible

+ * register.

*/

+ qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",

+ (uint32_t)env->exception.vaddress);

switch (env->exception.fsr & 0xf) {

case M_FAKE_FSR_NSC_EXEC:

/*

--

2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add an unimplemented SERDES (Serializer/Deserializer) area.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-zynqmp.h | 2 +-

hw/arm/xlnx-zynqmp.c | 5 +++++

2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-zynqmp.h

+++ b/include/hw/arm/xlnx-zynqmp.h

@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)

/*

* Unimplemented mmio regions needed to boot some images.

*/

-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1

+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2

struct XlnxZynqMPState {

/*< private >*/

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-zynqmp.c

+++ b/hw/arm/xlnx-zynqmp.c

@@ -XXX,XX +XXX,XX @@

#define QSPI_DMA_ADDR 0xff0f0800

#define NUM_QSPI_IRQ_LINES 2

+/* Serializer/Deserializer. */

+#define SERDES_ADDR 0xfd400000

+#define SERDES_SIZE 0x20000

+

#define DP_ADDR 0xfd4a0000

#define DP_IRQ 113

@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)

hwaddr size;

} unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {

{ .name = "apu", APU_ADDR, APU_SIZE },

+ { .name = "serdes", SERDES_ADDR, SERDES_SIZE },

};

unsigned int nr;

--

2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make the rvbar property settable after realize. This is done

in preparation to model the ZynqMP's runtime configurable rvbar.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.h | 3 ++-

target/arm/cpu.c | 12 +++++++-----

target/arm/helper.c | 10 +++++++---

3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {

uint64_t vbar_el[4];

};

uint32_t mvbar; /* (monitor) vector base address register */

+ uint64_t rvbar; /* rvbar sampled from rvbar property at reset */

struct { /* FCSE PID. */

uint32_t fcseidr_ns;

uint32_t fcseidr_s;

@@ -XXX,XX +XXX,XX @@ struct ArchCPU {

/* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */

uint32_t dcz_blocksize;

- uint64_t rvbar;

+ uint64_t rvbar_prop; /* Property/input signals. */

/* Configurable aspects of GIC cpu interface (which is part of the CPU) */

int gic_num_lrs; /* number of list registers */

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)

} else {

env->pstate = PSTATE_MODE_EL1h;

}

- env->pc = cpu->rvbar;

+

+ /* Sample rvbar at reset. */

+ env->cp15.rvbar = cpu->rvbar_prop;

+ env->pc = env->cp15.rvbar;

#endif

} else {

#if defined(CONFIG_USER_ONLY)

@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_cbar_property =

static Property arm_cpu_reset_hivecs_property =

DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);

-static Property arm_cpu_rvbar_property =

- DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);

-

#ifndef CONFIG_USER_ONLY

static Property arm_cpu_has_el2_property =

DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);

@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)

}

if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {

- qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);

+ object_property_add_uint64_ptr(obj, "rvbar",

+ &cpu->rvbar_prop,

+ OBJ_PROP_FLAG_READWRITE);

}

#ifndef CONFIG_USER_ONLY

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

ARMCPRegInfo rvbar = {

.name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,

- .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar

+ .access = PL1_R,

+ .fieldoffset = offsetof(CPUARMState, cp15.rvbar),

};

define_one_arm_cp_reg(cpu, &rvbar);

}

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

ARMCPRegInfo rvbar = {

.name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,

- .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar

+ .access = PL2_R,

+ .fieldoffset = offsetof(CPUARMState, cp15.rvbar),

};

define_one_arm_cp_reg(cpu, &rvbar);

}

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

ARMCPRegInfo el3_regs[] = {

{ .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,

- .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },

+ .access = PL3_R,

+ .fieldoffset = offsetof(CPUARMState, cp15.rvbar),

+ },

{ .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,

.access = PL3_RW,

--

2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx ZynqMP CRF. At the moment this

is mostly a stub model.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20220316164645.2303510-4-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++

hw/misc/xlnx-zynqmp-crf.c | 266 ++++++++++++++++++++++++++++++

hw/misc/meson.build | 1 +

3 files changed, 478 insertions(+)

create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h

create mode 100644 hw/misc/xlnx-zynqmp-crf.c

diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/include/hw/misc/xlnx-zynqmp-crf.h

@@ -XXX,XX +XXX,XX @@

+/*

+ * QEMU model of the CRF - Clock Reset FPD.

+ *

+ * Copyright (c) 2022 Xilinx Inc.

+ * SPDX-License-Identifier: GPL-2.0-or-later

+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>

+ */

+#ifndef HW_MISC_XLNX_ZYNQMP_CRF_H

+#define HW_MISC_XLNX_ZYNQMP_CRF_H

+

+#include "hw/sysbus.h"

+#include "hw/register.h"

+

+#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"

+OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPCRF, XLNX_ZYNQMP_CRF)

+

+REG32(ERR_CTRL, 0x0)

+ FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)

+REG32(IR_STATUS, 0x4)

+ FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)

+REG32(IR_MASK, 0x8)

+ FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)

+REG32(IR_ENABLE, 0xc)

+ FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)

+REG32(IR_DISABLE, 0x10)

+ FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)

+REG32(CRF_WPROT, 0x1c)

+ FIELD(CRF_WPROT, ACTIVE, 0, 1)

+REG32(APLL_CTRL, 0x20)

+ FIELD(APLL_CTRL, POST_SRC, 24, 3)

+ FIELD(APLL_CTRL, PRE_SRC, 20, 3)

+ FIELD(APLL_CTRL, CLKOUTDIV, 17, 1)

+ FIELD(APLL_CTRL, DIV2, 16, 1)

+ FIELD(APLL_CTRL, FBDIV, 8, 7)

+ FIELD(APLL_CTRL, BYPASS, 3, 1)

+ FIELD(APLL_CTRL, RESET, 0, 1)

+REG32(APLL_CFG, 0x24)

+ FIELD(APLL_CFG, LOCK_DLY, 25, 7)

+ FIELD(APLL_CFG, LOCK_CNT, 13, 10)

+ FIELD(APLL_CFG, LFHF, 10, 2)

+ FIELD(APLL_CFG, CP, 5, 4)

+ FIELD(APLL_CFG, RES, 0, 4)

+REG32(APLL_FRAC_CFG, 0x28)

+ FIELD(APLL_FRAC_CFG, ENABLED, 31, 1)

+ FIELD(APLL_FRAC_CFG, SEED, 22, 3)

+ FIELD(APLL_FRAC_CFG, ALGRTHM, 19, 1)

+ FIELD(APLL_FRAC_CFG, ORDER, 18, 1)

+ FIELD(APLL_FRAC_CFG, DATA, 0, 16)

+REG32(DPLL_CTRL, 0x2c)

+ FIELD(DPLL_CTRL, POST_SRC, 24, 3)

+ FIELD(DPLL_CTRL, PRE_SRC, 20, 3)

+ FIELD(DPLL_CTRL, CLKOUTDIV, 17, 1)

+ FIELD(DPLL_CTRL, DIV2, 16, 1)

+ FIELD(DPLL_CTRL, FBDIV, 8, 7)

+ FIELD(DPLL_CTRL, BYPASS, 3, 1)

+ FIELD(DPLL_CTRL, RESET, 0, 1)

+REG32(DPLL_CFG, 0x30)

+ FIELD(DPLL_CFG, LOCK_DLY, 25, 7)

+ FIELD(DPLL_CFG, LOCK_CNT, 13, 10)

+ FIELD(DPLL_CFG, LFHF, 10, 2)

+ FIELD(DPLL_CFG, CP, 5, 4)

+ FIELD(DPLL_CFG, RES, 0, 4)

+REG32(DPLL_FRAC_CFG, 0x34)

+ FIELD(DPLL_FRAC_CFG, ENABLED, 31, 1)

+ FIELD(DPLL_FRAC_CFG, SEED, 22, 3)

+ FIELD(DPLL_FRAC_CFG, ALGRTHM, 19, 1)

+ FIELD(DPLL_FRAC_CFG, ORDER, 18, 1)

+ FIELD(DPLL_FRAC_CFG, DATA, 0, 16)

+REG32(VPLL_CTRL, 0x38)

+ FIELD(VPLL_CTRL, POST_SRC, 24, 3)

+ FIELD(VPLL_CTRL, PRE_SRC, 20, 3)

+ FIELD(VPLL_CTRL, CLKOUTDIV, 17, 1)

+ FIELD(VPLL_CTRL, DIV2, 16, 1)

+ FIELD(VPLL_CTRL, FBDIV, 8, 7)

+ FIELD(VPLL_CTRL, BYPASS, 3, 1)

+ FIELD(VPLL_CTRL, RESET, 0, 1)

+REG32(VPLL_CFG, 0x3c)

+ FIELD(VPLL_CFG, LOCK_DLY, 25, 7)

+ FIELD(VPLL_CFG, LOCK_CNT, 13, 10)

+ FIELD(VPLL_CFG, LFHF, 10, 2)

+ FIELD(VPLL_CFG, CP, 5, 4)

+ FIELD(VPLL_CFG, RES, 0, 4)

+REG32(VPLL_FRAC_CFG, 0x40)

+ FIELD(VPLL_FRAC_CFG, ENABLED, 31, 1)

+ FIELD(VPLL_FRAC_CFG, SEED, 22, 3)

+ FIELD(VPLL_FRAC_CFG, ALGRTHM, 19, 1)

+ FIELD(VPLL_FRAC_CFG, ORDER, 18, 1)

+ FIELD(VPLL_FRAC_CFG, DATA, 0, 16)

+REG32(PLL_STATUS, 0x44)

+ FIELD(PLL_STATUS, VPLL_STABLE, 5, 1)

+ FIELD(PLL_STATUS, DPLL_STABLE, 4, 1)

+ FIELD(PLL_STATUS, APLL_STABLE, 3, 1)

+ FIELD(PLL_STATUS, VPLL_LOCK, 2, 1)

+ FIELD(PLL_STATUS, DPLL_LOCK, 1, 1)

+ FIELD(PLL_STATUS, APLL_LOCK, 0, 1)

+REG32(APLL_TO_LPD_CTRL, 0x48)

+ FIELD(APLL_TO_LPD_CTRL, DIVISOR0, 8, 6)

+REG32(DPLL_TO_LPD_CTRL, 0x4c)

+ FIELD(DPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)

+REG32(VPLL_TO_LPD_CTRL, 0x50)

+ FIELD(VPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)

+REG32(ACPU_CTRL, 0x60)

+ FIELD(ACPU_CTRL, CLKACT_HALF, 25, 1)

+ FIELD(ACPU_CTRL, CLKACT_FULL, 24, 1)

+ FIELD(ACPU_CTRL, DIVISOR0, 8, 6)

+ FIELD(ACPU_CTRL, SRCSEL, 0, 3)

+REG32(DBG_TRACE_CTRL, 0x64)

+ FIELD(DBG_TRACE_CTRL, CLKACT, 24, 1)

+ FIELD(DBG_TRACE_CTRL, DIVISOR0, 8, 6)

+ FIELD(DBG_TRACE_CTRL, SRCSEL, 0, 3)

+REG32(DBG_FPD_CTRL, 0x68)

+ FIELD(DBG_FPD_CTRL, CLKACT, 24, 1)

+ FIELD(DBG_FPD_CTRL, DIVISOR0, 8, 6)

+ FIELD(DBG_FPD_CTRL, SRCSEL, 0, 3)

+REG32(DP_VIDEO_REF_CTRL, 0x70)

+ FIELD(DP_VIDEO_REF_CTRL, CLKACT, 24, 1)

+ FIELD(DP_VIDEO_REF_CTRL, DIVISOR1, 16, 6)

+ FIELD(DP_VIDEO_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(DP_VIDEO_REF_CTRL, SRCSEL, 0, 3)

+REG32(DP_AUDIO_REF_CTRL, 0x74)

+ FIELD(DP_AUDIO_REF_CTRL, CLKACT, 24, 1)

+ FIELD(DP_AUDIO_REF_CTRL, DIVISOR1, 16, 6)

+ FIELD(DP_AUDIO_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(DP_AUDIO_REF_CTRL, SRCSEL, 0, 3)

+REG32(DP_STC_REF_CTRL, 0x7c)

+ FIELD(DP_STC_REF_CTRL, CLKACT, 24, 1)

+ FIELD(DP_STC_REF_CTRL, DIVISOR1, 16, 6)

+ FIELD(DP_STC_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(DP_STC_REF_CTRL, SRCSEL, 0, 3)

+REG32(DDR_CTRL, 0x80)

+ FIELD(DDR_CTRL, CLKACT, 24, 1)

+ FIELD(DDR_CTRL, DIVISOR0, 8, 6)

+ FIELD(DDR_CTRL, SRCSEL, 0, 3)

+REG32(GPU_REF_CTRL, 0x84)

+ FIELD(GPU_REF_CTRL, PP1_CLKACT, 26, 1)

+ FIELD(GPU_REF_CTRL, PP0_CLKACT, 25, 1)

+ FIELD(GPU_REF_CTRL, CLKACT, 24, 1)

+ FIELD(GPU_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(GPU_REF_CTRL, SRCSEL, 0, 3)

+REG32(SATA_REF_CTRL, 0xa0)

+ FIELD(SATA_REF_CTRL, CLKACT, 24, 1)

+ FIELD(SATA_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(SATA_REF_CTRL, SRCSEL, 0, 3)

+REG32(PCIE_REF_CTRL, 0xb4)

+ FIELD(PCIE_REF_CTRL, CLKACT, 24, 1)

+ FIELD(PCIE_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(PCIE_REF_CTRL, SRCSEL, 0, 3)

+REG32(GDMA_REF_CTRL, 0xb8)

+ FIELD(GDMA_REF_CTRL, CLKACT, 24, 1)

+ FIELD(GDMA_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(GDMA_REF_CTRL, SRCSEL, 0, 3)

+REG32(DPDMA_REF_CTRL, 0xbc)

+ FIELD(DPDMA_REF_CTRL, CLKACT, 24, 1)

+ FIELD(DPDMA_REF_CTRL, DIVISOR0, 8, 6)

+ FIELD(DPDMA_REF_CTRL, SRCSEL, 0, 3)

+REG32(TOPSW_MAIN_CTRL, 0xc0)

+ FIELD(TOPSW_MAIN_CTRL, CLKACT, 24, 1)

+ FIELD(TOPSW_MAIN_CTRL, DIVISOR0, 8, 6)

+ FIELD(TOPSW_MAIN_CTRL, SRCSEL, 0, 3)

+REG32(TOPSW_LSBUS_CTRL, 0xc4)

+ FIELD(TOPSW_LSBUS_CTRL, CLKACT, 24, 1)

+ FIELD(TOPSW_LSBUS_CTRL, DIVISOR0, 8, 6)

+ FIELD(TOPSW_LSBUS_CTRL, SRCSEL, 0, 3)

+REG32(DBG_TSTMP_CTRL, 0xf8)

+ FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 6)

+ FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)