1
arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
1
Hi; here's a relatively small target-arm queue, pretty much all
2
patches, which are somewhere between a bugfix and a new feature.
2
bug fixes. (There are a few non-arm patches that I've thrown in
3
there too for my convenience :-))
3
4
4
thanks
5
thanks
5
-- PMM
6
-- PMM
6
7
7
The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
8
The following changes since commit 278238505d28d292927bff7683f39fb4fbca7fd1:
8
9
9
Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
10
Merge tag 'pull-tcg-20230511-2' of https://gitlab.com/rth7680/qemu into staging (2023-05-11 11:44:23 +0100)
10
11
11
are available in the Git repository at:
12
are available in the Git repository at:
12
13
13
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
14
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230512
14
15
15
for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
16
for you to fetch changes up to 478dccbb99db0bf8f00537dd0b4d0de88d5cb537:
16
17
17
hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
18
target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check (2023-05-12 16:01:25 +0100)
18
19
19
----------------------------------------------------------------
20
----------------------------------------------------------------
20
target-arm queue:
21
target-arm queue:
21
* hw/arm/smmuv3: Check 31st bit to see if CD is valid
22
* More refactoring of files into tcg/
22
* qemu-options.hx: Fix formatting of -machine memory-backend option
23
* Don't allow stage 2 page table walks to downgrade to NS
23
* hw: aspeed_gpio: Fix memory size
24
* Fix handling of SW and NSW bits for stage 2 walks
24
* hw/arm/nseries: Display hexadecimal value with '0x' prefix
25
* MAINTAINERS: Update Akihiko Odaki's email address
25
* Add sve-default-vector-length cpu property
26
* ui: Fix pixel colour channel order for PNG screenshots
26
* docs: Update path that mentions deprecated.rst
27
* docs: Remove unused weirdly-named cross-reference targets
27
* hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
28
* hw/mips/malta: Fix minor dead code issue
28
* hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
29
* Fixes for the "allow CONFIG_TCG=n" changes
29
* hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
30
* tests/qtest: Don't run cdrom boot tests if no accelerator is present
30
* target/arm: Report M-profile alignment faults correctly to the guest
31
* target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check
31
* target/arm: Add missing 'return's after calling v7m_exception_taken()
32
* target/arm: Enforce that M-profile SP low 2 bits are always zero
33
32
34
----------------------------------------------------------------
33
----------------------------------------------------------------
35
Joe Komlodi (1):
34
Akihiko Odaki (1):
36
hw/arm/smmuv3: Check 31st bit to see if CD is valid
35
MAINTAINERS: Update Akihiko Odaki's email address
37
36
38
Joel Stanley (1):
37
Fabiano Rosas (3):
39
hw: aspeed_gpio: Fix memory size
38
target/arm: Select SEMIHOSTING when using TCG
39
target/arm: Select CONFIG_ARM_V7M when TCG is enabled
40
tests/qtest: Don't run cdrom boot tests if no accelerator is present
40
41
41
Mao Zhongyi (1):
42
Peter Maydell (6):
42
docs: Update path that mentions deprecated.rst
43
target/arm: Don't allow stage 2 page table walks to downgrade to NS
44
target/arm: Fix handling of SW and NSW bits for stage 2 walks
45
ui: Fix pixel colour channel order for PNG screenshots
46
docs: Remove unused weirdly-named cross-reference targets
47
hw/mips/malta: Fix minor dead code issue
48
target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check
43
49
44
Peter Maydell (7):
50
Richard Henderson (2):
45
qemu-options.hx: Fix formatting of -machine memory-backend option
51
target/arm: Move translate-a32.h, arm_ldst.h, sve_ldst_internal.h to tcg/
46
target/arm: Enforce that M-profile SP low 2 bits are always zero
52
target/arm: Move helper-{a64,mve,sme,sve}.h to tcg/
47
target/arm: Add missing 'return's after calling v7m_exception_taken()
48
target/arm: Report M-profile alignment faults correctly to the guest
49
hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
50
hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
51
hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
52
53
53
Philippe Mathieu-Daudé (1):
54
MAINTAINERS | 4 +-
54
hw/arm/nseries: Display hexadecimal value with '0x' prefix
55
docs/system/devices/igb.rst | 2 +-
55
56
docs/system/devices/ivshmem.rst | 2 -
56
Richard Henderson (3):
57
docs/system/devices/net.rst | 2 +-
57
target/arm: Correctly bound length in sve_zcr_get_valid_len
58
docs/system/devices/usb.rst | 2 -
58
target/arm: Export aarch64_sve_zcr_get_valid_len
59
docs/system/keys.rst | 2 +-
59
target/arm: Add sve-default-vector-length cpu property
60
docs/system/linuxboot.rst | 2 +-
60
61
docs/system/target-i386.rst | 4 --
61
docs/system/arm/cpu-features.rst | 15 ++++++++++
62
target/arm/helper.h | 8 +--
62
configure | 2 +-
63
target/arm/internals.h | 12 +++-
63
hw/arm/smmuv3-internal.h | 2 +-
64
target/arm/{ => tcg}/arm_ldst.h | 0
64
target/arm/cpu.h | 5 ++++
65
target/arm/{ => tcg}/helper-a64.h | 0
65
target/arm/internals.h | 10 +++++++
66
target/arm/{ => tcg}/helper-mve.h | 0
66
hw/arm/nseries.c | 2 +-
67
target/arm/{ => tcg}/helper-sme.h | 0
67
hw/gpio/aspeed_gpio.c | 3 +-
68
target/arm/{ => tcg}/helper-sve.h | 0
68
hw/intc/armv7m_nvic.c | 40 +++++++++++++++++++--------
69
target/arm/{ => tcg}/sve_ldst_internal.h | 0
69
target/arm/cpu.c | 14 ++++++++--
70
target/arm/{ => tcg}/translate-a32.h | 0
70
target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++++++++++
71
hw/mips/malta.c | 5 +-
71
target/arm/gdbstub.c | 4 +++
72
target/arm/gdbstub64.c | 2 +-
72
target/arm/helper.c | 8 ++++--
73
target/arm/helper.c | 15 ++++-
73
target/arm/m_helper.c | 24 ++++++++++++----
74
target/arm/ptw.c | 95 +++++++++++++++++++-------------
74
target/arm/translate.c | 3 ++
75
target/arm/tcg/pauth_helper.c | 6 +-
75
target/i386/cpu.c | 2 +-
76
tests/qtest/cdrom-test.c | 10 ++++
76
MAINTAINERS | 2 +-
77
ui/console.c | 4 +-
77
qemu-options.hx | 30 +++++++++++---------
78
target/arm/Kconfig | 9 +--
78
17 files changed, 183 insertions(+), 43 deletions(-)
79
25 files changed, 109 insertions(+), 77 deletions(-)
79
80
rename target/arm/{ => tcg}/arm_ldst.h (100%)
81
rename target/arm/{ => tcg}/helper-a64.h (100%)
82
rename target/arm/{ => tcg}/helper-mve.h (100%)
83
rename target/arm/{ => tcg}/helper-sme.h (100%)
84
rename target/arm/{ => tcg}/helper-sve.h (100%)
85
rename target/arm/{ => tcg}/sve_ldst_internal.h (100%)
86
rename target/arm/{ => tcg}/translate-a32.h (100%)
diff view generated by jsdifflib
1
From: Joel Stanley <joel@jms.id.au>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
The macro used to calculate the maximum memory size of the MMIO region
3
These files got missed when populating tcg/.
4
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
4
Because they are included with "", no change to the users required.
5
The intent was to have it be 0x9D8 - 0x800.
6
5
7
This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
region set aside for the GPIO controller.
7
Reviewed-by: Fabiano Rosas <farosas@suse.de>
9
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
10
On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
9
Message-id: 20230504110412.1892411-2-richard.henderson@linaro.org
11
regions would overlap. Worse was the 1.8V controller would map over the
12
top of the following peripheral, which happens to be the RTC.
13
14
The mmio region used by each device is a maximum of 2KB, so avoid the
15
calculations and hard code this as the maximum.
16
17
Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
18
Signed-off-by: Joel Stanley <joel@jms.id.au>
19
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
20
Reviewed-by: Cédric Le Goater <clg@kaod.org>
21
Message-id: 20210713065854.134634-2-joel@jms.id.au
22
[PMM: fix autocorrect error in commit message]
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
---
11
---
25
hw/gpio/aspeed_gpio.c | 3 +--
12
target/arm/{ => tcg}/arm_ldst.h | 0
26
1 file changed, 1 insertion(+), 2 deletions(-)
13
target/arm/{ => tcg}/sve_ldst_internal.h | 0
14
target/arm/{ => tcg}/translate-a32.h | 0
15
3 files changed, 0 insertions(+), 0 deletions(-)
16
rename target/arm/{ => tcg}/arm_ldst.h (100%)
17
rename target/arm/{ => tcg}/sve_ldst_internal.h (100%)
18
rename target/arm/{ => tcg}/translate-a32.h (100%)
27
19
28
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
20
diff --git a/target/arm/arm_ldst.h b/target/arm/tcg/arm_ldst.h
29
index XXXXXXX..XXXXXXX 100644
21
similarity index 100%
30
--- a/hw/gpio/aspeed_gpio.c
22
rename from target/arm/arm_ldst.h
31
+++ b/hw/gpio/aspeed_gpio.c
23
rename to target/arm/tcg/arm_ldst.h
32
@@ -XXX,XX +XXX,XX @@
24
diff --git a/target/arm/sve_ldst_internal.h b/target/arm/tcg/sve_ldst_internal.h
33
#define GPIO_1_8V_MEM_SIZE 0x9D8
25
similarity index 100%
34
#define GPIO_1_8V_REG_ARRAY_SIZE ((GPIO_1_8V_MEM_SIZE - \
26
rename from target/arm/sve_ldst_internal.h
35
GPIO_1_8V_REG_OFFSET) >> 2)
27
rename to target/arm/tcg/sve_ldst_internal.h
36
-#define GPIO_MAX_MEM_SIZE MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
28
diff --git a/target/arm/translate-a32.h b/target/arm/tcg/translate-a32.h
37
29
similarity index 100%
38
static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
30
rename from target/arm/translate-a32.h
39
{
31
rename to target/arm/tcg/translate-a32.h
40
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
41
}
42
43
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
44
- TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
45
+ TYPE_ASPEED_GPIO, 0x800);
46
47
sysbus_init_mmio(sbd, &s->iomem);
48
}
49
--
32
--
50
2.20.1
33
2.34.1
51
34
52
35
diff view generated by jsdifflib
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Currently, our only caller is sve_zcr_len_for_el, which has
3
While we cannot move the main "helper.h" out of target/arm/,
4
already masked the length extracted from ZCR_ELx, so the
4
due to usage by generic code, we can move the sub-includes.
5
masking done here is a nop. But we will shortly have uses
6
from other locations, where the length will be unmasked.
7
8
Saturate the length to ARM_MAX_VQ instead of truncating to
9
the low 4 bits.
10
5
11
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
12
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Fabiano Rosas <farosas@suse.de>
13
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
8
Message-id: 20230504110412.1892411-3-richard.henderson@linaro.org
9
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
---
11
---
16
target/arm/helper.c | 4 +++-
12
target/arm/helper.h | 8 ++++----
17
1 file changed, 3 insertions(+), 1 deletion(-)
13
target/arm/{ => tcg}/helper-a64.h | 0
14
target/arm/{ => tcg}/helper-mve.h | 0
15
target/arm/{ => tcg}/helper-sme.h | 0
16
target/arm/{ => tcg}/helper-sve.h | 0
17
5 files changed, 4 insertions(+), 4 deletions(-)
18
rename target/arm/{ => tcg}/helper-a64.h (100%)
19
rename target/arm/{ => tcg}/helper-mve.h (100%)
20
rename target/arm/{ => tcg}/helper-sme.h (100%)
21
rename target/arm/{ => tcg}/helper-sve.h (100%)
18
22
19
diff --git a/target/arm/helper.c b/target/arm/helper.c
23
diff --git a/target/arm/helper.h b/target/arm/helper.h
20
index XXXXXXX..XXXXXXX 100644
24
index XXXXXXX..XXXXXXX 100644
21
--- a/target/arm/helper.c
25
--- a/target/arm/helper.h
22
+++ b/target/arm/helper.c
26
+++ b/target/arm/helper.h
23
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
27
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_uclamp_d, TCG_CALL_NO_RWG,
24
{
28
void, ptr, ptr, ptr, ptr, i32)
25
uint32_t end_len;
29
26
30
#ifdef TARGET_AARCH64
27
- end_len = start_len &= 0xf;
31
-#include "helper-a64.h"
28
+ start_len = MIN(start_len, ARM_MAX_VQ - 1);
32
-#include "helper-sve.h"
29
+ end_len = start_len;
33
-#include "helper-sme.h"
30
+
34
+#include "tcg/helper-a64.h"
31
if (!test_bit(start_len, cpu->sve_vq_map)) {
35
+#include "tcg/helper-sve.h"
32
end_len = find_last_bit(cpu->sve_vq_map, start_len);
36
+#include "tcg/helper-sme.h"
33
assert(end_len < start_len);
37
#endif
38
39
-#include "helper-mve.h"
40
+#include "tcg/helper-mve.h"
41
diff --git a/target/arm/helper-a64.h b/target/arm/tcg/helper-a64.h
42
similarity index 100%
43
rename from target/arm/helper-a64.h
44
rename to target/arm/tcg/helper-a64.h
45
diff --git a/target/arm/helper-mve.h b/target/arm/tcg/helper-mve.h
46
similarity index 100%
47
rename from target/arm/helper-mve.h
48
rename to target/arm/tcg/helper-mve.h
49
diff --git a/target/arm/helper-sme.h b/target/arm/tcg/helper-sme.h
50
similarity index 100%
51
rename from target/arm/helper-sme.h
52
rename to target/arm/tcg/helper-sme.h
53
diff --git a/target/arm/helper-sve.h b/target/arm/tcg/helper-sve.h
54
similarity index 100%
55
rename from target/arm/helper-sve.h
56
rename to target/arm/tcg/helper-sve.h
34
--
57
--
35
2.20.1
58
2.34.1
36
59
37
60
diff view generated by jsdifflib
1
The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
1
Bit 63 in a Table descriptor is only the NSTable bit for stage 1
2
the register. We were incorrectly masking it to 8 bits, so it would
2
translations; in stage 2 it is RES0. We were incorrectly looking at
3
report the wrong value if the pending exception was greater than 256.
3
it all the time.
4
Fix the bug.
5
4
5
This causes problems if:
6
* the stage 2 table descriptor was incorrectly setting the RES0 bit
7
* we are doing a stage 2 translation in Secure address space for
8
a NonSecure stage 1 regime -- in this case we would incorrectly
9
do an immediate downgrade to NonSecure
10
11
A bug elsewhere in the code currently prevents us from getting
12
to the second situation, but when we fix that it will be possible.
13
14
Cc: qemu-stable@nongnu.org
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
16
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
17
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
18
Message-id: 20230504135425.2748672-2-peter.maydell@linaro.org
9
---
19
---
10
hw/intc/armv7m_nvic.c | 2 +-
20
target/arm/ptw.c | 5 +++--
11
1 file changed, 1 insertion(+), 1 deletion(-)
21
1 file changed, 3 insertions(+), 2 deletions(-)
12
22
13
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
23
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
14
index XXXXXXX..XXXXXXX 100644
24
index XXXXXXX..XXXXXXX 100644
15
--- a/hw/intc/armv7m_nvic.c
25
--- a/target/arm/ptw.c
16
+++ b/hw/intc/armv7m_nvic.c
26
+++ b/target/arm/ptw.c
17
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
27
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
18
/* VECTACTIVE */
28
descaddrmask &= ~indexmask_grainsize;
19
val = cpu->env.v7m.exception;
29
20
/* VECTPENDING */
30
/*
21
- val |= (s->vectpending & 0xff) << 12;
31
- * Secure accesses start with the page table in secure memory and
22
+ val |= (s->vectpending & 0x1ff) << 12;
32
+ * Secure stage 1 accesses start with the page table in secure memory and
23
/* ISRPENDING - set if any external IRQ is pending */
33
* can be downgraded to non-secure at any step. Non-secure accesses
24
if (nvic_isrpending(s)) {
34
* remain non-secure. We implement this by just ORing in the NSTable/NS
25
val |= (1 << 22);
35
* bits at each step.
36
+ * Stage 2 never gets this kind of downgrade.
37
*/
38
tableattrs = is_secure ? 0 : (1 << 4);
39
40
next_level:
41
descaddr |= (address >> (stride * (4 - level))) & indexmask;
42
descaddr &= ~7ULL;
43
- nstable = extract32(tableattrs, 4, 1);
44
+ nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
45
if (nstable) {
46
/*
47
* Stage2_S -> Stage2 or Phys_S -> Phys_NS
26
--
48
--
27
2.20.1
49
2.34.1
28
50
29
51
diff view generated by jsdifflib
1
In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
1
We currently don't correctly handle the VSTCR_EL2.SW and VTCR_EL2.NSW
2
the register is accessed NonSecure and the highest priority pending
2
configuration bits. These allow configuration of whether the stage 2
3
enabled exception (that would be returned in the VECTPENDING field)
3
page table walks for Secure IPA and NonSecure IPA should do their
4
targets Secure, then the VECTPENDING field must read 1 rather than
4
descriptor reads from Secure or NonSecure physical addresses. (This
5
the exception number of the pending exception. Implement this.
5
is separate from how the translation table base address and other
6
parameters are set: an NS IPA always uses VTTBR_EL2 and VTCR_EL2
7
for its base address and walk parameters, regardless of the NSW bit,
8
and similarly for Secure.)
6
9
10
Provide a new function ptw_idx_for_stage_2() which returns the
11
MMU index to use for descriptor reads, and use it to set up
12
the .in_ptw_idx wherever we call get_phys_addr_lpae().
13
14
For a stage 2 walk, wherever we call get_phys_addr_lpae():
15
* .in_ptw_idx should be ptw_idx_for_stage_2() of the .in_mmu_idx
16
* .in_secure should be true if .in_mmu_idx is Stage2_S
17
18
This allows us to correct S1_ptw_translate() so that it consistently
19
always sets its (out_secure, out_phys) to the result it gets from the
20
S2 walk (either by calling get_phys_addr_lpae() or by TLB lookup).
21
This makes better conceptual sense because the S2 walk should return
22
us an (address space, address) tuple, not an address that we then
23
randomly assign to S or NS.
24
25
Our previous handling of SW and NSW was broken, so guest code
26
trying to use these bits to put the s2 page tables in the "other"
27
address space wouldn't work correctly.
28
29
Cc: qemu-stable@nongnu.org
30
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1600
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
31
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
32
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
33
Message-id: 20230504135425.2748672-3-peter.maydell@linaro.org
10
---
34
---
11
hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
35
target/arm/ptw.c | 76 ++++++++++++++++++++++++++++++++----------------
12
1 file changed, 24 insertions(+), 7 deletions(-)
36
1 file changed, 51 insertions(+), 25 deletions(-)
13
37
14
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
38
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
15
index XXXXXXX..XXXXXXX 100644
39
index XXXXXXX..XXXXXXX 100644
16
--- a/hw/intc/armv7m_nvic.c
40
--- a/target/arm/ptw.c
17
+++ b/hw/intc/armv7m_nvic.c
41
+++ b/target/arm/ptw.c
18
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
42
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env)
19
nvic_irq_update(s);
43
return stage_1_mmu_idx(arm_mmu_idx(env));
20
}
44
}
21
45
22
+static bool vectpending_targets_secure(NVICState *s)
46
+/*
47
+ * Return where we should do ptw loads from for a stage 2 walk.
48
+ * This depends on whether the address we are looking up is a
49
+ * Secure IPA or a NonSecure IPA, which we know from whether this is
50
+ * Stage2 or Stage2_S.
51
+ * If this is the Secure EL1&0 regime we need to check the NSW and SW bits.
52
+ */
53
+static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
23
+{
54
+{
24
+ /* Return true if s->vectpending targets Secure state */
55
+ bool s2walk_secure;
25
+ if (s->vectpending_is_s_banked) {
56
+
26
+ return true;
57
+ /*
58
+ * We're OK to check the current state of the CPU here because
59
+ * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes
60
+ * (2) there's no way to do a lookup that cares about Stage 2 for a
61
+ * different security state to the current one for AArch64, and AArch32
62
+ * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
63
+ * an NS stage 1+2 lookup while the NS bit is 0.)
64
+ */
65
+ if (!arm_is_secure_below_el3(env) || !arm_el_is_aa64(env, 3)) {
66
+ return ARMMMUIdx_Phys_NS;
27
+ }
67
+ }
28
+ return !exc_is_banked(s->vectpending) &&
68
+ if (stage2idx == ARMMMUIdx_Stage2_S) {
29
+ exc_targets_secure(s, s->vectpending);
69
+ s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
70
+ } else {
71
+ s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
72
+ }
73
+ return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
74
+
30
+}
75
+}
31
+
76
+
32
void armv7m_nvic_get_pending_irq_info(void *opaque,
77
static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
33
int *pirq, bool *ptargets_secure)
34
{
78
{
35
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
79
return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
36
80
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
37
assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
81
ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
38
82
ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
39
- if (s->vectpending_is_s_banked) {
83
uint8_t pte_attrs;
40
- targets_secure = true;
84
- bool pte_secure;
85
86
ptw->out_virt = addr;
87
88
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
89
if (regime_is_stage2(s2_mmu_idx)) {
90
S1Translate s2ptw = {
91
.in_mmu_idx = s2_mmu_idx,
92
- .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
93
- .in_secure = is_secure,
94
+ .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
95
+ .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
96
.in_debug = true,
97
};
98
GetPhysAddrResult s2 = { };
99
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
100
}
101
ptw->out_phys = s2.f.phys_addr;
102
pte_attrs = s2.cacheattrs.attrs;
103
- pte_secure = s2.f.attrs.secure;
104
+ ptw->out_secure = s2.f.attrs.secure;
105
} else {
106
/* Regime is physical. */
107
ptw->out_phys = addr;
108
pte_attrs = 0;
109
- pte_secure = is_secure;
110
+ ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
111
}
112
ptw->out_host = NULL;
113
ptw->out_rw = false;
114
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
115
ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
116
ptw->out_rw = full->prot & PAGE_WRITE;
117
pte_attrs = full->pte_attrs;
118
- pte_secure = full->attrs.secure;
119
+ ptw->out_secure = full->attrs.secure;
120
#else
121
g_assert_not_reached();
122
#endif
123
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
124
}
125
}
126
127
- /* Check if page table walk is to secure or non-secure PA space. */
128
- ptw->out_secure = (is_secure
129
- && !(pte_secure
130
- ? env->cp15.vstcr_el2 & VSTCR_SW
131
- : env->cp15.vtcr_el2 & VTCR_NSW));
132
ptw->out_be = regime_translation_big_endian(env, mmu_idx);
133
return true;
134
135
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
136
hwaddr ipa;
137
int s1_prot, s1_lgpgsz;
138
bool is_secure = ptw->in_secure;
139
- bool ret, ipa_secure, s2walk_secure;
140
+ bool ret, ipa_secure;
141
ARMCacheAttrs cacheattrs1;
142
bool is_el0;
143
uint64_t hcr;
144
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
145
146
ipa = result->f.phys_addr;
147
ipa_secure = result->f.attrs.secure;
148
- if (is_secure) {
149
- /* Select TCR based on the NS bit from the S1 walk. */
150
- s2walk_secure = !(ipa_secure
151
- ? env->cp15.vstcr_el2 & VSTCR_SW
152
- : env->cp15.vtcr_el2 & VTCR_NSW);
41
- } else {
153
- } else {
42
- targets_secure = !exc_is_banked(pending) &&
154
- assert(!ipa_secure);
43
- exc_targets_secure(s, pending);
155
- s2walk_secure = false;
44
- }
156
- }
45
+ targets_secure = vectpending_targets_secure(s);
157
46
158
is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
47
trace_nvic_get_pending_irq_info(pending, targets_secure);
159
- ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
48
160
- ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
49
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
161
- ptw->in_secure = s2walk_secure;
50
/* VECTACTIVE */
162
+ ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
51
val = cpu->env.v7m.exception;
163
+ ptw->in_secure = ipa_secure;
52
/* VECTPENDING */
164
+ ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
53
- val |= (s->vectpending & 0x1ff) << 12;
165
54
+ if (s->vectpending) {
166
/*
55
+ /*
167
* S1 is done, now do S2 translation.
56
+ * From v8.1M VECTPENDING must read as 1 if accessed as
168
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
57
+ * NonSecure and the highest priority pending and enabled
169
ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
58
+ * exception targets Secure.
170
break;
59
+ */
171
60
+ int vp = s->vectpending;
172
+ case ARMMMUIdx_Stage2:
61
+ if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
173
+ case ARMMMUIdx_Stage2_S:
62
+ vectpending_targets_secure(s)) {
174
+ /*
63
+ vp = 1;
175
+ * Second stage lookup uses physical for ptw; whether this is S or
64
+ }
176
+ * NS may depend on the SW/NSW bits if this is a stage 2 lookup for
65
+ val |= (vp & 0x1ff) << 12;
177
+ * the Secure EL2&0 regime.
66
+ }
178
+ */
67
/* ISRPENDING - set if any external IRQ is pending */
179
+ ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx);
68
if (nvic_isrpending(s)) {
180
+ break;
69
val |= (1 << 22);
181
+
182
case ARMMMUIdx_E10_0:
183
s1_mmu_idx = ARMMMUIdx_Stage1_E0;
184
goto do_twostage;
185
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
186
/* fall through */
187
188
default:
189
- /* Single stage and second stage uses physical for ptw. */
190
+ /* Single stage uses physical for ptw. */
191
ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
192
break;
193
}
70
--
194
--
71
2.20.1
195
2.34.1
72
73
diff view generated by jsdifflib
1
From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
1
From: Akihiko Odaki <akihiko.odaki@gmail.com>
2
2
3
Missed in commit f3478392 "docs: Move deprecation, build
3
I am now employed by Daynix. Although my role as a reviewer of
4
and license info out of system/"
4
macOS-related change is not very relevant to the employment, I decided
5
to use the company email address to avoid confusions from different
6
addresses.
5
7
6
Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
8
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
8
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
10
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
11
Message-id: 20230506072333.32510-1-akihiko.odaki@daynix.com
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
13
---
11
configure | 2 +-
14
MAINTAINERS | 4 ++--
12
target/i386/cpu.c | 2 +-
15
1 file changed, 2 insertions(+), 2 deletions(-)
13
MAINTAINERS | 2 +-
14
3 files changed, 3 insertions(+), 3 deletions(-)
15
16
16
diff --git a/configure b/configure
17
index XXXXXXX..XXXXXXX 100755
18
--- a/configure
19
+++ b/configure
20
@@ -XXX,XX +XXX,XX @@ fi
21
22
if test -n "${deprecated_features}"; then
23
echo "Warning, deprecated features enabled."
24
- echo "Please see docs/system/deprecated.rst"
25
+ echo "Please see docs/about/deprecated.rst"
26
echo " features: ${deprecated_features}"
27
fi
28
29
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
30
index XXXXXXX..XXXXXXX 100644
31
--- a/target/i386/cpu.c
32
+++ b/target/i386/cpu.c
33
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
34
* none", but this is just for compatibility while libvirt isn't
35
* adapted to resolve CPU model versions before creating VMs.
36
* See "Runnability guarantee of CPU models" at
37
- * docs/system/deprecated.rst.
38
+ * docs/about/deprecated.rst.
39
*/
40
X86CPUVersion default_cpu_version = 1;
41
42
diff --git a/MAINTAINERS b/MAINTAINERS
17
diff --git a/MAINTAINERS b/MAINTAINERS
43
index XXXXXXX..XXXXXXX 100644
18
index XXXXXXX..XXXXXXX 100644
44
--- a/MAINTAINERS
19
--- a/MAINTAINERS
45
+++ b/MAINTAINERS
20
+++ b/MAINTAINERS
46
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
21
@@ -XXX,XX +XXX,XX @@ Core Audio framework backend
47
22
M: Gerd Hoffmann <kraxel@redhat.com>
48
Incompatible changes
23
M: Philippe Mathieu-Daudé <philmd@linaro.org>
49
R: libvir-list@redhat.com
24
R: Christian Schoenebeck <qemu_oss@crudebyte.com>
50
-F: docs/system/deprecated.rst
25
-R: Akihiko Odaki <akihiko.odaki@gmail.com>
51
+F: docs/about/deprecated.rst
26
+R: Akihiko Odaki <akihiko.odaki@daynix.com>
52
27
S: Odd Fixes
53
Build System
28
F: audio/coreaudio.c
54
------------
29
30
@@ -XXX,XX +XXX,XX @@ F: docs/devel/ui.rst
31
Cocoa graphics
32
M: Peter Maydell <peter.maydell@linaro.org>
33
M: Philippe Mathieu-Daudé <philmd@linaro.org>
34
-R: Akihiko Odaki <akihiko.odaki@gmail.com>
35
+R: Akihiko Odaki <akihiko.odaki@daynix.com>
36
S: Odd Fixes
37
F: ui/cocoa.m
38
55
--
39
--
56
2.20.1
40
2.34.1
57
41
58
42
diff view generated by jsdifflib
1
The ISCR.ISRPENDING bit is set when an external interrupt is pending.
1
When we take a PNG screenshot the ordering of the colour channels in
2
This is true whether that external interrupt is enabled or not.
2
the data is not correct, resulting in the image having weird
3
This means that we can't use 's->vectpending == 0' as a shortcut to
3
colouring compared to the actual display. (Specifically, on a
4
"ISRPENDING is zero", because s->vectpending indicates only the
4
little-endian host the blue and red channels are swapped; on
5
highest priority pending enabled interrupt.
5
big-endian everything is wrong.)
6
6
7
Remove the incorrect optimization so that if there is no pending
7
This happens because the pixman idea of the pixel data and the libpng
8
enabled interrupt we fall through to scanning through the whole
8
idea differ. PIXMAN_a8r8g8b8 defines that pixels are 32-bit values,
9
interrupt array.
9
with A in bits 24-31, R in bits 16-23, G in bits 8-15 and B in bits
10
0-7. This means that on little-endian systems the bytes in memory
11
are
12
B G R A
13
and on big-endian systems they are
14
A R G B
10
15
16
libpng, on the other hand, thinks of pixels as being a series of
17
values for each channel, so its format PNG_COLOR_TYPE_RGB_ALPHA
18
always wants bytes in the order
19
R G B A
20
21
This isn't the same as the pixman order for either big or little
22
endian hosts.
23
24
The alpha channel is also unnecessary bulk in the output PNG file,
25
because there is no alpha information in a screenshot.
26
27
To handle the endianness issue, we already define in ui/qemu-pixman.h
28
various PIXMAN_BE_* and PIXMAN_LE_* values that give consistent
29
byte-order pixel channel formats. So we can use PIXMAN_BE_r8g8b8 and
30
PNG_COLOR_TYPE_RGB, which both have an in-memory byte order of
31
R G B
32
and 3 bytes per pixel.
33
34
(PPM format screenshots get this right; they already use the
35
PIXMAN_BE_r8g8b8 format.)
36
37
Cc: qemu-stable@nongnu.org
38
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1622
39
Fixes: 9a0a119a382867 ("Added parameter to take screenshot with screendump as PNG")
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
40
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
41
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
13
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
42
Message-id: 20230502135548.2451309-1-peter.maydell@linaro.org
14
---
43
---
15
hw/intc/armv7m_nvic.c | 9 ++++-----
44
ui/console.c | 4 ++--
16
1 file changed, 4 insertions(+), 5 deletions(-)
45
1 file changed, 2 insertions(+), 2 deletions(-)
17
46
18
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
47
diff --git a/ui/console.c b/ui/console.c
19
index XXXXXXX..XXXXXXX 100644
48
index XXXXXXX..XXXXXXX 100644
20
--- a/hw/intc/armv7m_nvic.c
49
--- a/ui/console.c
21
+++ b/hw/intc/armv7m_nvic.c
50
+++ b/ui/console.c
22
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
51
@@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp)
23
{
52
png_struct *png_ptr;
24
int irq;
53
png_info *info_ptr;
25
54
g_autoptr(pixman_image_t) linebuf =
26
- /* We can shortcut if the highest priority pending interrupt
55
- qemu_pixman_linebuf_create(PIXMAN_a8r8g8b8, width);
27
- * happens to be external or if there is nothing pending.
56
+ qemu_pixman_linebuf_create(PIXMAN_BE_r8g8b8, width);
28
+ /*
57
uint8_t *buf = (uint8_t *)pixman_image_get_data(linebuf);
29
+ * We can shortcut if the highest priority pending interrupt
58
FILE *f = fdopen(fd, "wb");
30
+ * happens to be external; if not we need to check the whole
59
int y;
31
+ * vectors[] array.
60
@@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp)
32
*/
61
png_init_io(png_ptr, f);
33
if (s->vectpending > NVIC_FIRST_IRQ) {
62
34
return true;
63
png_set_IHDR(png_ptr, info_ptr, width, height, 8,
35
}
64
- PNG_COLOR_TYPE_RGB_ALPHA, PNG_INTERLACE_NONE,
36
- if (s->vectpending == 0) {
65
+ PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE,
37
- return false;
66
PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
38
- }
67
39
68
png_write_info(png_ptr, info_ptr);
40
for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
41
if (s->vectors[irq].pending) {
42
--
69
--
43
2.20.1
70
2.34.1
44
71
45
72
diff view generated by jsdifflib
1
For M-profile, we weren't reporting alignment faults triggered by the
1
In the doc sources, we have a few cross-reference targets with odd
2
generic TCG code correctly to the guest. These get passed into
2
names "pcsys_005fxyz". These are the legacy of the semi-automated
3
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
3
conversion of the old info docs to rST (the '005f' is because ASCII
4
style exception.fsr value of 1. We didn't check for this, and so
4
0x5f is '_' and the old info link names had underscores in them).
5
they fell through into the default of "assume this is an MPU fault"
6
and were reported to the guest as a data access violation MPU fault.
7
5
8
Report these alignment faults as UsageFaults which set the UNALIGNED
6
Remove the targets which nothing links to, and rename the two targets
9
bit in the UFSR.
7
which are used to something a bit more descriptive.
10
8
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230421163642.1151904-1-peter.maydell@linaro.org
13
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
11
Reviewed-by: Markus Armbruster <armbru@redhat.com>
14
---
12
---
15
target/arm/m_helper.c | 8 ++++++++
13
docs/system/devices/igb.rst | 2 +-
16
1 file changed, 8 insertions(+)
14
docs/system/devices/ivshmem.rst | 2 --
15
docs/system/devices/net.rst | 2 +-
16
docs/system/devices/usb.rst | 2 --
17
docs/system/keys.rst | 2 +-
18
docs/system/linuxboot.rst | 2 +-
19
docs/system/target-i386.rst | 4 ----
20
7 files changed, 4 insertions(+), 12 deletions(-)
17
21
18
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
22
diff --git a/docs/system/devices/igb.rst b/docs/system/devices/igb.rst
19
index XXXXXXX..XXXXXXX 100644
23
index XXXXXXX..XXXXXXX 100644
20
--- a/target/arm/m_helper.c
24
--- a/docs/system/devices/igb.rst
21
+++ b/target/arm/m_helper.c
25
+++ b/docs/system/devices/igb.rst
22
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
26
@@ -XXX,XX +XXX,XX @@ Using igb
23
env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
27
=========
24
break;
28
25
case EXCP_UNALIGNED:
29
Using igb should be nothing different from using another network device. See
26
+ /* Unaligned faults reported by M-profile aware code */
30
-:ref:`pcsys_005fnetwork` in general.
27
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
31
+:ref:`Network_emulation` in general.
28
env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
32
29
break;
33
However, you may also need to perform additional steps to activate SR-IOV
30
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
34
feature on your guest. For Linux, refer to [4]_.
31
}
35
diff --git a/docs/system/devices/ivshmem.rst b/docs/system/devices/ivshmem.rst
32
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
36
index XXXXXXX..XXXXXXX 100644
33
break;
37
--- a/docs/system/devices/ivshmem.rst
34
+ case 0x1: /* Alignment fault reported by generic code */
38
+++ b/docs/system/devices/ivshmem.rst
35
+ qemu_log_mask(CPU_LOG_INT,
39
@@ -XXX,XX +XXX,XX @@
36
+ "...really UsageFault with UFSR.UNALIGNED\n");
40
-.. _pcsys_005fivshmem:
37
+ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
41
-
38
+ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
42
Inter-VM Shared Memory device
39
+ env->v7m.secure);
43
-----------------------------
40
+ break;
44
41
default:
45
diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst
42
/*
46
index XXXXXXX..XXXXXXX 100644
43
* All other FSR values are either MPU faults or "can't happen
47
--- a/docs/system/devices/net.rst
48
+++ b/docs/system/devices/net.rst
49
@@ -XXX,XX +XXX,XX @@
50
-.. _pcsys_005fnetwork:
51
+.. _Network_Emulation:
52
53
Network emulation
54
-----------------
55
diff --git a/docs/system/devices/usb.rst b/docs/system/devices/usb.rst
56
index XXXXXXX..XXXXXXX 100644
57
--- a/docs/system/devices/usb.rst
58
+++ b/docs/system/devices/usb.rst
59
@@ -XXX,XX +XXX,XX @@
60
-.. _pcsys_005fusb:
61
-
62
USB emulation
63
-------------
64
65
diff --git a/docs/system/keys.rst b/docs/system/keys.rst
66
index XXXXXXX..XXXXXXX 100644
67
--- a/docs/system/keys.rst
68
+++ b/docs/system/keys.rst
69
@@ -XXX,XX +XXX,XX @@
70
-.. _pcsys_005fkeys:
71
+.. _GUI_keys:
72
73
Keys in the graphical frontends
74
-------------------------------
75
diff --git a/docs/system/linuxboot.rst b/docs/system/linuxboot.rst
76
index XXXXXXX..XXXXXXX 100644
77
--- a/docs/system/linuxboot.rst
78
+++ b/docs/system/linuxboot.rst
79
@@ -XXX,XX +XXX,XX @@ virtual serial port and the QEMU monitor to the console with the
80
-append "root=/dev/hda console=ttyS0" -nographic
81
82
Use Ctrl-a c to switch between the serial console and the monitor (see
83
-:ref:`pcsys_005fkeys`).
84
+:ref:`GUI_keys`).
85
diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst
86
index XXXXXXX..XXXXXXX 100644
87
--- a/docs/system/target-i386.rst
88
+++ b/docs/system/target-i386.rst
89
@@ -XXX,XX +XXX,XX @@
90
x86 System emulator
91
-------------------
92
93
-.. _pcsys_005fdevices:
94
-
95
Board-specific documentation
96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
97
98
@@ -XXX,XX +XXX,XX @@ Architectural features
99
i386/sgx
100
i386/amd-memory-encryption
101
102
-.. _pcsys_005freq:
103
-
104
OS requirements
105
~~~~~~~~~~~~~~~
106
44
--
107
--
45
2.20.1
108
2.34.1
46
47
diff view generated by jsdifflib
1
In do_v7m_exception_exit(), we perform various checks as part of
1
Coverity points out (in CID 1508390) that write_bootloader has
2
performing the exception return. If one of these checks fails, the
2
some dead code, where we assign to 'p' and then in the following
3
architecture requires that we take an appropriate exception on the
3
line assign to it again. This happened as a result of the
4
existing stackframe. We implement this by calling
4
refactoring in commit cd5066f8618b.
5
v7m_exception_taken() to set up to take the new exception, and then
6
immediately returning from do_v7m_exception_exit() without proceeding
7
any further with the unstack-and-exception-return process.
8
5
9
In a couple of checks that are new in v8.1M, we forgot the "return"
6
Fix the dead code by removing the 'void *v' variable entirely and
10
statement, with the effect that if bad code in the guest tripped over
7
instead adding a cast when calling bl_setup_gt64120_jump_kernel(), as
11
these checks we would set up to take a UsageFault exception but then
8
we do at its other callsite in write_bootloader_nanomips().
12
blunder on trying to also unstack and return from the original
13
exception, with the probable result that the guest would crash.
14
15
Add the missing return statements.
16
9
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
19
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
20
---
12
---
21
target/arm/m_helper.c | 2 ++
13
hw/mips/malta.c | 5 +----
22
1 file changed, 2 insertions(+)
14
1 file changed, 1 insertion(+), 4 deletions(-)
23
15
24
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
16
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
25
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
26
--- a/target/arm/m_helper.c
18
--- a/hw/mips/malta.c
27
+++ b/target/arm/m_helper.c
19
+++ b/hw/mips/malta.c
28
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
20
@@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr,
29
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
21
uint64_t kernel_entry)
30
"stackframe: NSACR prevents clearing FPU registers\n");
22
{
31
v7m_exception_taken(cpu, excret, true, false);
23
uint32_t *p;
32
+ return;
24
- void *v;
33
} else if (!cpacr_pass) {
25
34
armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
26
/* Small bootloader */
35
exc_secure);
27
p = (uint32_t *)base;
36
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
28
@@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr,
37
qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
29
*
38
"stackframe: CPACR prevents clearing FPU registers\n");
30
*/
39
v7m_exception_taken(cpu, excret, true, false);
31
40
+ return;
32
- v = p;
41
}
33
- bl_setup_gt64120_jump_kernel(&v, run_addr, kernel_entry);
42
}
34
- p = v;
43
/* Clear s0..s15, FPSCR and VPR */
35
+ bl_setup_gt64120_jump_kernel((void **)&p, run_addr, kernel_entry);
36
37
/* YAMON subroutines */
38
p = (uint32_t *) (base + 0x800);
44
--
39
--
45
2.20.1
40
2.34.1
46
41
47
42
diff view generated by jsdifflib
1
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
1
From: Fabiano Rosas <farosas@suse.de>
2
2
3
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
3
Semihosting has been made a 'default y' entry in Kconfig, which does
4
not work because when building --without-default-devices, the
5
semihosting code would not be available.
6
7
Make semihosting unconditional when TCG is present.
8
9
Fixes: 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a KVM-only build")
10
Signed-off-by: Fabiano Rosas <farosas@suse.de>
4
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
5
Message-id: 20210726150953.1218690-1-f4bug@amsat.org
12
Message-id: 20230508181611.2621-2-farosas@suse.de
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
14
---
8
hw/arm/nseries.c | 2 +-
15
target/arm/Kconfig | 8 +-------
9
1 file changed, 1 insertion(+), 1 deletion(-)
16
1 file changed, 1 insertion(+), 7 deletions(-)
10
17
11
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
18
diff --git a/target/arm/Kconfig b/target/arm/Kconfig
12
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
13
--- a/hw/arm/nseries.c
20
--- a/target/arm/Kconfig
14
+++ b/hw/arm/nseries.c
21
+++ b/target/arm/Kconfig
15
@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
22
@@ -XXX,XX +XXX,XX @@
16
default:
23
config ARM
17
bad_cmd:
24
bool
18
qemu_log_mask(LOG_GUEST_ERROR,
25
+ select ARM_COMPATIBLE_SEMIHOSTING if TCG
19
- "%s: unknown command %02x\n", __func__, s->cmd);
26
20
+ "%s: unknown command 0x%02x\n", __func__, s->cmd);
27
config AARCH64
21
break;
28
bool
22
}
29
select ARM
23
30
-
31
-# This config exists just so we can make SEMIHOSTING default when TCG
32
-# is selected without also changing it for other architectures.
33
-config ARM_SEMIHOSTING
34
- bool
35
- default y if TCG && ARM
36
- select ARM_COMPATIBLE_SEMIHOSTING
24
--
37
--
25
2.20.1
38
2.34.1
26
27
diff view generated by jsdifflib
1
From: Joe Komlodi <joe.komlodi@xilinx.com>
1
From: Fabiano Rosas <farosas@suse.de>
2
2
3
The bit to see if a CD is valid is the last bit of the first word of the CD.
3
We cannot allow this config to be disabled at the moment as not all of
4
the relevant code is protected by it.
4
5
5
Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
6
Commit 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a
6
Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
7
KVM-only build") moved the CONFIGs of several boards to Kconfig, so it
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
is now possible that nothing selects ARM_V7M (e.g. when doing a
9
--without-default-devices build).
10
11
Return the CONFIG_ARM_V7M entry to a state where it is always selected
12
whenever TCG is available.
13
14
Fixes: 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a KVM-only build")
15
Signed-off-by: Fabiano Rosas <farosas@suse.de>
16
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
17
Message-id: 20230508181611.2621-3-farosas@suse.de
8
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
9
---
19
---
10
hw/arm/smmuv3-internal.h | 2 +-
20
target/arm/Kconfig | 1 +
11
1 file changed, 1 insertion(+), 1 deletion(-)
21
1 file changed, 1 insertion(+)
12
22
13
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
23
diff --git a/target/arm/Kconfig b/target/arm/Kconfig
14
index XXXXXXX..XXXXXXX 100644
24
index XXXXXXX..XXXXXXX 100644
15
--- a/hw/arm/smmuv3-internal.h
25
--- a/target/arm/Kconfig
16
+++ b/hw/arm/smmuv3-internal.h
26
+++ b/target/arm/Kconfig
17
@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
27
@@ -XXX,XX +XXX,XX @@
18
28
config ARM
19
/* CD fields */
29
bool
20
30
select ARM_COMPATIBLE_SEMIHOSTING if TCG
21
-#define CD_VALID(x) extract32((x)->word[0], 30, 1)
31
+ select ARM_V7M if TCG
22
+#define CD_VALID(x) extract32((x)->word[0], 31, 1)
32
23
#define CD_ASID(x) extract32((x)->word[1], 16, 16)
33
config AARCH64
24
#define CD_TTB(x, sel) \
34
bool
25
({ \
26
--
35
--
27
2.20.1
36
2.34.1
28
29
diff view generated by jsdifflib
Deleted patch
1
The documentation of the -machine memory-backend has some minor
2
formatting errors:
3
* Misindentation of the initial line meant that the whole option
4
section is incorrectly indented in the HTML output compared to
5
the other -machine options
6
* The examples weren't indented, which meant that they were formatted
7
as plain run-on text including outputting the "::" as text.
8
* The a) b) list has no rst-format markup so it is rendered as
9
a single run-on paragraph
10
1
11
Fix the formatting.
12
13
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
14
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
15
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
16
---
17
qemu-options.hx | 30 +++++++++++++++++-------------
18
1 file changed, 17 insertions(+), 13 deletions(-)
19
20
diff --git a/qemu-options.hx b/qemu-options.hx
21
index XXXXXXX..XXXXXXX 100644
22
--- a/qemu-options.hx
23
+++ b/qemu-options.hx
24
@@ -XXX,XX +XXX,XX @@ SRST
25
Enables or disables ACPI Heterogeneous Memory Attribute Table
26
(HMAT) support. The default is off.
27
28
- ``memory-backend='id'``
29
+ ``memory-backend='id'``
30
An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
31
Allows to use a memory backend as main RAM.
32
33
For example:
34
::
35
- -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
36
- -machine memory-backend=pc.ram
37
- -m 512M
38
+
39
+ -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
40
+ -machine memory-backend=pc.ram
41
+ -m 512M
42
43
Migration compatibility note:
44
- a) as backend id one shall use value of 'default-ram-id', advertised by
45
- machine type (available via ``query-machines`` QMP command), if migration
46
- to/from old QEMU (<5.0) is expected.
47
- b) for machine types 4.0 and older, user shall
48
- use ``x-use-canonical-path-for-ramblock-id=off`` backend option
49
- if migration to/from old QEMU (<5.0) is expected.
50
+
51
+ * as backend id one shall use value of 'default-ram-id', advertised by
52
+ machine type (available via ``query-machines`` QMP command), if migration
53
+ to/from old QEMU (<5.0) is expected.
54
+ * for machine types 4.0 and older, user shall
55
+ use ``x-use-canonical-path-for-ramblock-id=off`` backend option
56
+ if migration to/from old QEMU (<5.0) is expected.
57
+
58
For example:
59
::
60
- -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
61
- -machine memory-backend=pc.ram
62
- -m 512M
63
+
64
+ -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
65
+ -machine memory-backend=pc.ram
66
+ -m 512M
67
ERST
68
69
HXCOMM Deprecated by -machine
70
--
71
2.20.1
72
73
diff view generated by jsdifflib
Deleted patch
1
For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
2
RES0H, which is to say that they must be hardwired to zero so that
3
guest attempts to write non-zero values to them are ignored.
4
1
5
Implement this behaviour by masking out the low bits:
6
* for writes to r13 by the gdbstub
7
* for writes to any of the various flavours of SP via MSR
8
* for writes to r13 via store_reg() in generated code
9
10
Note that all the direct uses of cpu_R[] in translate.c are in places
11
where the register is definitely not r13 (usually because that has
12
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
13
UNDEF).
14
15
All the other writes to regs[13] in C code are either:
16
* A-profile only code
17
* writes of values we can guarantee to be aligned, such as
18
- writes of previous-SP-value plus or minus a 4-aligned constant
19
- writes of the value in an SP limit register (which we already
20
enforce to be aligned)
21
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
24
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
25
---
26
target/arm/gdbstub.c | 4 ++++
27
target/arm/m_helper.c | 14 ++++++++------
28
target/arm/translate.c | 3 +++
29
3 files changed, 15 insertions(+), 6 deletions(-)
30
31
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
32
index XXXXXXX..XXXXXXX 100644
33
--- a/target/arm/gdbstub.c
34
+++ b/target/arm/gdbstub.c
35
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
36
37
if (n < 16) {
38
/* Core integer register. */
39
+ if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
40
+ /* M profile SP low bits are always 0 */
41
+ tmp &= ~3;
42
+ }
43
env->regs[n] = tmp;
44
return 4;
45
}
46
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
47
index XXXXXXX..XXXXXXX 100644
48
--- a/target/arm/m_helper.c
49
+++ b/target/arm/m_helper.c
50
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
51
if (!env->v7m.secure) {
52
return;
53
}
54
- env->v7m.other_ss_msp = val;
55
+ env->v7m.other_ss_msp = val & ~3;
56
return;
57
case 0x89: /* PSP_NS */
58
if (!env->v7m.secure) {
59
return;
60
}
61
- env->v7m.other_ss_psp = val;
62
+ env->v7m.other_ss_psp = val & ~3;
63
return;
64
case 0x8a: /* MSPLIM_NS */
65
if (!env->v7m.secure) {
66
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
67
68
limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
69
70
+ val &= ~0x3;
71
+
72
if (val < limit) {
73
raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
74
}
75
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
76
break;
77
case 8: /* MSP */
78
if (v7m_using_psp(env)) {
79
- env->v7m.other_sp = val;
80
+ env->v7m.other_sp = val & ~3;
81
} else {
82
- env->regs[13] = val;
83
+ env->regs[13] = val & ~3;
84
}
85
break;
86
case 9: /* PSP */
87
if (v7m_using_psp(env)) {
88
- env->regs[13] = val;
89
+ env->regs[13] = val & ~3;
90
} else {
91
- env->v7m.other_sp = val;
92
+ env->v7m.other_sp = val & ~3;
93
}
94
break;
95
case 10: /* MSPLIM */
96
diff --git a/target/arm/translate.c b/target/arm/translate.c
97
index XXXXXXX..XXXXXXX 100644
98
--- a/target/arm/translate.c
99
+++ b/target/arm/translate.c
100
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
101
*/
102
tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
103
s->base.is_jmp = DISAS_JUMP;
104
+ } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
105
+ /* For M-profile SP bits [1:0] are always zero */
106
+ tcg_gen_andi_i32(var, var, ~3);
107
}
108
tcg_gen_mov_i32(cpu_R[reg], var);
109
tcg_temp_free_i32(var);
110
--
111
2.20.1
112
113
diff view generated by jsdifflib
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Fabiano Rosas <farosas@suse.de>
2
2
3
Mirror the behavour of /proc/sys/abi/sve_default_vector_length
3
On a build configured with: --disable-tcg --enable-xen it is possible
4
under the real linux kernel. We have no way of passing along
4
to produce a QEMU binary with no TCG nor KVM support. Skip the cdrom
5
a real default across exec like the kernel can, but this is a
5
boot tests if that's the case.
6
decent way of adjusting the startup vector length of a process.
7
6
8
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
7
Fixes: 0c1ae3ff9d ("tests/qtest: Fix tests when no KVM or TCG are present")
9
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Signed-off-by: Fabiano Rosas <farosas@suse.de>
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Reviewed-by: Thomas Huth <thuth@redhat.com>
11
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
10
Message-id: 20230508181611.2621-4-farosas@suse.de
12
[PMM: tweaked docs formatting, document -1 special-case,
13
added fixup patch from RTH mentioning QEMU's maximum veclen.]
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
---
12
---
16
docs/system/arm/cpu-features.rst | 15 ++++++++
13
tests/qtest/cdrom-test.c | 10 ++++++++++
17
target/arm/cpu.h | 5 +++
14
1 file changed, 10 insertions(+)
18
target/arm/cpu.c | 14 ++++++--
19
target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++
20
4 files changed, 92 insertions(+), 2 deletions(-)
21
15
22
diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
16
diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
23
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
24
--- a/docs/system/arm/cpu-features.rst
18
--- a/tests/qtest/cdrom-test.c
25
+++ b/docs/system/arm/cpu-features.rst
19
+++ b/tests/qtest/cdrom-test.c
26
@@ -XXX,XX +XXX,XX @@ verbose command lines. However, the recommended way to select vector
20
@@ -XXX,XX +XXX,XX @@ static void test_cdboot(gconstpointer data)
27
lengths is to explicitly enable each desired length. Therefore only
21
28
example's (1), (4), and (6) exhibit recommended uses of the properties.
22
static void add_x86_tests(void)
29
23
{
30
+SVE User-mode Default Vector Length Property
24
+ if (!qtest_has_accel("tcg") && !qtest_has_accel("kvm")) {
31
+--------------------------------------------
25
+ g_test_skip("No KVM or TCG accelerator available, skipping boot tests");
32
+
33
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
34
+defined to mirror the Linux kernel parameter file
35
+``/proc/sys/abi/sve_default_vector_length``. The default length, ``N``,
36
+is in units of bytes and must be between 16 and 8192.
37
+If not specified, the default vector length is 64.
38
+
39
+If the default length is larger than the maximum vector length enabled,
40
+the actual vector length will be reduced. Note that the maximum vector
41
+length supported by QEMU is 256.
42
+
43
+If this property is set to ``-1`` then the default vector length
44
+is set to the maximum possible length.
45
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
46
index XXXXXXX..XXXXXXX 100644
47
--- a/target/arm/cpu.h
48
+++ b/target/arm/cpu.h
49
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
50
/* Used to set the maximum vector length the cpu will support. */
51
uint32_t sve_max_vq;
52
53
+#ifdef CONFIG_USER_ONLY
54
+ /* Used to set the default vector length at process start. */
55
+ uint32_t sve_default_vq;
56
+#endif
57
+
58
/*
59
* In sve_vq_map each set bit is a supported vector length of
60
* (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
61
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
62
index XXXXXXX..XXXXXXX 100644
63
--- a/target/arm/cpu.c
64
+++ b/target/arm/cpu.c
65
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
66
env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
67
/* with reasonable vector length */
68
if (cpu_isar_feature(aa64_sve, cpu)) {
69
- env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
70
+ env->vfp.zcr_el[1] =
71
+ aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
72
}
73
/*
74
* Enable TBI0 but not TBI1.
75
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
76
QLIST_INIT(&cpu->pre_el_change_hooks);
77
QLIST_INIT(&cpu->el_change_hooks);
78
79
-#ifndef CONFIG_USER_ONLY
80
+#ifdef CONFIG_USER_ONLY
81
+# ifdef TARGET_AARCH64
82
+ /*
83
+ * The linux kernel defaults to 512-bit vectors, when sve is supported.
84
+ * See documentation for /proc/sys/abi/sve_default_vector_length, and
85
+ * our corresponding sve-default-vector-length cpu property.
86
+ */
87
+ cpu->sve_default_vq = 4;
88
+# endif
89
+#else
90
/* Our inbound IRQ and FIQ lines */
91
if (kvm_enabled()) {
92
/* VIRQ and VFIQ are unused with KVM but we add them to maintain
93
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
94
index XXXXXXX..XXXXXXX 100644
95
--- a/target/arm/cpu64.c
96
+++ b/target/arm/cpu64.c
97
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
98
cpu->isar.id_aa64pfr0 = t;
99
}
100
101
+#ifdef CONFIG_USER_ONLY
102
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
103
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
104
+ const char *name, void *opaque,
105
+ Error **errp)
106
+{
107
+ ARMCPU *cpu = ARM_CPU(obj);
108
+ int32_t default_len, default_vq, remainder;
109
+
110
+ if (!visit_type_int32(v, name, &default_len, errp)) {
111
+ return;
26
+ return;
112
+ }
27
+ }
113
+
28
+
114
+ /* Undocumented, but the kernel allows -1 to indicate "maximum". */
29
qtest_add_data_func("cdrom/boot/default", "-cdrom ", test_cdboot);
115
+ if (default_len == -1) {
30
qtest_add_data_func("cdrom/boot/virtio-scsi",
116
+ cpu->sve_default_vq = ARM_MAX_VQ;
31
"-device virtio-scsi -device scsi-cd,drive=cdr "
32
@@ -XXX,XX +XXX,XX @@ static void add_x86_tests(void)
33
34
static void add_s390x_tests(void)
35
{
36
+ if (!qtest_has_accel("tcg") && !qtest_has_accel("kvm")) {
37
+ g_test_skip("No KVM or TCG accelerator available, skipping boot tests");
117
+ return;
38
+ return;
118
+ }
39
+ }
119
+
40
+
120
+ default_vq = default_len / 16;
41
qtest_add_data_func("cdrom/boot/default", "-cdrom ", test_cdboot);
121
+ remainder = default_len % 16;
42
qtest_add_data_func("cdrom/boot/virtio-scsi",
122
+
43
"-device virtio-scsi -device scsi-cd,drive=cdr "
123
+ /*
124
+ * Note that the 512 max comes from include/uapi/asm/sve_context.h
125
+ * and is the maximum architectural width of ZCR_ELx.LEN.
126
+ */
127
+ if (remainder || default_vq < 1 || default_vq > 512) {
128
+ error_setg(errp, "cannot set sve-default-vector-length");
129
+ if (remainder) {
130
+ error_append_hint(errp, "Vector length not a multiple of 16\n");
131
+ } else if (default_vq < 1) {
132
+ error_append_hint(errp, "Vector length smaller than 16\n");
133
+ } else {
134
+ error_append_hint(errp, "Vector length larger than %d\n",
135
+ 512 * 16);
136
+ }
137
+ return;
138
+ }
139
+
140
+ cpu->sve_default_vq = default_vq;
141
+}
142
+
143
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
144
+ const char *name, void *opaque,
145
+ Error **errp)
146
+{
147
+ ARMCPU *cpu = ARM_CPU(obj);
148
+ int32_t value = cpu->sve_default_vq * 16;
149
+
150
+ visit_type_int32(v, name, &value, errp);
151
+}
152
+#endif
153
+
154
void aarch64_add_sve_properties(Object *obj)
155
{
156
uint32_t vq;
157
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
158
object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
159
cpu_arm_set_sve_vq, NULL, NULL);
160
}
161
+
162
+#ifdef CONFIG_USER_ONLY
163
+ /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
164
+ object_property_add(obj, "sve-default-vector-length", "int32",
165
+ cpu_arm_get_sve_default_vec_len,
166
+ cpu_arm_set_sve_default_vec_len, NULL, NULL);
167
+#endif
168
}
169
170
void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
171
--
44
--
172
2.20.1
45
2.34.1
173
174
diff view generated by jsdifflib
1
From: Richard Henderson <richard.henderson@linaro.org>
1
In check_s2_mmu_setup() we have a check that is attempting to
2
implement the part of AArch64.S2MinTxSZ that is specific to when EL1
3
is AArch32:
2
4
3
Rename from sve_zcr_get_valid_len and make accessible
5
if !s1aarch64 then
4
from outside of helper.c.
6
// EL1 is AArch32
7
min_txsz = Min(min_txsz, 24);
5
8
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
Unfortunately we got this wrong in two ways:
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
8
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
11
(1) The minimum txsz corresponds to a maximum inputsize, but we got
12
the sense of the comparison wrong and were faulting for all
13
inputsizes less than 40 bits
14
15
(2) We try to implement this as an extra check that happens after
16
we've done the same txsz checks we would do for an AArch64 EL1, but
17
in fact the pseudocode is *loosening* the requirements, so that txsz
18
values that would fault for an AArch64 EL1 do not fault for AArch32
19
EL1, because it does Min(old_min, 24), not Max(old_min, 24).
20
21
You can see this also in the text of the Arm ARM in table D8-8, which
22
shows that where the implemented PA size is less than 40 bits an
23
AArch32 EL1 is still OK with a configured stage2 T0SZ for a 40 bit
24
IPA, whereas if EL1 is AArch64 then the T0SZ must be big enough to
25
constrain the IPA to the implemented PA size.
26
27
Because of part (2), we can't do this as a separate check, but
28
have to integrate it into aa64_va_parameters(). Add a new argument
29
to that function to indicate that EL1 is 32-bit. All the existing
30
callsites except the one in get_phys_addr_lpae() can pass 'false',
31
because they are either doing a lookup for a stage 1 regime or
32
else they don't care about the tsz/tsz_oob fields.
33
34
Cc: qemu-stable@nongnu.org
35
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1627
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
36
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
37
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
38
Message-id: 20230509092059.3176487-1-peter.maydell@linaro.org
10
---
39
---
11
target/arm/internals.h | 10 ++++++++++
40
target/arm/internals.h | 12 +++++++++++-
12
target/arm/helper.c | 4 ++--
41
target/arm/gdbstub64.c | 2 +-
13
2 files changed, 12 insertions(+), 2 deletions(-)
42
target/arm/helper.c | 15 +++++++++++++--
43
target/arm/ptw.c | 14 ++------------
44
target/arm/tcg/pauth_helper.c | 6 +++---
45
5 files changed, 30 insertions(+), 19 deletions(-)
14
46
15
diff --git a/target/arm/internals.h b/target/arm/internals.h
47
diff --git a/target/arm/internals.h b/target/arm/internals.h
16
index XXXXXXX..XXXXXXX 100644
48
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/internals.h
49
--- a/target/arm/internals.h
18
+++ b/target/arm/internals.h
50
+++ b/target/arm/internals.h
19
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
51
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
20
void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
52
ARMGranuleSize gran : 2;
21
#endif /* CONFIG_TCG */
53
} ARMVAParameters;
22
54
23
+/**
55
+/**
24
+ * aarch64_sve_zcr_get_valid_len:
56
+ * aa64_va_parameters: Return parameters for an AArch64 virtual address
25
+ * @cpu: cpu context
57
+ * @env: CPU
26
+ * @start_len: maximum len to consider
58
+ * @va: virtual address to look up
27
+ *
59
+ * @mmu_idx: determines translation regime to use
28
+ * Return the maximum supported sve vector length <= @start_len.
60
+ * @data: true if this is a data access
29
+ * Note that both @start_len and the return value are in units
61
+ * @el1_is_aa32: true if we are asking about stage 2 when EL1 is AArch32
30
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
62
+ * (ignored if @mmu_idx is for a stage 1 regime; only affects tsz/tsz_oob)
31
+ */
63
+ */
32
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
64
ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
33
65
- ARMMMUIdx mmu_idx, bool data);
34
enum arm_fprounding {
66
+ ARMMMUIdx mmu_idx, bool data,
35
FPROUNDING_TIEEVEN,
67
+ bool el1_is_aa32);
68
69
int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx);
70
int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx);
71
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
72
index XXXXXXX..XXXXXXX 100644
73
--- a/target/arm/gdbstub64.c
74
+++ b/target/arm/gdbstub64.c
75
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
76
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
77
ARMVAParameters param;
78
79
- param = aa64_va_parameters(env, -is_high, mmu_idx, is_data);
80
+ param = aa64_va_parameters(env, -is_high, mmu_idx, is_data, false);
81
return gdb_get_reg64(buf, pauth_ptr_mask(param));
82
}
83
default:
36
diff --git a/target/arm/helper.c b/target/arm/helper.c
84
diff --git a/target/arm/helper.c b/target/arm/helper.c
37
index XXXXXXX..XXXXXXX 100644
85
index XXXXXXX..XXXXXXX 100644
38
--- a/target/arm/helper.c
86
--- a/target/arm/helper.c
39
+++ b/target/arm/helper.c
87
+++ b/target/arm/helper.c
40
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
88
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
41
return 0;
89
unsigned int page_size_granule, page_shift, num, scale, exponent;
90
/* Extract one bit to represent the va selector in use. */
91
uint64_t select = sextract64(value, 36, 1);
92
- ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
93
+ ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true, false);
94
TLBIRange ret = { };
95
ARMGranuleSize gran;
96
97
@@ -XXX,XX +XXX,XX @@ static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran,
42
}
98
}
43
99
44
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
100
ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
45
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
101
- ARMMMUIdx mmu_idx, bool data)
102
+ ARMMMUIdx mmu_idx, bool data,
103
+ bool el1_is_aa32)
46
{
104
{
47
uint32_t end_len;
105
uint64_t tcr = regime_tcr(env, mmu_idx);
48
106
bool epd, hpd, tsz_oob, ds, ha, hd;
49
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
107
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
50
zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
108
}
51
}
109
}
52
110
53
- return sve_zcr_get_valid_len(cpu, zcr_len);
111
+ if (stage2 && el1_is_aa32) {
54
+ return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
112
+ /*
113
+ * For AArch32 EL1 the min txsz (and thus max IPA size) requirements
114
+ * are loosened: a configured IPA of 40 bits is permitted even if
115
+ * the implemented PA is less than that (and so a 40 bit IPA would
116
+ * fault for an AArch64 EL1). See R_DTLMN.
117
+ */
118
+ min_tsz = MIN(min_tsz, 24);
119
+ }
120
+
121
if (tsz > max_tsz) {
122
tsz = max_tsz;
123
tsz_oob = true;
124
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
125
index XXXXXXX..XXXXXXX 100644
126
--- a/target/arm/ptw.c
127
+++ b/target/arm/ptw.c
128
@@ -XXX,XX +XXX,XX @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
129
130
sl0 = extract32(tcr, 6, 2);
131
if (is_aa64) {
132
- /*
133
- * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
134
- * get_phys_addr_lpae, that used aa64_va_parameters which apply
135
- * to aarch64. If Stage1 is aarch32, the min_txsz is larger.
136
- * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
137
- * inputsize is 64 - 24 = 40.
138
- */
139
- if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
140
- goto fail;
141
- }
142
-
143
/*
144
* AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
145
* so interleave AArch64.S2StartLevel.
146
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
147
int ps;
148
149
param = aa64_va_parameters(env, address, mmu_idx,
150
- access_type != MMU_INST_FETCH);
151
+ access_type != MMU_INST_FETCH,
152
+ !arm_el_is_aa64(env, 1));
153
level = 0;
154
155
/*
156
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
157
index XXXXXXX..XXXXXXX 100644
158
--- a/target/arm/tcg/pauth_helper.c
159
+++ b/target/arm/tcg/pauth_helper.c
160
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
161
ARMPACKey *key, bool data)
162
{
163
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
164
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
165
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
166
uint64_t pac, ext_ptr, ext, test;
167
int bot_bit, top_bit;
168
169
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
170
ARMPACKey *key, bool data, int keynumber)
171
{
172
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
173
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
174
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
175
int bot_bit, top_bit;
176
uint64_t pac, orig_ptr, test;
177
178
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
179
static uint64_t pauth_strip(CPUARMState *env, uint64_t ptr, bool data)
180
{
181
ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
182
- ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
183
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false);
184
185
return pauth_original_ptr(ptr, param);
55
}
186
}
56
57
static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
58
--
187
--
59
2.20.1
188
2.34.1
60
61
diff view generated by jsdifflib