1 | arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length | 1 | Hi; here's a relatively small target-arm queue, pretty much all |
---|---|---|---|
2 | patches, which are somewhere between a bugfix and a new feature. | 2 | bug fixes. (There are a few non-arm patches that I've thrown in |
3 | there too for my convenience :-)) | ||
3 | 4 | ||
4 | thanks | 5 | thanks |
5 | -- PMM | 6 | -- PMM |
6 | 7 | ||
7 | The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a: | 8 | The following changes since commit 278238505d28d292927bff7683f39fb4fbca7fd1: |
8 | 9 | ||
9 | Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100) | 10 | Merge tag 'pull-tcg-20230511-2' of https://gitlab.com/rth7680/qemu into staging (2023-05-11 11:44:23 +0100) |
10 | 11 | ||
11 | are available in the Git repository at: | 12 | are available in the Git repository at: |
12 | 13 | ||
13 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727 | 14 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230512 |
14 | 15 | ||
15 | for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749: | 16 | for you to fetch changes up to 478dccbb99db0bf8f00537dd0b4d0de88d5cb537: |
16 | 17 | ||
17 | hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100) | 18 | target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check (2023-05-12 16:01:25 +0100) |
18 | 19 | ||
19 | ---------------------------------------------------------------- | 20 | ---------------------------------------------------------------- |
20 | target-arm queue: | 21 | target-arm queue: |
21 | * hw/arm/smmuv3: Check 31st bit to see if CD is valid | 22 | * More refactoring of files into tcg/ |
22 | * qemu-options.hx: Fix formatting of -machine memory-backend option | 23 | * Don't allow stage 2 page table walks to downgrade to NS |
23 | * hw: aspeed_gpio: Fix memory size | 24 | * Fix handling of SW and NSW bits for stage 2 walks |
24 | * hw/arm/nseries: Display hexadecimal value with '0x' prefix | 25 | * MAINTAINERS: Update Akihiko Odaki's email address |
25 | * Add sve-default-vector-length cpu property | 26 | * ui: Fix pixel colour channel order for PNG screenshots |
26 | * docs: Update path that mentions deprecated.rst | 27 | * docs: Remove unused weirdly-named cross-reference targets |
27 | * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS | 28 | * hw/mips/malta: Fix minor dead code issue |
28 | * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING | 29 | * Fixes for the "allow CONFIG_TCG=n" changes |
29 | * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts | 30 | * tests/qtest: Don't run cdrom boot tests if no accelerator is present |
30 | * target/arm: Report M-profile alignment faults correctly to the guest | 31 | * target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check |
31 | * target/arm: Add missing 'return's after calling v7m_exception_taken() | ||
32 | * target/arm: Enforce that M-profile SP low 2 bits are always zero | ||
33 | 32 | ||
34 | ---------------------------------------------------------------- | 33 | ---------------------------------------------------------------- |
35 | Joe Komlodi (1): | 34 | Akihiko Odaki (1): |
36 | hw/arm/smmuv3: Check 31st bit to see if CD is valid | 35 | MAINTAINERS: Update Akihiko Odaki's email address |
37 | 36 | ||
38 | Joel Stanley (1): | 37 | Fabiano Rosas (3): |
39 | hw: aspeed_gpio: Fix memory size | 38 | target/arm: Select SEMIHOSTING when using TCG |
39 | target/arm: Select CONFIG_ARM_V7M when TCG is enabled | ||
40 | tests/qtest: Don't run cdrom boot tests if no accelerator is present | ||
40 | 41 | ||
41 | Mao Zhongyi (1): | 42 | Peter Maydell (6): |
42 | docs: Update path that mentions deprecated.rst | 43 | target/arm: Don't allow stage 2 page table walks to downgrade to NS |
44 | target/arm: Fix handling of SW and NSW bits for stage 2 walks | ||
45 | ui: Fix pixel colour channel order for PNG screenshots | ||
46 | docs: Remove unused weirdly-named cross-reference targets | ||
47 | hw/mips/malta: Fix minor dead code issue | ||
48 | target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check | ||
43 | 49 | ||
44 | Peter Maydell (7): | 50 | Richard Henderson (2): |
45 | qemu-options.hx: Fix formatting of -machine memory-backend option | 51 | target/arm: Move translate-a32.h, arm_ldst.h, sve_ldst_internal.h to tcg/ |
46 | target/arm: Enforce that M-profile SP low 2 bits are always zero | 52 | target/arm: Move helper-{a64,mve,sme,sve}.h to tcg/ |
47 | target/arm: Add missing 'return's after calling v7m_exception_taken() | ||
48 | target/arm: Report M-profile alignment faults correctly to the guest | ||
49 | hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts | ||
50 | hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING | ||
51 | hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS | ||
52 | 53 | ||
53 | Philippe Mathieu-Daudé (1): | 54 | MAINTAINERS | 4 +- |
54 | hw/arm/nseries: Display hexadecimal value with '0x' prefix | 55 | docs/system/devices/igb.rst | 2 +- |
55 | 56 | docs/system/devices/ivshmem.rst | 2 - | |
56 | Richard Henderson (3): | 57 | docs/system/devices/net.rst | 2 +- |
57 | target/arm: Correctly bound length in sve_zcr_get_valid_len | 58 | docs/system/devices/usb.rst | 2 - |
58 | target/arm: Export aarch64_sve_zcr_get_valid_len | 59 | docs/system/keys.rst | 2 +- |
59 | target/arm: Add sve-default-vector-length cpu property | 60 | docs/system/linuxboot.rst | 2 +- |
60 | 61 | docs/system/target-i386.rst | 4 -- | |
61 | docs/system/arm/cpu-features.rst | 15 ++++++++++ | 62 | target/arm/helper.h | 8 +-- |
62 | configure | 2 +- | 63 | target/arm/internals.h | 12 +++- |
63 | hw/arm/smmuv3-internal.h | 2 +- | 64 | target/arm/{ => tcg}/arm_ldst.h | 0 |
64 | target/arm/cpu.h | 5 ++++ | 65 | target/arm/{ => tcg}/helper-a64.h | 0 |
65 | target/arm/internals.h | 10 +++++++ | 66 | target/arm/{ => tcg}/helper-mve.h | 0 |
66 | hw/arm/nseries.c | 2 +- | 67 | target/arm/{ => tcg}/helper-sme.h | 0 |
67 | hw/gpio/aspeed_gpio.c | 3 +- | 68 | target/arm/{ => tcg}/helper-sve.h | 0 |
68 | hw/intc/armv7m_nvic.c | 40 +++++++++++++++++++-------- | 69 | target/arm/{ => tcg}/sve_ldst_internal.h | 0 |
69 | target/arm/cpu.c | 14 ++++++++-- | 70 | target/arm/{ => tcg}/translate-a32.h | 0 |
70 | target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++++++++++ | 71 | hw/mips/malta.c | 5 +- |
71 | target/arm/gdbstub.c | 4 +++ | 72 | target/arm/gdbstub64.c | 2 +- |
72 | target/arm/helper.c | 8 ++++-- | 73 | target/arm/helper.c | 15 ++++- |
73 | target/arm/m_helper.c | 24 ++++++++++++---- | 74 | target/arm/ptw.c | 95 +++++++++++++++++++------------- |
74 | target/arm/translate.c | 3 ++ | 75 | target/arm/tcg/pauth_helper.c | 6 +- |
75 | target/i386/cpu.c | 2 +- | 76 | tests/qtest/cdrom-test.c | 10 ++++ |
76 | MAINTAINERS | 2 +- | 77 | ui/console.c | 4 +- |
77 | qemu-options.hx | 30 +++++++++++--------- | 78 | target/arm/Kconfig | 9 +-- |
78 | 17 files changed, 183 insertions(+), 43 deletions(-) | 79 | 25 files changed, 109 insertions(+), 77 deletions(-) |
79 | 80 | rename target/arm/{ => tcg}/arm_ldst.h (100%) | |
81 | rename target/arm/{ => tcg}/helper-a64.h (100%) | ||
82 | rename target/arm/{ => tcg}/helper-mve.h (100%) | ||
83 | rename target/arm/{ => tcg}/helper-sme.h (100%) | ||
84 | rename target/arm/{ => tcg}/helper-sve.h (100%) | ||
85 | rename target/arm/{ => tcg}/sve_ldst_internal.h (100%) | ||
86 | rename target/arm/{ => tcg}/translate-a32.h (100%) | diff view generated by jsdifflib |
1 | From: Joel Stanley <joel@jms.id.au> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
---|---|---|---|
2 | 2 | ||
3 | The macro used to calculate the maximum memory size of the MMIO region | 3 | These files got missed when populating tcg/. |
4 | had a mistake, causing all GPIO models to create a mapping of 0x9D8. | 4 | Because they are included with "", no change to the users required. |
5 | The intent was to have it be 0x9D8 - 0x800. | ||
6 | 5 | ||
7 | This extra size doesn't matter on ast2400 and ast2500, which have a 4KB | 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
8 | region set aside for the GPIO controller. | 7 | Reviewed-by: Fabiano Rosas <farosas@suse.de> |
9 | 8 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | |
10 | On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the | 9 | Message-id: 20230504110412.1892411-2-richard.henderson@linaro.org |
11 | regions would overlap. Worse was the 1.8V controller would map over the | ||
12 | top of the following peripheral, which happens to be the RTC. | ||
13 | |||
14 | The mmio region used by each device is a maximum of 2KB, so avoid the | ||
15 | calculations and hard code this as the maximum. | ||
16 | |||
17 | Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation") | ||
18 | Signed-off-by: Joel Stanley <joel@jms.id.au> | ||
19 | Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com> | ||
20 | Reviewed-by: Cédric Le Goater <clg@kaod.org> | ||
21 | Message-id: 20210713065854.134634-2-joel@jms.id.au | ||
22 | [PMM: fix autocorrect error in commit message] | ||
23 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
24 | --- | 11 | --- |
25 | hw/gpio/aspeed_gpio.c | 3 +-- | 12 | target/arm/{ => tcg}/arm_ldst.h | 0 |
26 | 1 file changed, 1 insertion(+), 2 deletions(-) | 13 | target/arm/{ => tcg}/sve_ldst_internal.h | 0 |
14 | target/arm/{ => tcg}/translate-a32.h | 0 | ||
15 | 3 files changed, 0 insertions(+), 0 deletions(-) | ||
16 | rename target/arm/{ => tcg}/arm_ldst.h (100%) | ||
17 | rename target/arm/{ => tcg}/sve_ldst_internal.h (100%) | ||
18 | rename target/arm/{ => tcg}/translate-a32.h (100%) | ||
27 | 19 | ||
28 | diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c | 20 | diff --git a/target/arm/arm_ldst.h b/target/arm/tcg/arm_ldst.h |
29 | index XXXXXXX..XXXXXXX 100644 | 21 | similarity index 100% |
30 | --- a/hw/gpio/aspeed_gpio.c | 22 | rename from target/arm/arm_ldst.h |
31 | +++ b/hw/gpio/aspeed_gpio.c | 23 | rename to target/arm/tcg/arm_ldst.h |
32 | @@ -XXX,XX +XXX,XX @@ | 24 | diff --git a/target/arm/sve_ldst_internal.h b/target/arm/tcg/sve_ldst_internal.h |
33 | #define GPIO_1_8V_MEM_SIZE 0x9D8 | 25 | similarity index 100% |
34 | #define GPIO_1_8V_REG_ARRAY_SIZE ((GPIO_1_8V_MEM_SIZE - \ | 26 | rename from target/arm/sve_ldst_internal.h |
35 | GPIO_1_8V_REG_OFFSET) >> 2) | 27 | rename to target/arm/tcg/sve_ldst_internal.h |
36 | -#define GPIO_MAX_MEM_SIZE MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE) | 28 | diff --git a/target/arm/translate-a32.h b/target/arm/tcg/translate-a32.h |
37 | 29 | similarity index 100% | |
38 | static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio) | 30 | rename from target/arm/translate-a32.h |
39 | { | 31 | rename to target/arm/tcg/translate-a32.h |
40 | @@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp) | ||
41 | } | ||
42 | |||
43 | memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s, | ||
44 | - TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE); | ||
45 | + TYPE_ASPEED_GPIO, 0x800); | ||
46 | |||
47 | sysbus_init_mmio(sbd, &s->iomem); | ||
48 | } | ||
49 | -- | 32 | -- |
50 | 2.20.1 | 33 | 2.34.1 |
51 | 34 | ||
52 | 35 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
---|---|---|---|
2 | 2 | ||
3 | Currently, our only caller is sve_zcr_len_for_el, which has | 3 | While we cannot move the main "helper.h" out of target/arm/, |
4 | already masked the length extracted from ZCR_ELx, so the | 4 | due to usage by generic code, we can move the sub-includes. |
5 | masking done here is a nop. But we will shortly have uses | ||
6 | from other locations, where the length will be unmasked. | ||
7 | |||
8 | Saturate the length to ARM_MAX_VQ instead of truncating to | ||
9 | the low 4 bits. | ||
10 | 5 | ||
11 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
12 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Fabiano Rosas <farosas@suse.de> |
13 | Message-id: 20210723203344.968563-2-richard.henderson@linaro.org | 8 | Message-id: 20230504110412.1892411-3-richard.henderson@linaro.org |
9 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
15 | --- | 11 | --- |
16 | target/arm/helper.c | 4 +++- | 12 | target/arm/helper.h | 8 ++++---- |
17 | 1 file changed, 3 insertions(+), 1 deletion(-) | 13 | target/arm/{ => tcg}/helper-a64.h | 0 |
14 | target/arm/{ => tcg}/helper-mve.h | 0 | ||
15 | target/arm/{ => tcg}/helper-sme.h | 0 | ||
16 | target/arm/{ => tcg}/helper-sve.h | 0 | ||
17 | 5 files changed, 4 insertions(+), 4 deletions(-) | ||
18 | rename target/arm/{ => tcg}/helper-a64.h (100%) | ||
19 | rename target/arm/{ => tcg}/helper-mve.h (100%) | ||
20 | rename target/arm/{ => tcg}/helper-sme.h (100%) | ||
21 | rename target/arm/{ => tcg}/helper-sve.h (100%) | ||
18 | 22 | ||
19 | diff --git a/target/arm/helper.c b/target/arm/helper.c | 23 | diff --git a/target/arm/helper.h b/target/arm/helper.h |
20 | index XXXXXXX..XXXXXXX 100644 | 24 | index XXXXXXX..XXXXXXX 100644 |
21 | --- a/target/arm/helper.c | 25 | --- a/target/arm/helper.h |
22 | +++ b/target/arm/helper.c | 26 | +++ b/target/arm/helper.h |
23 | @@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) | 27 | @@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_uclamp_d, TCG_CALL_NO_RWG, |
24 | { | 28 | void, ptr, ptr, ptr, ptr, i32) |
25 | uint32_t end_len; | 29 | |
26 | 30 | #ifdef TARGET_AARCH64 | |
27 | - end_len = start_len &= 0xf; | 31 | -#include "helper-a64.h" |
28 | + start_len = MIN(start_len, ARM_MAX_VQ - 1); | 32 | -#include "helper-sve.h" |
29 | + end_len = start_len; | 33 | -#include "helper-sme.h" |
30 | + | 34 | +#include "tcg/helper-a64.h" |
31 | if (!test_bit(start_len, cpu->sve_vq_map)) { | 35 | +#include "tcg/helper-sve.h" |
32 | end_len = find_last_bit(cpu->sve_vq_map, start_len); | 36 | +#include "tcg/helper-sme.h" |
33 | assert(end_len < start_len); | 37 | #endif |
38 | |||
39 | -#include "helper-mve.h" | ||
40 | +#include "tcg/helper-mve.h" | ||
41 | diff --git a/target/arm/helper-a64.h b/target/arm/tcg/helper-a64.h | ||
42 | similarity index 100% | ||
43 | rename from target/arm/helper-a64.h | ||
44 | rename to target/arm/tcg/helper-a64.h | ||
45 | diff --git a/target/arm/helper-mve.h b/target/arm/tcg/helper-mve.h | ||
46 | similarity index 100% | ||
47 | rename from target/arm/helper-mve.h | ||
48 | rename to target/arm/tcg/helper-mve.h | ||
49 | diff --git a/target/arm/helper-sme.h b/target/arm/tcg/helper-sme.h | ||
50 | similarity index 100% | ||
51 | rename from target/arm/helper-sme.h | ||
52 | rename to target/arm/tcg/helper-sme.h | ||
53 | diff --git a/target/arm/helper-sve.h b/target/arm/tcg/helper-sve.h | ||
54 | similarity index 100% | ||
55 | rename from target/arm/helper-sve.h | ||
56 | rename to target/arm/tcg/helper-sve.h | ||
34 | -- | 57 | -- |
35 | 2.20.1 | 58 | 2.34.1 |
36 | 59 | ||
37 | 60 | diff view generated by jsdifflib |
1 | The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of | 1 | Bit 63 in a Table descriptor is only the NSTable bit for stage 1 |
---|---|---|---|
2 | the register. We were incorrectly masking it to 8 bits, so it would | 2 | translations; in stage 2 it is RES0. We were incorrectly looking at |
3 | report the wrong value if the pending exception was greater than 256. | 3 | it all the time. |
4 | Fix the bug. | ||
5 | 4 | ||
5 | This causes problems if: | ||
6 | * the stage 2 table descriptor was incorrectly setting the RES0 bit | ||
7 | * we are doing a stage 2 translation in Secure address space for | ||
8 | a NonSecure stage 1 regime -- in this case we would incorrectly | ||
9 | do an immediate downgrade to NonSecure | ||
10 | |||
11 | A bug elsewhere in the code currently prevents us from getting | ||
12 | to the second situation, but when we fix that it will be possible. | ||
13 | |||
14 | Cc: qemu-stable@nongnu.org | ||
6 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
7 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 16 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
8 | Message-id: 20210723162146.5167-6-peter.maydell@linaro.org | 17 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> |
18 | Message-id: 20230504135425.2748672-2-peter.maydell@linaro.org | ||
9 | --- | 19 | --- |
10 | hw/intc/armv7m_nvic.c | 2 +- | 20 | target/arm/ptw.c | 5 +++-- |
11 | 1 file changed, 1 insertion(+), 1 deletion(-) | 21 | 1 file changed, 3 insertions(+), 2 deletions(-) |
12 | 22 | ||
13 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c | 23 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
14 | index XXXXXXX..XXXXXXX 100644 | 24 | index XXXXXXX..XXXXXXX 100644 |
15 | --- a/hw/intc/armv7m_nvic.c | 25 | --- a/target/arm/ptw.c |
16 | +++ b/hw/intc/armv7m_nvic.c | 26 | +++ b/target/arm/ptw.c |
17 | @@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) | 27 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, |
18 | /* VECTACTIVE */ | 28 | descaddrmask &= ~indexmask_grainsize; |
19 | val = cpu->env.v7m.exception; | 29 | |
20 | /* VECTPENDING */ | 30 | /* |
21 | - val |= (s->vectpending & 0xff) << 12; | 31 | - * Secure accesses start with the page table in secure memory and |
22 | + val |= (s->vectpending & 0x1ff) << 12; | 32 | + * Secure stage 1 accesses start with the page table in secure memory and |
23 | /* ISRPENDING - set if any external IRQ is pending */ | 33 | * can be downgraded to non-secure at any step. Non-secure accesses |
24 | if (nvic_isrpending(s)) { | 34 | * remain non-secure. We implement this by just ORing in the NSTable/NS |
25 | val |= (1 << 22); | 35 | * bits at each step. |
36 | + * Stage 2 never gets this kind of downgrade. | ||
37 | */ | ||
38 | tableattrs = is_secure ? 0 : (1 << 4); | ||
39 | |||
40 | next_level: | ||
41 | descaddr |= (address >> (stride * (4 - level))) & indexmask; | ||
42 | descaddr &= ~7ULL; | ||
43 | - nstable = extract32(tableattrs, 4, 1); | ||
44 | + nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1); | ||
45 | if (nstable) { | ||
46 | /* | ||
47 | * Stage2_S -> Stage2 or Phys_S -> Phys_NS | ||
26 | -- | 48 | -- |
27 | 2.20.1 | 49 | 2.34.1 |
28 | 50 | ||
29 | 51 | diff view generated by jsdifflib |
1 | In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if | 1 | We currently don't correctly handle the VSTCR_EL2.SW and VTCR_EL2.NSW |
---|---|---|---|
2 | the register is accessed NonSecure and the highest priority pending | 2 | configuration bits. These allow configuration of whether the stage 2 |
3 | enabled exception (that would be returned in the VECTPENDING field) | 3 | page table walks for Secure IPA and NonSecure IPA should do their |
4 | targets Secure, then the VECTPENDING field must read 1 rather than | 4 | descriptor reads from Secure or NonSecure physical addresses. (This |
5 | the exception number of the pending exception. Implement this. | 5 | is separate from how the translation table base address and other |
6 | parameters are set: an NS IPA always uses VTTBR_EL2 and VTCR_EL2 | ||
7 | for its base address and walk parameters, regardless of the NSW bit, | ||
8 | and similarly for Secure.) | ||
6 | 9 | ||
10 | Provide a new function ptw_idx_for_stage_2() which returns the | ||
11 | MMU index to use for descriptor reads, and use it to set up | ||
12 | the .in_ptw_idx wherever we call get_phys_addr_lpae(). | ||
13 | |||
14 | For a stage 2 walk, wherever we call get_phys_addr_lpae(): | ||
15 | * .in_ptw_idx should be ptw_idx_for_stage_2() of the .in_mmu_idx | ||
16 | * .in_secure should be true if .in_mmu_idx is Stage2_S | ||
17 | |||
18 | This allows us to correct S1_ptw_translate() so that it consistently | ||
19 | always sets its (out_secure, out_phys) to the result it gets from the | ||
20 | S2 walk (either by calling get_phys_addr_lpae() or by TLB lookup). | ||
21 | This makes better conceptual sense because the S2 walk should return | ||
22 | us an (address space, address) tuple, not an address that we then | ||
23 | randomly assign to S or NS. | ||
24 | |||
25 | Our previous handling of SW and NSW was broken, so guest code | ||
26 | trying to use these bits to put the s2 page tables in the "other" | ||
27 | address space wouldn't work correctly. | ||
28 | |||
29 | Cc: qemu-stable@nongnu.org | ||
30 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1600 | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 31 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
8 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 32 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
9 | Message-id: 20210723162146.5167-7-peter.maydell@linaro.org | 33 | Message-id: 20230504135425.2748672-3-peter.maydell@linaro.org |
10 | --- | 34 | --- |
11 | hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++------- | 35 | target/arm/ptw.c | 76 ++++++++++++++++++++++++++++++++---------------- |
12 | 1 file changed, 24 insertions(+), 7 deletions(-) | 36 | 1 file changed, 51 insertions(+), 25 deletions(-) |
13 | 37 | ||
14 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c | 38 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
15 | index XXXXXXX..XXXXXXX 100644 | 39 | index XXXXXXX..XXXXXXX 100644 |
16 | --- a/hw/intc/armv7m_nvic.c | 40 | --- a/target/arm/ptw.c |
17 | +++ b/hw/intc/armv7m_nvic.c | 41 | +++ b/target/arm/ptw.c |
18 | @@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque) | 42 | @@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env) |
19 | nvic_irq_update(s); | 43 | return stage_1_mmu_idx(arm_mmu_idx(env)); |
20 | } | 44 | } |
21 | 45 | ||
22 | +static bool vectpending_targets_secure(NVICState *s) | 46 | +/* |
47 | + * Return where we should do ptw loads from for a stage 2 walk. | ||
48 | + * This depends on whether the address we are looking up is a | ||
49 | + * Secure IPA or a NonSecure IPA, which we know from whether this is | ||
50 | + * Stage2 or Stage2_S. | ||
51 | + * If this is the Secure EL1&0 regime we need to check the NSW and SW bits. | ||
52 | + */ | ||
53 | +static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx) | ||
23 | +{ | 54 | +{ |
24 | + /* Return true if s->vectpending targets Secure state */ | 55 | + bool s2walk_secure; |
25 | + if (s->vectpending_is_s_banked) { | 56 | + |
26 | + return true; | 57 | + /* |
58 | + * We're OK to check the current state of the CPU here because | ||
59 | + * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes | ||
60 | + * (2) there's no way to do a lookup that cares about Stage 2 for a | ||
61 | + * different security state to the current one for AArch64, and AArch32 | ||
62 | + * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do | ||
63 | + * an NS stage 1+2 lookup while the NS bit is 0.) | ||
64 | + */ | ||
65 | + if (!arm_is_secure_below_el3(env) || !arm_el_is_aa64(env, 3)) { | ||
66 | + return ARMMMUIdx_Phys_NS; | ||
27 | + } | 67 | + } |
28 | + return !exc_is_banked(s->vectpending) && | 68 | + if (stage2idx == ARMMMUIdx_Stage2_S) { |
29 | + exc_targets_secure(s, s->vectpending); | 69 | + s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW); |
70 | + } else { | ||
71 | + s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW); | ||
72 | + } | ||
73 | + return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; | ||
74 | + | ||
30 | +} | 75 | +} |
31 | + | 76 | + |
32 | void armv7m_nvic_get_pending_irq_info(void *opaque, | 77 | static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx) |
33 | int *pirq, bool *ptargets_secure) | ||
34 | { | 78 | { |
35 | @@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque, | 79 | return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0; |
36 | 80 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, | |
37 | assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq); | 81 | ARMMMUIdx mmu_idx = ptw->in_mmu_idx; |
38 | 82 | ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx; | |
39 | - if (s->vectpending_is_s_banked) { | 83 | uint8_t pte_attrs; |
40 | - targets_secure = true; | 84 | - bool pte_secure; |
85 | |||
86 | ptw->out_virt = addr; | ||
87 | |||
88 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, | ||
89 | if (regime_is_stage2(s2_mmu_idx)) { | ||
90 | S1Translate s2ptw = { | ||
91 | .in_mmu_idx = s2_mmu_idx, | ||
92 | - .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS, | ||
93 | - .in_secure = is_secure, | ||
94 | + .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx), | ||
95 | + .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S, | ||
96 | .in_debug = true, | ||
97 | }; | ||
98 | GetPhysAddrResult s2 = { }; | ||
99 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, | ||
100 | } | ||
101 | ptw->out_phys = s2.f.phys_addr; | ||
102 | pte_attrs = s2.cacheattrs.attrs; | ||
103 | - pte_secure = s2.f.attrs.secure; | ||
104 | + ptw->out_secure = s2.f.attrs.secure; | ||
105 | } else { | ||
106 | /* Regime is physical. */ | ||
107 | ptw->out_phys = addr; | ||
108 | pte_attrs = 0; | ||
109 | - pte_secure = is_secure; | ||
110 | + ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S; | ||
111 | } | ||
112 | ptw->out_host = NULL; | ||
113 | ptw->out_rw = false; | ||
114 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, | ||
115 | ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK); | ||
116 | ptw->out_rw = full->prot & PAGE_WRITE; | ||
117 | pte_attrs = full->pte_attrs; | ||
118 | - pte_secure = full->attrs.secure; | ||
119 | + ptw->out_secure = full->attrs.secure; | ||
120 | #else | ||
121 | g_assert_not_reached(); | ||
122 | #endif | ||
123 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, | ||
124 | } | ||
125 | } | ||
126 | |||
127 | - /* Check if page table walk is to secure or non-secure PA space. */ | ||
128 | - ptw->out_secure = (is_secure | ||
129 | - && !(pte_secure | ||
130 | - ? env->cp15.vstcr_el2 & VSTCR_SW | ||
131 | - : env->cp15.vtcr_el2 & VTCR_NSW)); | ||
132 | ptw->out_be = regime_translation_big_endian(env, mmu_idx); | ||
133 | return true; | ||
134 | |||
135 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, | ||
136 | hwaddr ipa; | ||
137 | int s1_prot, s1_lgpgsz; | ||
138 | bool is_secure = ptw->in_secure; | ||
139 | - bool ret, ipa_secure, s2walk_secure; | ||
140 | + bool ret, ipa_secure; | ||
141 | ARMCacheAttrs cacheattrs1; | ||
142 | bool is_el0; | ||
143 | uint64_t hcr; | ||
144 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, | ||
145 | |||
146 | ipa = result->f.phys_addr; | ||
147 | ipa_secure = result->f.attrs.secure; | ||
148 | - if (is_secure) { | ||
149 | - /* Select TCR based on the NS bit from the S1 walk. */ | ||
150 | - s2walk_secure = !(ipa_secure | ||
151 | - ? env->cp15.vstcr_el2 & VSTCR_SW | ||
152 | - : env->cp15.vtcr_el2 & VTCR_NSW); | ||
41 | - } else { | 153 | - } else { |
42 | - targets_secure = !exc_is_banked(pending) && | 154 | - assert(!ipa_secure); |
43 | - exc_targets_secure(s, pending); | 155 | - s2walk_secure = false; |
44 | - } | 156 | - } |
45 | + targets_secure = vectpending_targets_secure(s); | 157 | |
46 | 158 | is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0; | |
47 | trace_nvic_get_pending_irq_info(pending, targets_secure); | 159 | - ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; |
48 | 160 | - ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; | |
49 | @@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs) | 161 | - ptw->in_secure = s2walk_secure; |
50 | /* VECTACTIVE */ | 162 | + ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; |
51 | val = cpu->env.v7m.exception; | 163 | + ptw->in_secure = ipa_secure; |
52 | /* VECTPENDING */ | 164 | + ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx); |
53 | - val |= (s->vectpending & 0x1ff) << 12; | 165 | |
54 | + if (s->vectpending) { | 166 | /* |
55 | + /* | 167 | * S1 is done, now do S2 translation. |
56 | + * From v8.1M VECTPENDING must read as 1 if accessed as | 168 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, |
57 | + * NonSecure and the highest priority pending and enabled | 169 | ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2; |
58 | + * exception targets Secure. | 170 | break; |
59 | + */ | 171 | |
60 | + int vp = s->vectpending; | 172 | + case ARMMMUIdx_Stage2: |
61 | + if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) && | 173 | + case ARMMMUIdx_Stage2_S: |
62 | + vectpending_targets_secure(s)) { | 174 | + /* |
63 | + vp = 1; | 175 | + * Second stage lookup uses physical for ptw; whether this is S or |
64 | + } | 176 | + * NS may depend on the SW/NSW bits if this is a stage 2 lookup for |
65 | + val |= (vp & 0x1ff) << 12; | 177 | + * the Secure EL2&0 regime. |
66 | + } | 178 | + */ |
67 | /* ISRPENDING - set if any external IRQ is pending */ | 179 | + ptw->in_ptw_idx = ptw_idx_for_stage_2(env, mmu_idx); |
68 | if (nvic_isrpending(s)) { | 180 | + break; |
69 | val |= (1 << 22); | 181 | + |
182 | case ARMMMUIdx_E10_0: | ||
183 | s1_mmu_idx = ARMMMUIdx_Stage1_E0; | ||
184 | goto do_twostage; | ||
185 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw, | ||
186 | /* fall through */ | ||
187 | |||
188 | default: | ||
189 | - /* Single stage and second stage uses physical for ptw. */ | ||
190 | + /* Single stage uses physical for ptw. */ | ||
191 | ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS; | ||
192 | break; | ||
193 | } | ||
70 | -- | 194 | -- |
71 | 2.20.1 | 195 | 2.34.1 |
72 | |||
73 | diff view generated by jsdifflib |
1 | From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> | 1 | From: Akihiko Odaki <akihiko.odaki@gmail.com> |
---|---|---|---|
2 | 2 | ||
3 | Missed in commit f3478392 "docs: Move deprecation, build | 3 | I am now employed by Daynix. Although my role as a reviewer of |
4 | and license info out of system/" | 4 | macOS-related change is not very relevant to the employment, I decided |
5 | to use the company email address to avoid confusions from different | ||
6 | addresses. | ||
5 | 7 | ||
6 | Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com> | 8 | Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> |
7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> |
8 | Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com | 10 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> |
11 | Message-id: 20230506072333.32510-1-akihiko.odaki@daynix.com | ||
9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
10 | --- | 13 | --- |
11 | configure | 2 +- | 14 | MAINTAINERS | 4 ++-- |
12 | target/i386/cpu.c | 2 +- | 15 | 1 file changed, 2 insertions(+), 2 deletions(-) |
13 | MAINTAINERS | 2 +- | ||
14 | 3 files changed, 3 insertions(+), 3 deletions(-) | ||
15 | 16 | ||
16 | diff --git a/configure b/configure | ||
17 | index XXXXXXX..XXXXXXX 100755 | ||
18 | --- a/configure | ||
19 | +++ b/configure | ||
20 | @@ -XXX,XX +XXX,XX @@ fi | ||
21 | |||
22 | if test -n "${deprecated_features}"; then | ||
23 | echo "Warning, deprecated features enabled." | ||
24 | - echo "Please see docs/system/deprecated.rst" | ||
25 | + echo "Please see docs/about/deprecated.rst" | ||
26 | echo " features: ${deprecated_features}" | ||
27 | fi | ||
28 | |||
29 | diff --git a/target/i386/cpu.c b/target/i386/cpu.c | ||
30 | index XXXXXXX..XXXXXXX 100644 | ||
31 | --- a/target/i386/cpu.c | ||
32 | +++ b/target/i386/cpu.c | ||
33 | @@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = { | ||
34 | * none", but this is just for compatibility while libvirt isn't | ||
35 | * adapted to resolve CPU model versions before creating VMs. | ||
36 | * See "Runnability guarantee of CPU models" at | ||
37 | - * docs/system/deprecated.rst. | ||
38 | + * docs/about/deprecated.rst. | ||
39 | */ | ||
40 | X86CPUVersion default_cpu_version = 1; | ||
41 | |||
42 | diff --git a/MAINTAINERS b/MAINTAINERS | 17 | diff --git a/MAINTAINERS b/MAINTAINERS |
43 | index XXXXXXX..XXXXXXX 100644 | 18 | index XXXXXXX..XXXXXXX 100644 |
44 | --- a/MAINTAINERS | 19 | --- a/MAINTAINERS |
45 | +++ b/MAINTAINERS | 20 | +++ b/MAINTAINERS |
46 | @@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/* | 21 | @@ -XXX,XX +XXX,XX @@ Core Audio framework backend |
47 | 22 | M: Gerd Hoffmann <kraxel@redhat.com> | |
48 | Incompatible changes | 23 | M: Philippe Mathieu-Daudé <philmd@linaro.org> |
49 | R: libvir-list@redhat.com | 24 | R: Christian Schoenebeck <qemu_oss@crudebyte.com> |
50 | -F: docs/system/deprecated.rst | 25 | -R: Akihiko Odaki <akihiko.odaki@gmail.com> |
51 | +F: docs/about/deprecated.rst | 26 | +R: Akihiko Odaki <akihiko.odaki@daynix.com> |
52 | 27 | S: Odd Fixes | |
53 | Build System | 28 | F: audio/coreaudio.c |
54 | ------------ | 29 | |
30 | @@ -XXX,XX +XXX,XX @@ F: docs/devel/ui.rst | ||
31 | Cocoa graphics | ||
32 | M: Peter Maydell <peter.maydell@linaro.org> | ||
33 | M: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
34 | -R: Akihiko Odaki <akihiko.odaki@gmail.com> | ||
35 | +R: Akihiko Odaki <akihiko.odaki@daynix.com> | ||
36 | S: Odd Fixes | ||
37 | F: ui/cocoa.m | ||
38 | |||
55 | -- | 39 | -- |
56 | 2.20.1 | 40 | 2.34.1 |
57 | 41 | ||
58 | 42 | diff view generated by jsdifflib |
1 | The ISCR.ISRPENDING bit is set when an external interrupt is pending. | 1 | When we take a PNG screenshot the ordering of the colour channels in |
---|---|---|---|
2 | This is true whether that external interrupt is enabled or not. | 2 | the data is not correct, resulting in the image having weird |
3 | This means that we can't use 's->vectpending == 0' as a shortcut to | 3 | colouring compared to the actual display. (Specifically, on a |
4 | "ISRPENDING is zero", because s->vectpending indicates only the | 4 | little-endian host the blue and red channels are swapped; on |
5 | highest priority pending enabled interrupt. | 5 | big-endian everything is wrong.) |
6 | 6 | ||
7 | Remove the incorrect optimization so that if there is no pending | 7 | This happens because the pixman idea of the pixel data and the libpng |
8 | enabled interrupt we fall through to scanning through the whole | 8 | idea differ. PIXMAN_a8r8g8b8 defines that pixels are 32-bit values, |
9 | interrupt array. | 9 | with A in bits 24-31, R in bits 16-23, G in bits 8-15 and B in bits |
10 | 0-7. This means that on little-endian systems the bytes in memory | ||
11 | are | ||
12 | B G R A | ||
13 | and on big-endian systems they are | ||
14 | A R G B | ||
10 | 15 | ||
16 | libpng, on the other hand, thinks of pixels as being a series of | ||
17 | values for each channel, so its format PNG_COLOR_TYPE_RGB_ALPHA | ||
18 | always wants bytes in the order | ||
19 | R G B A | ||
20 | |||
21 | This isn't the same as the pixman order for either big or little | ||
22 | endian hosts. | ||
23 | |||
24 | The alpha channel is also unnecessary bulk in the output PNG file, | ||
25 | because there is no alpha information in a screenshot. | ||
26 | |||
27 | To handle the endianness issue, we already define in ui/qemu-pixman.h | ||
28 | various PIXMAN_BE_* and PIXMAN_LE_* values that give consistent | ||
29 | byte-order pixel channel formats. So we can use PIXMAN_BE_r8g8b8 and | ||
30 | PNG_COLOR_TYPE_RGB, which both have an in-memory byte order of | ||
31 | R G B | ||
32 | and 3 bytes per pixel. | ||
33 | |||
34 | (PPM format screenshots get this right; they already use the | ||
35 | PIXMAN_BE_r8g8b8 format.) | ||
36 | |||
37 | Cc: qemu-stable@nongnu.org | ||
38 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1622 | ||
39 | Fixes: 9a0a119a382867 ("Added parameter to take screenshot with screendump as PNG") | ||
11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 40 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
12 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 41 | Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> |
13 | Message-id: 20210723162146.5167-5-peter.maydell@linaro.org | 42 | Message-id: 20230502135548.2451309-1-peter.maydell@linaro.org |
14 | --- | 43 | --- |
15 | hw/intc/armv7m_nvic.c | 9 ++++----- | 44 | ui/console.c | 4 ++-- |
16 | 1 file changed, 4 insertions(+), 5 deletions(-) | 45 | 1 file changed, 2 insertions(+), 2 deletions(-) |
17 | 46 | ||
18 | diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c | 47 | diff --git a/ui/console.c b/ui/console.c |
19 | index XXXXXXX..XXXXXXX 100644 | 48 | index XXXXXXX..XXXXXXX 100644 |
20 | --- a/hw/intc/armv7m_nvic.c | 49 | --- a/ui/console.c |
21 | +++ b/hw/intc/armv7m_nvic.c | 50 | +++ b/ui/console.c |
22 | @@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s) | 51 | @@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp) |
23 | { | 52 | png_struct *png_ptr; |
24 | int irq; | 53 | png_info *info_ptr; |
25 | 54 | g_autoptr(pixman_image_t) linebuf = | |
26 | - /* We can shortcut if the highest priority pending interrupt | 55 | - qemu_pixman_linebuf_create(PIXMAN_a8r8g8b8, width); |
27 | - * happens to be external or if there is nothing pending. | 56 | + qemu_pixman_linebuf_create(PIXMAN_BE_r8g8b8, width); |
28 | + /* | 57 | uint8_t *buf = (uint8_t *)pixman_image_get_data(linebuf); |
29 | + * We can shortcut if the highest priority pending interrupt | 58 | FILE *f = fdopen(fd, "wb"); |
30 | + * happens to be external; if not we need to check the whole | 59 | int y; |
31 | + * vectors[] array. | 60 | @@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp) |
32 | */ | 61 | png_init_io(png_ptr, f); |
33 | if (s->vectpending > NVIC_FIRST_IRQ) { | 62 | |
34 | return true; | 63 | png_set_IHDR(png_ptr, info_ptr, width, height, 8, |
35 | } | 64 | - PNG_COLOR_TYPE_RGB_ALPHA, PNG_INTERLACE_NONE, |
36 | - if (s->vectpending == 0) { | 65 | + PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE, |
37 | - return false; | 66 | PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE); |
38 | - } | 67 | |
39 | 68 | png_write_info(png_ptr, info_ptr); | |
40 | for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) { | ||
41 | if (s->vectors[irq].pending) { | ||
42 | -- | 69 | -- |
43 | 2.20.1 | 70 | 2.34.1 |
44 | 71 | ||
45 | 72 | diff view generated by jsdifflib |
1 | For M-profile, we weren't reporting alignment faults triggered by the | 1 | In the doc sources, we have a few cross-reference targets with odd |
---|---|---|---|
2 | generic TCG code correctly to the guest. These get passed into | 2 | names "pcsys_005fxyz". These are the legacy of the semi-automated |
3 | arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile | 3 | conversion of the old info docs to rST (the '005f' is because ASCII |
4 | style exception.fsr value of 1. We didn't check for this, and so | 4 | 0x5f is '_' and the old info link names had underscores in them). |
5 | they fell through into the default of "assume this is an MPU fault" | ||
6 | and were reported to the guest as a data access violation MPU fault. | ||
7 | 5 | ||
8 | Report these alignment faults as UsageFaults which set the UNALIGNED | 6 | Remove the targets which nothing links to, and rename the two targets |
9 | bit in the UFSR. | 7 | which are used to something a bit more descriptive. |
10 | 8 | ||
11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
12 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 10 | Message-id: 20230421163642.1151904-1-peter.maydell@linaro.org |
13 | Message-id: 20210723162146.5167-4-peter.maydell@linaro.org | 11 | Reviewed-by: Markus Armbruster <armbru@redhat.com> |
14 | --- | 12 | --- |
15 | target/arm/m_helper.c | 8 ++++++++ | 13 | docs/system/devices/igb.rst | 2 +- |
16 | 1 file changed, 8 insertions(+) | 14 | docs/system/devices/ivshmem.rst | 2 -- |
15 | docs/system/devices/net.rst | 2 +- | ||
16 | docs/system/devices/usb.rst | 2 -- | ||
17 | docs/system/keys.rst | 2 +- | ||
18 | docs/system/linuxboot.rst | 2 +- | ||
19 | docs/system/target-i386.rst | 4 ---- | ||
20 | 7 files changed, 4 insertions(+), 12 deletions(-) | ||
17 | 21 | ||
18 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c | 22 | diff --git a/docs/system/devices/igb.rst b/docs/system/devices/igb.rst |
19 | index XXXXXXX..XXXXXXX 100644 | 23 | index XXXXXXX..XXXXXXX 100644 |
20 | --- a/target/arm/m_helper.c | 24 | --- a/docs/system/devices/igb.rst |
21 | +++ b/target/arm/m_helper.c | 25 | +++ b/docs/system/devices/igb.rst |
22 | @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) | 26 | @@ -XXX,XX +XXX,XX @@ Using igb |
23 | env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK; | 27 | ========= |
24 | break; | 28 | |
25 | case EXCP_UNALIGNED: | 29 | Using igb should be nothing different from using another network device. See |
26 | + /* Unaligned faults reported by M-profile aware code */ | 30 | -:ref:`pcsys_005fnetwork` in general. |
27 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure); | 31 | +:ref:`Network_emulation` in general. |
28 | env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK; | 32 | |
29 | break; | 33 | However, you may also need to perform additional steps to activate SR-IOV |
30 | @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) | 34 | feature on your guest. For Linux, refer to [4]_. |
31 | } | 35 | diff --git a/docs/system/devices/ivshmem.rst b/docs/system/devices/ivshmem.rst |
32 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false); | 36 | index XXXXXXX..XXXXXXX 100644 |
33 | break; | 37 | --- a/docs/system/devices/ivshmem.rst |
34 | + case 0x1: /* Alignment fault reported by generic code */ | 38 | +++ b/docs/system/devices/ivshmem.rst |
35 | + qemu_log_mask(CPU_LOG_INT, | 39 | @@ -XXX,XX +XXX,XX @@ |
36 | + "...really UsageFault with UFSR.UNALIGNED\n"); | 40 | -.. _pcsys_005fivshmem: |
37 | + env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK; | 41 | - |
38 | + armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, | 42 | Inter-VM Shared Memory device |
39 | + env->v7m.secure); | 43 | ----------------------------- |
40 | + break; | 44 | |
41 | default: | 45 | diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst |
42 | /* | 46 | index XXXXXXX..XXXXXXX 100644 |
43 | * All other FSR values are either MPU faults or "can't happen | 47 | --- a/docs/system/devices/net.rst |
48 | +++ b/docs/system/devices/net.rst | ||
49 | @@ -XXX,XX +XXX,XX @@ | ||
50 | -.. _pcsys_005fnetwork: | ||
51 | +.. _Network_Emulation: | ||
52 | |||
53 | Network emulation | ||
54 | ----------------- | ||
55 | diff --git a/docs/system/devices/usb.rst b/docs/system/devices/usb.rst | ||
56 | index XXXXXXX..XXXXXXX 100644 | ||
57 | --- a/docs/system/devices/usb.rst | ||
58 | +++ b/docs/system/devices/usb.rst | ||
59 | @@ -XXX,XX +XXX,XX @@ | ||
60 | -.. _pcsys_005fusb: | ||
61 | - | ||
62 | USB emulation | ||
63 | ------------- | ||
64 | |||
65 | diff --git a/docs/system/keys.rst b/docs/system/keys.rst | ||
66 | index XXXXXXX..XXXXXXX 100644 | ||
67 | --- a/docs/system/keys.rst | ||
68 | +++ b/docs/system/keys.rst | ||
69 | @@ -XXX,XX +XXX,XX @@ | ||
70 | -.. _pcsys_005fkeys: | ||
71 | +.. _GUI_keys: | ||
72 | |||
73 | Keys in the graphical frontends | ||
74 | ------------------------------- | ||
75 | diff --git a/docs/system/linuxboot.rst b/docs/system/linuxboot.rst | ||
76 | index XXXXXXX..XXXXXXX 100644 | ||
77 | --- a/docs/system/linuxboot.rst | ||
78 | +++ b/docs/system/linuxboot.rst | ||
79 | @@ -XXX,XX +XXX,XX @@ virtual serial port and the QEMU monitor to the console with the | ||
80 | -append "root=/dev/hda console=ttyS0" -nographic | ||
81 | |||
82 | Use Ctrl-a c to switch between the serial console and the monitor (see | ||
83 | -:ref:`pcsys_005fkeys`). | ||
84 | +:ref:`GUI_keys`). | ||
85 | diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst | ||
86 | index XXXXXXX..XXXXXXX 100644 | ||
87 | --- a/docs/system/target-i386.rst | ||
88 | +++ b/docs/system/target-i386.rst | ||
89 | @@ -XXX,XX +XXX,XX @@ | ||
90 | x86 System emulator | ||
91 | ------------------- | ||
92 | |||
93 | -.. _pcsys_005fdevices: | ||
94 | - | ||
95 | Board-specific documentation | ||
96 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
97 | |||
98 | @@ -XXX,XX +XXX,XX @@ Architectural features | ||
99 | i386/sgx | ||
100 | i386/amd-memory-encryption | ||
101 | |||
102 | -.. _pcsys_005freq: | ||
103 | - | ||
104 | OS requirements | ||
105 | ~~~~~~~~~~~~~~~ | ||
106 | |||
44 | -- | 107 | -- |
45 | 2.20.1 | 108 | 2.34.1 |
46 | |||
47 | diff view generated by jsdifflib |
1 | In do_v7m_exception_exit(), we perform various checks as part of | 1 | Coverity points out (in CID 1508390) that write_bootloader has |
---|---|---|---|
2 | performing the exception return. If one of these checks fails, the | 2 | some dead code, where we assign to 'p' and then in the following |
3 | architecture requires that we take an appropriate exception on the | 3 | line assign to it again. This happened as a result of the |
4 | existing stackframe. We implement this by calling | 4 | refactoring in commit cd5066f8618b. |
5 | v7m_exception_taken() to set up to take the new exception, and then | ||
6 | immediately returning from do_v7m_exception_exit() without proceeding | ||
7 | any further with the unstack-and-exception-return process. | ||
8 | 5 | ||
9 | In a couple of checks that are new in v8.1M, we forgot the "return" | 6 | Fix the dead code by removing the 'void *v' variable entirely and |
10 | statement, with the effect that if bad code in the guest tripped over | 7 | instead adding a cast when calling bl_setup_gt64120_jump_kernel(), as |
11 | these checks we would set up to take a UsageFault exception but then | 8 | we do at its other callsite in write_bootloader_nanomips(). |
12 | blunder on trying to also unstack and return from the original | ||
13 | exception, with the probable result that the guest would crash. | ||
14 | |||
15 | Add the missing return statements. | ||
16 | 9 | ||
17 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 10 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
18 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 11 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> |
19 | Message-id: 20210723162146.5167-3-peter.maydell@linaro.org | ||
20 | --- | 12 | --- |
21 | target/arm/m_helper.c | 2 ++ | 13 | hw/mips/malta.c | 5 +---- |
22 | 1 file changed, 2 insertions(+) | 14 | 1 file changed, 1 insertion(+), 4 deletions(-) |
23 | 15 | ||
24 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c | 16 | diff --git a/hw/mips/malta.c b/hw/mips/malta.c |
25 | index XXXXXXX..XXXXXXX 100644 | 17 | index XXXXXXX..XXXXXXX 100644 |
26 | --- a/target/arm/m_helper.c | 18 | --- a/hw/mips/malta.c |
27 | +++ b/target/arm/m_helper.c | 19 | +++ b/hw/mips/malta.c |
28 | @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) | 20 | @@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr, |
29 | qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " | 21 | uint64_t kernel_entry) |
30 | "stackframe: NSACR prevents clearing FPU registers\n"); | 22 | { |
31 | v7m_exception_taken(cpu, excret, true, false); | 23 | uint32_t *p; |
32 | + return; | 24 | - void *v; |
33 | } else if (!cpacr_pass) { | 25 | |
34 | armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, | 26 | /* Small bootloader */ |
35 | exc_secure); | 27 | p = (uint32_t *)base; |
36 | @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) | 28 | @@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr, |
37 | qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " | 29 | * |
38 | "stackframe: CPACR prevents clearing FPU registers\n"); | 30 | */ |
39 | v7m_exception_taken(cpu, excret, true, false); | 31 | |
40 | + return; | 32 | - v = p; |
41 | } | 33 | - bl_setup_gt64120_jump_kernel(&v, run_addr, kernel_entry); |
42 | } | 34 | - p = v; |
43 | /* Clear s0..s15, FPSCR and VPR */ | 35 | + bl_setup_gt64120_jump_kernel((void **)&p, run_addr, kernel_entry); |
36 | |||
37 | /* YAMON subroutines */ | ||
38 | p = (uint32_t *) (base + 0x800); | ||
44 | -- | 39 | -- |
45 | 2.20.1 | 40 | 2.34.1 |
46 | 41 | ||
47 | 42 | diff view generated by jsdifflib |
1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> | 1 | From: Fabiano Rosas <farosas@suse.de> |
---|---|---|---|
2 | 2 | ||
3 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | 3 | Semihosting has been made a 'default y' entry in Kconfig, which does |
4 | not work because when building --without-default-devices, the | ||
5 | semihosting code would not be available. | ||
6 | |||
7 | Make semihosting unconditional when TCG is present. | ||
8 | |||
9 | Fixes: 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a KVM-only build") | ||
10 | Signed-off-by: Fabiano Rosas <farosas@suse.de> | ||
4 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 11 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
5 | Message-id: 20210726150953.1218690-1-f4bug@amsat.org | 12 | Message-id: 20230508181611.2621-2-farosas@suse.de |
6 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
7 | --- | 14 | --- |
8 | hw/arm/nseries.c | 2 +- | 15 | target/arm/Kconfig | 8 +------- |
9 | 1 file changed, 1 insertion(+), 1 deletion(-) | 16 | 1 file changed, 1 insertion(+), 7 deletions(-) |
10 | 17 | ||
11 | diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c | 18 | diff --git a/target/arm/Kconfig b/target/arm/Kconfig |
12 | index XXXXXXX..XXXXXXX 100644 | 19 | index XXXXXXX..XXXXXXX 100644 |
13 | --- a/hw/arm/nseries.c | 20 | --- a/target/arm/Kconfig |
14 | +++ b/hw/arm/nseries.c | 21 | +++ b/target/arm/Kconfig |
15 | @@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len) | 22 | @@ -XXX,XX +XXX,XX @@ |
16 | default: | 23 | config ARM |
17 | bad_cmd: | 24 | bool |
18 | qemu_log_mask(LOG_GUEST_ERROR, | 25 | + select ARM_COMPATIBLE_SEMIHOSTING if TCG |
19 | - "%s: unknown command %02x\n", __func__, s->cmd); | 26 | |
20 | + "%s: unknown command 0x%02x\n", __func__, s->cmd); | 27 | config AARCH64 |
21 | break; | 28 | bool |
22 | } | 29 | select ARM |
23 | 30 | - | |
31 | -# This config exists just so we can make SEMIHOSTING default when TCG | ||
32 | -# is selected without also changing it for other architectures. | ||
33 | -config ARM_SEMIHOSTING | ||
34 | - bool | ||
35 | - default y if TCG && ARM | ||
36 | - select ARM_COMPATIBLE_SEMIHOSTING | ||
24 | -- | 37 | -- |
25 | 2.20.1 | 38 | 2.34.1 |
26 | |||
27 | diff view generated by jsdifflib |
1 | From: Joe Komlodi <joe.komlodi@xilinx.com> | 1 | From: Fabiano Rosas <farosas@suse.de> |
---|---|---|---|
2 | 2 | ||
3 | The bit to see if a CD is valid is the last bit of the first word of the CD. | 3 | We cannot allow this config to be disabled at the moment as not all of |
4 | the relevant code is protected by it. | ||
4 | 5 | ||
5 | Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com> | 6 | Commit 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a |
6 | Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com | 7 | KVM-only build") moved the CONFIGs of several boards to Kconfig, so it |
7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 8 | is now possible that nothing selects ARM_V7M (e.g. when doing a |
9 | --without-default-devices build). | ||
10 | |||
11 | Return the CONFIG_ARM_V7M entry to a state where it is always selected | ||
12 | whenever TCG is available. | ||
13 | |||
14 | Fixes: 29d9efca16 ("arm/Kconfig: Do not build TCG-only boards on a KVM-only build") | ||
15 | Signed-off-by: Fabiano Rosas <farosas@suse.de> | ||
16 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
17 | Message-id: 20230508181611.2621-3-farosas@suse.de | ||
8 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 18 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
9 | --- | 19 | --- |
10 | hw/arm/smmuv3-internal.h | 2 +- | 20 | target/arm/Kconfig | 1 + |
11 | 1 file changed, 1 insertion(+), 1 deletion(-) | 21 | 1 file changed, 1 insertion(+) |
12 | 22 | ||
13 | diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h | 23 | diff --git a/target/arm/Kconfig b/target/arm/Kconfig |
14 | index XXXXXXX..XXXXXXX 100644 | 24 | index XXXXXXX..XXXXXXX 100644 |
15 | --- a/hw/arm/smmuv3-internal.h | 25 | --- a/target/arm/Kconfig |
16 | +++ b/hw/arm/smmuv3-internal.h | 26 | +++ b/target/arm/Kconfig |
17 | @@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste) | 27 | @@ -XXX,XX +XXX,XX @@ |
18 | 28 | config ARM | |
19 | /* CD fields */ | 29 | bool |
20 | 30 | select ARM_COMPATIBLE_SEMIHOSTING if TCG | |
21 | -#define CD_VALID(x) extract32((x)->word[0], 30, 1) | 31 | + select ARM_V7M if TCG |
22 | +#define CD_VALID(x) extract32((x)->word[0], 31, 1) | 32 | |
23 | #define CD_ASID(x) extract32((x)->word[1], 16, 16) | 33 | config AARCH64 |
24 | #define CD_TTB(x, sel) \ | 34 | bool |
25 | ({ \ | ||
26 | -- | 35 | -- |
27 | 2.20.1 | 36 | 2.34.1 |
28 | |||
29 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | The documentation of the -machine memory-backend has some minor | ||
2 | formatting errors: | ||
3 | * Misindentation of the initial line meant that the whole option | ||
4 | section is incorrectly indented in the HTML output compared to | ||
5 | the other -machine options | ||
6 | * The examples weren't indented, which meant that they were formatted | ||
7 | as plain run-on text including outputting the "::" as text. | ||
8 | * The a) b) list has no rst-format markup so it is rendered as | ||
9 | a single run-on paragraph | ||
10 | 1 | ||
11 | Fix the formatting. | ||
12 | |||
13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
14 | Reviewed-by: Igor Mammedov <imammedo@redhat.com> | ||
15 | Message-id: 20210719105257.3599-1-peter.maydell@linaro.org | ||
16 | --- | ||
17 | qemu-options.hx | 30 +++++++++++++++++------------- | ||
18 | 1 file changed, 17 insertions(+), 13 deletions(-) | ||
19 | |||
20 | diff --git a/qemu-options.hx b/qemu-options.hx | ||
21 | index XXXXXXX..XXXXXXX 100644 | ||
22 | --- a/qemu-options.hx | ||
23 | +++ b/qemu-options.hx | ||
24 | @@ -XXX,XX +XXX,XX @@ SRST | ||
25 | Enables or disables ACPI Heterogeneous Memory Attribute Table | ||
26 | (HMAT) support. The default is off. | ||
27 | |||
28 | - ``memory-backend='id'`` | ||
29 | + ``memory-backend='id'`` | ||
30 | An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options. | ||
31 | Allows to use a memory backend as main RAM. | ||
32 | |||
33 | For example: | ||
34 | :: | ||
35 | - -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on | ||
36 | - -machine memory-backend=pc.ram | ||
37 | - -m 512M | ||
38 | + | ||
39 | + -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on | ||
40 | + -machine memory-backend=pc.ram | ||
41 | + -m 512M | ||
42 | |||
43 | Migration compatibility note: | ||
44 | - a) as backend id one shall use value of 'default-ram-id', advertised by | ||
45 | - machine type (available via ``query-machines`` QMP command), if migration | ||
46 | - to/from old QEMU (<5.0) is expected. | ||
47 | - b) for machine types 4.0 and older, user shall | ||
48 | - use ``x-use-canonical-path-for-ramblock-id=off`` backend option | ||
49 | - if migration to/from old QEMU (<5.0) is expected. | ||
50 | + | ||
51 | + * as backend id one shall use value of 'default-ram-id', advertised by | ||
52 | + machine type (available via ``query-machines`` QMP command), if migration | ||
53 | + to/from old QEMU (<5.0) is expected. | ||
54 | + * for machine types 4.0 and older, user shall | ||
55 | + use ``x-use-canonical-path-for-ramblock-id=off`` backend option | ||
56 | + if migration to/from old QEMU (<5.0) is expected. | ||
57 | + | ||
58 | For example: | ||
59 | :: | ||
60 | - -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off | ||
61 | - -machine memory-backend=pc.ram | ||
62 | - -m 512M | ||
63 | + | ||
64 | + -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off | ||
65 | + -machine memory-backend=pc.ram | ||
66 | + -m 512M | ||
67 | ERST | ||
68 | |||
69 | HXCOMM Deprecated by -machine | ||
70 | -- | ||
71 | 2.20.1 | ||
72 | |||
73 | diff view generated by jsdifflib |
Deleted patch | |||
---|---|---|---|
1 | For M-profile, unlike A-profile, the low 2 bits of SP are defined to be | ||
2 | RES0H, which is to say that they must be hardwired to zero so that | ||
3 | guest attempts to write non-zero values to them are ignored. | ||
4 | 1 | ||
5 | Implement this behaviour by masking out the low bits: | ||
6 | * for writes to r13 by the gdbstub | ||
7 | * for writes to any of the various flavours of SP via MSR | ||
8 | * for writes to r13 via store_reg() in generated code | ||
9 | |||
10 | Note that all the direct uses of cpu_R[] in translate.c are in places | ||
11 | where the register is definitely not r13 (usually because that has | ||
12 | been checked for as an UNDEFINED or UNPREDICTABLE case and handled as | ||
13 | UNDEF). | ||
14 | |||
15 | All the other writes to regs[13] in C code are either: | ||
16 | * A-profile only code | ||
17 | * writes of values we can guarantee to be aligned, such as | ||
18 | - writes of previous-SP-value plus or minus a 4-aligned constant | ||
19 | - writes of the value in an SP limit register (which we already | ||
20 | enforce to be aligned) | ||
21 | |||
22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
23 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
24 | Message-id: 20210723162146.5167-2-peter.maydell@linaro.org | ||
25 | --- | ||
26 | target/arm/gdbstub.c | 4 ++++ | ||
27 | target/arm/m_helper.c | 14 ++++++++------ | ||
28 | target/arm/translate.c | 3 +++ | ||
29 | 3 files changed, 15 insertions(+), 6 deletions(-) | ||
30 | |||
31 | diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c | ||
32 | index XXXXXXX..XXXXXXX 100644 | ||
33 | --- a/target/arm/gdbstub.c | ||
34 | +++ b/target/arm/gdbstub.c | ||
35 | @@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n) | ||
36 | |||
37 | if (n < 16) { | ||
38 | /* Core integer register. */ | ||
39 | + if (n == 13 && arm_feature(env, ARM_FEATURE_M)) { | ||
40 | + /* M profile SP low bits are always 0 */ | ||
41 | + tmp &= ~3; | ||
42 | + } | ||
43 | env->regs[n] = tmp; | ||
44 | return 4; | ||
45 | } | ||
46 | diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c | ||
47 | index XXXXXXX..XXXXXXX 100644 | ||
48 | --- a/target/arm/m_helper.c | ||
49 | +++ b/target/arm/m_helper.c | ||
50 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
51 | if (!env->v7m.secure) { | ||
52 | return; | ||
53 | } | ||
54 | - env->v7m.other_ss_msp = val; | ||
55 | + env->v7m.other_ss_msp = val & ~3; | ||
56 | return; | ||
57 | case 0x89: /* PSP_NS */ | ||
58 | if (!env->v7m.secure) { | ||
59 | return; | ||
60 | } | ||
61 | - env->v7m.other_ss_psp = val; | ||
62 | + env->v7m.other_ss_psp = val & ~3; | ||
63 | return; | ||
64 | case 0x8a: /* MSPLIM_NS */ | ||
65 | if (!env->v7m.secure) { | ||
66 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
67 | |||
68 | limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false]; | ||
69 | |||
70 | + val &= ~0x3; | ||
71 | + | ||
72 | if (val < limit) { | ||
73 | raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC()); | ||
74 | } | ||
75 | @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) | ||
76 | break; | ||
77 | case 8: /* MSP */ | ||
78 | if (v7m_using_psp(env)) { | ||
79 | - env->v7m.other_sp = val; | ||
80 | + env->v7m.other_sp = val & ~3; | ||
81 | } else { | ||
82 | - env->regs[13] = val; | ||
83 | + env->regs[13] = val & ~3; | ||
84 | } | ||
85 | break; | ||
86 | case 9: /* PSP */ | ||
87 | if (v7m_using_psp(env)) { | ||
88 | - env->regs[13] = val; | ||
89 | + env->regs[13] = val & ~3; | ||
90 | } else { | ||
91 | - env->v7m.other_sp = val; | ||
92 | + env->v7m.other_sp = val & ~3; | ||
93 | } | ||
94 | break; | ||
95 | case 10: /* MSPLIM */ | ||
96 | diff --git a/target/arm/translate.c b/target/arm/translate.c | ||
97 | index XXXXXXX..XXXXXXX 100644 | ||
98 | --- a/target/arm/translate.c | ||
99 | +++ b/target/arm/translate.c | ||
100 | @@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var) | ||
101 | */ | ||
102 | tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3); | ||
103 | s->base.is_jmp = DISAS_JUMP; | ||
104 | + } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) { | ||
105 | + /* For M-profile SP bits [1:0] are always zero */ | ||
106 | + tcg_gen_andi_i32(var, var, ~3); | ||
107 | } | ||
108 | tcg_gen_mov_i32(cpu_R[reg], var); | ||
109 | tcg_temp_free_i32(var); | ||
110 | -- | ||
111 | 2.20.1 | ||
112 | |||
113 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Fabiano Rosas <farosas@suse.de> |
---|---|---|---|
2 | 2 | ||
3 | Mirror the behavour of /proc/sys/abi/sve_default_vector_length | 3 | On a build configured with: --disable-tcg --enable-xen it is possible |
4 | under the real linux kernel. We have no way of passing along | 4 | to produce a QEMU binary with no TCG nor KVM support. Skip the cdrom |
5 | a real default across exec like the kernel can, but this is a | 5 | boot tests if that's the case. |
6 | decent way of adjusting the startup vector length of a process. | ||
7 | 6 | ||
8 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482 | 7 | Fixes: 0c1ae3ff9d ("tests/qtest: Fix tests when no KVM or TCG are present") |
9 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 8 | Signed-off-by: Fabiano Rosas <farosas@suse.de> |
10 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Reviewed-by: Thomas Huth <thuth@redhat.com> |
11 | Message-id: 20210723203344.968563-4-richard.henderson@linaro.org | 10 | Message-id: 20230508181611.2621-4-farosas@suse.de |
12 | [PMM: tweaked docs formatting, document -1 special-case, | ||
13 | added fixup patch from RTH mentioning QEMU's maximum veclen.] | ||
14 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 11 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
15 | --- | 12 | --- |
16 | docs/system/arm/cpu-features.rst | 15 ++++++++ | 13 | tests/qtest/cdrom-test.c | 10 ++++++++++ |
17 | target/arm/cpu.h | 5 +++ | 14 | 1 file changed, 10 insertions(+) |
18 | target/arm/cpu.c | 14 ++++++-- | ||
19 | target/arm/cpu64.c | 60 ++++++++++++++++++++++++++++++++ | ||
20 | 4 files changed, 92 insertions(+), 2 deletions(-) | ||
21 | 15 | ||
22 | diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst | 16 | diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c |
23 | index XXXXXXX..XXXXXXX 100644 | 17 | index XXXXXXX..XXXXXXX 100644 |
24 | --- a/docs/system/arm/cpu-features.rst | 18 | --- a/tests/qtest/cdrom-test.c |
25 | +++ b/docs/system/arm/cpu-features.rst | 19 | +++ b/tests/qtest/cdrom-test.c |
26 | @@ -XXX,XX +XXX,XX @@ verbose command lines. However, the recommended way to select vector | 20 | @@ -XXX,XX +XXX,XX @@ static void test_cdboot(gconstpointer data) |
27 | lengths is to explicitly enable each desired length. Therefore only | 21 | |
28 | example's (1), (4), and (6) exhibit recommended uses of the properties. | 22 | static void add_x86_tests(void) |
29 | 23 | { | |
30 | +SVE User-mode Default Vector Length Property | 24 | + if (!qtest_has_accel("tcg") && !qtest_has_accel("kvm")) { |
31 | +-------------------------------------------- | 25 | + g_test_skip("No KVM or TCG accelerator available, skipping boot tests"); |
32 | + | ||
33 | +For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is | ||
34 | +defined to mirror the Linux kernel parameter file | ||
35 | +``/proc/sys/abi/sve_default_vector_length``. The default length, ``N``, | ||
36 | +is in units of bytes and must be between 16 and 8192. | ||
37 | +If not specified, the default vector length is 64. | ||
38 | + | ||
39 | +If the default length is larger than the maximum vector length enabled, | ||
40 | +the actual vector length will be reduced. Note that the maximum vector | ||
41 | +length supported by QEMU is 256. | ||
42 | + | ||
43 | +If this property is set to ``-1`` then the default vector length | ||
44 | +is set to the maximum possible length. | ||
45 | diff --git a/target/arm/cpu.h b/target/arm/cpu.h | ||
46 | index XXXXXXX..XXXXXXX 100644 | ||
47 | --- a/target/arm/cpu.h | ||
48 | +++ b/target/arm/cpu.h | ||
49 | @@ -XXX,XX +XXX,XX @@ struct ARMCPU { | ||
50 | /* Used to set the maximum vector length the cpu will support. */ | ||
51 | uint32_t sve_max_vq; | ||
52 | |||
53 | +#ifdef CONFIG_USER_ONLY | ||
54 | + /* Used to set the default vector length at process start. */ | ||
55 | + uint32_t sve_default_vq; | ||
56 | +#endif | ||
57 | + | ||
58 | /* | ||
59 | * In sve_vq_map each set bit is a supported vector length of | ||
60 | * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector | ||
61 | diff --git a/target/arm/cpu.c b/target/arm/cpu.c | ||
62 | index XXXXXXX..XXXXXXX 100644 | ||
63 | --- a/target/arm/cpu.c | ||
64 | +++ b/target/arm/cpu.c | ||
65 | @@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev) | ||
66 | env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3); | ||
67 | /* with reasonable vector length */ | ||
68 | if (cpu_isar_feature(aa64_sve, cpu)) { | ||
69 | - env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3); | ||
70 | + env->vfp.zcr_el[1] = | ||
71 | + aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1); | ||
72 | } | ||
73 | /* | ||
74 | * Enable TBI0 but not TBI1. | ||
75 | @@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj) | ||
76 | QLIST_INIT(&cpu->pre_el_change_hooks); | ||
77 | QLIST_INIT(&cpu->el_change_hooks); | ||
78 | |||
79 | -#ifndef CONFIG_USER_ONLY | ||
80 | +#ifdef CONFIG_USER_ONLY | ||
81 | +# ifdef TARGET_AARCH64 | ||
82 | + /* | ||
83 | + * The linux kernel defaults to 512-bit vectors, when sve is supported. | ||
84 | + * See documentation for /proc/sys/abi/sve_default_vector_length, and | ||
85 | + * our corresponding sve-default-vector-length cpu property. | ||
86 | + */ | ||
87 | + cpu->sve_default_vq = 4; | ||
88 | +# endif | ||
89 | +#else | ||
90 | /* Our inbound IRQ and FIQ lines */ | ||
91 | if (kvm_enabled()) { | ||
92 | /* VIRQ and VFIQ are unused with KVM but we add them to maintain | ||
93 | diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c | ||
94 | index XXXXXXX..XXXXXXX 100644 | ||
95 | --- a/target/arm/cpu64.c | ||
96 | +++ b/target/arm/cpu64.c | ||
97 | @@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp) | ||
98 | cpu->isar.id_aa64pfr0 = t; | ||
99 | } | ||
100 | |||
101 | +#ifdef CONFIG_USER_ONLY | ||
102 | +/* Mirror linux /proc/sys/abi/sve_default_vector_length. */ | ||
103 | +static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v, | ||
104 | + const char *name, void *opaque, | ||
105 | + Error **errp) | ||
106 | +{ | ||
107 | + ARMCPU *cpu = ARM_CPU(obj); | ||
108 | + int32_t default_len, default_vq, remainder; | ||
109 | + | ||
110 | + if (!visit_type_int32(v, name, &default_len, errp)) { | ||
111 | + return; | 26 | + return; |
112 | + } | 27 | + } |
113 | + | 28 | + |
114 | + /* Undocumented, but the kernel allows -1 to indicate "maximum". */ | 29 | qtest_add_data_func("cdrom/boot/default", "-cdrom ", test_cdboot); |
115 | + if (default_len == -1) { | 30 | qtest_add_data_func("cdrom/boot/virtio-scsi", |
116 | + cpu->sve_default_vq = ARM_MAX_VQ; | 31 | "-device virtio-scsi -device scsi-cd,drive=cdr " |
32 | @@ -XXX,XX +XXX,XX @@ static void add_x86_tests(void) | ||
33 | |||
34 | static void add_s390x_tests(void) | ||
35 | { | ||
36 | + if (!qtest_has_accel("tcg") && !qtest_has_accel("kvm")) { | ||
37 | + g_test_skip("No KVM or TCG accelerator available, skipping boot tests"); | ||
117 | + return; | 38 | + return; |
118 | + } | 39 | + } |
119 | + | 40 | + |
120 | + default_vq = default_len / 16; | 41 | qtest_add_data_func("cdrom/boot/default", "-cdrom ", test_cdboot); |
121 | + remainder = default_len % 16; | 42 | qtest_add_data_func("cdrom/boot/virtio-scsi", |
122 | + | 43 | "-device virtio-scsi -device scsi-cd,drive=cdr " |
123 | + /* | ||
124 | + * Note that the 512 max comes from include/uapi/asm/sve_context.h | ||
125 | + * and is the maximum architectural width of ZCR_ELx.LEN. | ||
126 | + */ | ||
127 | + if (remainder || default_vq < 1 || default_vq > 512) { | ||
128 | + error_setg(errp, "cannot set sve-default-vector-length"); | ||
129 | + if (remainder) { | ||
130 | + error_append_hint(errp, "Vector length not a multiple of 16\n"); | ||
131 | + } else if (default_vq < 1) { | ||
132 | + error_append_hint(errp, "Vector length smaller than 16\n"); | ||
133 | + } else { | ||
134 | + error_append_hint(errp, "Vector length larger than %d\n", | ||
135 | + 512 * 16); | ||
136 | + } | ||
137 | + return; | ||
138 | + } | ||
139 | + | ||
140 | + cpu->sve_default_vq = default_vq; | ||
141 | +} | ||
142 | + | ||
143 | +static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v, | ||
144 | + const char *name, void *opaque, | ||
145 | + Error **errp) | ||
146 | +{ | ||
147 | + ARMCPU *cpu = ARM_CPU(obj); | ||
148 | + int32_t value = cpu->sve_default_vq * 16; | ||
149 | + | ||
150 | + visit_type_int32(v, name, &value, errp); | ||
151 | +} | ||
152 | +#endif | ||
153 | + | ||
154 | void aarch64_add_sve_properties(Object *obj) | ||
155 | { | ||
156 | uint32_t vq; | ||
157 | @@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj) | ||
158 | object_property_add(obj, name, "bool", cpu_arm_get_sve_vq, | ||
159 | cpu_arm_set_sve_vq, NULL, NULL); | ||
160 | } | ||
161 | + | ||
162 | +#ifdef CONFIG_USER_ONLY | ||
163 | + /* Mirror linux /proc/sys/abi/sve_default_vector_length. */ | ||
164 | + object_property_add(obj, "sve-default-vector-length", "int32", | ||
165 | + cpu_arm_get_sve_default_vec_len, | ||
166 | + cpu_arm_set_sve_default_vec_len, NULL, NULL); | ||
167 | +#endif | ||
168 | } | ||
169 | |||
170 | void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) | ||
171 | -- | 44 | -- |
172 | 2.20.1 | 45 | 2.34.1 |
173 | |||
174 | diff view generated by jsdifflib |
1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | In check_s2_mmu_setup() we have a check that is attempting to |
---|---|---|---|
2 | implement the part of AArch64.S2MinTxSZ that is specific to when EL1 | ||
3 | is AArch32: | ||
2 | 4 | ||
3 | Rename from sve_zcr_get_valid_len and make accessible | 5 | if !s1aarch64 then |
4 | from outside of helper.c. | 6 | // EL1 is AArch32 |
7 | min_txsz = Min(min_txsz, 24); | ||
5 | 8 | ||
6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 9 | Unfortunately we got this wrong in two ways: |
7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 10 | |
8 | Message-id: 20210723203344.968563-3-richard.henderson@linaro.org | 11 | (1) The minimum txsz corresponds to a maximum inputsize, but we got |
12 | the sense of the comparison wrong and were faulting for all | ||
13 | inputsizes less than 40 bits | ||
14 | |||
15 | (2) We try to implement this as an extra check that happens after | ||
16 | we've done the same txsz checks we would do for an AArch64 EL1, but | ||
17 | in fact the pseudocode is *loosening* the requirements, so that txsz | ||
18 | values that would fault for an AArch64 EL1 do not fault for AArch32 | ||
19 | EL1, because it does Min(old_min, 24), not Max(old_min, 24). | ||
20 | |||
21 | You can see this also in the text of the Arm ARM in table D8-8, which | ||
22 | shows that where the implemented PA size is less than 40 bits an | ||
23 | AArch32 EL1 is still OK with a configured stage2 T0SZ for a 40 bit | ||
24 | IPA, whereas if EL1 is AArch64 then the T0SZ must be big enough to | ||
25 | constrain the IPA to the implemented PA size. | ||
26 | |||
27 | Because of part (2), we can't do this as a separate check, but | ||
28 | have to integrate it into aa64_va_parameters(). Add a new argument | ||
29 | to that function to indicate that EL1 is 32-bit. All the existing | ||
30 | callsites except the one in get_phys_addr_lpae() can pass 'false', | ||
31 | because they are either doing a lookup for a stage 1 regime or | ||
32 | else they don't care about the tsz/tsz_oob fields. | ||
33 | |||
34 | Cc: qemu-stable@nongnu.org | ||
35 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1627 | ||
9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 36 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
37 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
38 | Message-id: 20230509092059.3176487-1-peter.maydell@linaro.org | ||
10 | --- | 39 | --- |
11 | target/arm/internals.h | 10 ++++++++++ | 40 | target/arm/internals.h | 12 +++++++++++- |
12 | target/arm/helper.c | 4 ++-- | 41 | target/arm/gdbstub64.c | 2 +- |
13 | 2 files changed, 12 insertions(+), 2 deletions(-) | 42 | target/arm/helper.c | 15 +++++++++++++-- |
43 | target/arm/ptw.c | 14 ++------------ | ||
44 | target/arm/tcg/pauth_helper.c | 6 +++--- | ||
45 | 5 files changed, 30 insertions(+), 19 deletions(-) | ||
14 | 46 | ||
15 | diff --git a/target/arm/internals.h b/target/arm/internals.h | 47 | diff --git a/target/arm/internals.h b/target/arm/internals.h |
16 | index XXXXXXX..XXXXXXX 100644 | 48 | index XXXXXXX..XXXXXXX 100644 |
17 | --- a/target/arm/internals.h | 49 | --- a/target/arm/internals.h |
18 | +++ b/target/arm/internals.h | 50 | +++ b/target/arm/internals.h |
19 | @@ -XXX,XX +XXX,XX @@ void arm_translate_init(void); | 51 | @@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters { |
20 | void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb); | 52 | ARMGranuleSize gran : 2; |
21 | #endif /* CONFIG_TCG */ | 53 | } ARMVAParameters; |
22 | 54 | ||
23 | +/** | 55 | +/** |
24 | + * aarch64_sve_zcr_get_valid_len: | 56 | + * aa64_va_parameters: Return parameters for an AArch64 virtual address |
25 | + * @cpu: cpu context | 57 | + * @env: CPU |
26 | + * @start_len: maximum len to consider | 58 | + * @va: virtual address to look up |
27 | + * | 59 | + * @mmu_idx: determines translation regime to use |
28 | + * Return the maximum supported sve vector length <= @start_len. | 60 | + * @data: true if this is a data access |
29 | + * Note that both @start_len and the return value are in units | 61 | + * @el1_is_aa32: true if we are asking about stage 2 when EL1 is AArch32 |
30 | + * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128. | 62 | + * (ignored if @mmu_idx is for a stage 1 regime; only affects tsz/tsz_oob) |
31 | + */ | 63 | + */ |
32 | +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len); | 64 | ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, |
33 | 65 | - ARMMMUIdx mmu_idx, bool data); | |
34 | enum arm_fprounding { | 66 | + ARMMMUIdx mmu_idx, bool data, |
35 | FPROUNDING_TIEEVEN, | 67 | + bool el1_is_aa32); |
68 | |||
69 | int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx); | ||
70 | int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx); | ||
71 | diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c | ||
72 | index XXXXXXX..XXXXXXX 100644 | ||
73 | --- a/target/arm/gdbstub64.c | ||
74 | +++ b/target/arm/gdbstub64.c | ||
75 | @@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg) | ||
76 | ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env); | ||
77 | ARMVAParameters param; | ||
78 | |||
79 | - param = aa64_va_parameters(env, -is_high, mmu_idx, is_data); | ||
80 | + param = aa64_va_parameters(env, -is_high, mmu_idx, is_data, false); | ||
81 | return gdb_get_reg64(buf, pauth_ptr_mask(param)); | ||
82 | } | ||
83 | default: | ||
36 | diff --git a/target/arm/helper.c b/target/arm/helper.c | 84 | diff --git a/target/arm/helper.c b/target/arm/helper.c |
37 | index XXXXXXX..XXXXXXX 100644 | 85 | index XXXXXXX..XXXXXXX 100644 |
38 | --- a/target/arm/helper.c | 86 | --- a/target/arm/helper.c |
39 | +++ b/target/arm/helper.c | 87 | +++ b/target/arm/helper.c |
40 | @@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el) | 88 | @@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx, |
41 | return 0; | 89 | unsigned int page_size_granule, page_shift, num, scale, exponent; |
90 | /* Extract one bit to represent the va selector in use. */ | ||
91 | uint64_t select = sextract64(value, 36, 1); | ||
92 | - ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true); | ||
93 | + ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true, false); | ||
94 | TLBIRange ret = { }; | ||
95 | ARMGranuleSize gran; | ||
96 | |||
97 | @@ -XXX,XX +XXX,XX @@ static ARMGranuleSize sanitize_gran_size(ARMCPU *cpu, ARMGranuleSize gran, | ||
42 | } | 98 | } |
43 | 99 | ||
44 | -static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) | 100 | ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, |
45 | +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len) | 101 | - ARMMMUIdx mmu_idx, bool data) |
102 | + ARMMMUIdx mmu_idx, bool data, | ||
103 | + bool el1_is_aa32) | ||
46 | { | 104 | { |
47 | uint32_t end_len; | 105 | uint64_t tcr = regime_tcr(env, mmu_idx); |
48 | 106 | bool epd, hpd, tsz_oob, ds, ha, hd; | |
49 | @@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el) | 107 | @@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va, |
50 | zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]); | 108 | } |
51 | } | 109 | } |
52 | 110 | ||
53 | - return sve_zcr_get_valid_len(cpu, zcr_len); | 111 | + if (stage2 && el1_is_aa32) { |
54 | + return aarch64_sve_zcr_get_valid_len(cpu, zcr_len); | 112 | + /* |
113 | + * For AArch32 EL1 the min txsz (and thus max IPA size) requirements | ||
114 | + * are loosened: a configured IPA of 40 bits is permitted even if | ||
115 | + * the implemented PA is less than that (and so a 40 bit IPA would | ||
116 | + * fault for an AArch64 EL1). See R_DTLMN. | ||
117 | + */ | ||
118 | + min_tsz = MIN(min_tsz, 24); | ||
119 | + } | ||
120 | + | ||
121 | if (tsz > max_tsz) { | ||
122 | tsz = max_tsz; | ||
123 | tsz_oob = true; | ||
124 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
125 | index XXXXXXX..XXXXXXX 100644 | ||
126 | --- a/target/arm/ptw.c | ||
127 | +++ b/target/arm/ptw.c | ||
128 | @@ -XXX,XX +XXX,XX @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr, | ||
129 | |||
130 | sl0 = extract32(tcr, 6, 2); | ||
131 | if (is_aa64) { | ||
132 | - /* | ||
133 | - * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of | ||
134 | - * get_phys_addr_lpae, that used aa64_va_parameters which apply | ||
135 | - * to aarch64. If Stage1 is aarch32, the min_txsz is larger. | ||
136 | - * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to | ||
137 | - * inputsize is 64 - 24 = 40. | ||
138 | - */ | ||
139 | - if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) { | ||
140 | - goto fail; | ||
141 | - } | ||
142 | - | ||
143 | /* | ||
144 | * AArch64.S2InvalidSL: Interpretation of SL depends on the page size, | ||
145 | * so interleave AArch64.S2StartLevel. | ||
146 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, | ||
147 | int ps; | ||
148 | |||
149 | param = aa64_va_parameters(env, address, mmu_idx, | ||
150 | - access_type != MMU_INST_FETCH); | ||
151 | + access_type != MMU_INST_FETCH, | ||
152 | + !arm_el_is_aa64(env, 1)); | ||
153 | level = 0; | ||
154 | |||
155 | /* | ||
156 | diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c | ||
157 | index XXXXXXX..XXXXXXX 100644 | ||
158 | --- a/target/arm/tcg/pauth_helper.c | ||
159 | +++ b/target/arm/tcg/pauth_helper.c | ||
160 | @@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier, | ||
161 | ARMPACKey *key, bool data) | ||
162 | { | ||
163 | ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env); | ||
164 | - ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data); | ||
165 | + ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false); | ||
166 | uint64_t pac, ext_ptr, ext, test; | ||
167 | int bot_bit, top_bit; | ||
168 | |||
169 | @@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier, | ||
170 | ARMPACKey *key, bool data, int keynumber) | ||
171 | { | ||
172 | ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env); | ||
173 | - ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data); | ||
174 | + ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false); | ||
175 | int bot_bit, top_bit; | ||
176 | uint64_t pac, orig_ptr, test; | ||
177 | |||
178 | @@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier, | ||
179 | static uint64_t pauth_strip(CPUARMState *env, uint64_t ptr, bool data) | ||
180 | { | ||
181 | ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env); | ||
182 | - ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data); | ||
183 | + ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data, false); | ||
184 | |||
185 | return pauth_original_ptr(ptr, param); | ||
55 | } | 186 | } |
56 | |||
57 | static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri, | ||
58 | -- | 187 | -- |
59 | 2.20.1 | 188 | 2.34.1 |
60 | |||
61 | diff view generated by jsdifflib |