Hi; here's the first target-arm pullreq for the 7.0 cycle.

The following changes since commit 76b56fdfc9fa43ec6e5986aee33f108c6c6a511e:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2021-12-14 12:46:18 -0800)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211215

for you to fetch changes up to aed176558806674d030a8305d989d4e6a5073359:

tests/acpi: add expected blob for VIOT test on virt machine (2021-12-15 10:35:26 +0000)

* ITS: error reporting cleanup

* aspeed: improve documentation

* Fix STM32F2XX USART data register readout

* allow emulated GICv3 to be disabled in non-TCG builds

* fix exception priority for singlestep, misaligned PC, bp, etc

* Correct calculation of tlb range invalidate length

* npcm7xx_emc: fix missing queue_flush

* virt: Add VIOT ACPI table for virtio-iommu

* target/i386: Use assert() to sanity-check b1 in SSE decode

* Don't include qemu-common unnecessarily

Alex Bennée (1):

hw/intc: clean-up error reporting for failed ITS cmd

Jean-Philippe Brucker (8):

hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu

hw/arm/virt: Remove device tree restriction for virtio-iommu

hw/arm/virt: Reject instantiation of multiple IOMMUs

hw/arm/virt: Use object_property_set instead of qdev_prop_set

tests/acpi: allow updates of VIOT expected data files

tests/acpi: add test case for VIOT

tests/acpi: add expected blobs for VIOT test on q35 machine

tests/acpi: add expected blob for VIOT test on virt machine

Joel Stanley (4):

docs: aspeed: Add new boards

docs: aspeed: Update OpenBMC image URL

docs: aspeed: Give an example of booting a kernel

docs: aspeed: ADC is now modelled

Olivier Hériveaux (1):

Fix STM32F2XX USART data register readout

From: Alex Bennée <alex.bennee@linaro.org>

While trying to debug a GIC ITS failure I saw some guest errors that

had poor formatting as well as leaving me confused as to what failed.

As most of the checks aren't possible without a valid dte split that

check apart and then check the other conditions in steps. This avoids

us relying on undefined data.

I still get a failure with the current kvm-unit-tests but at least I

know (partially) why now:

Exception return from AArch64 EL1 to AArch64 EL1 PC 0x40080588

PASS: gicv3: its-trigger: inv/invall: dev2/eventid=20 now triggers an LPI

ITS: MAPD devid=2 size = 0x8 itt=0x40430000 valid=0

INT dev_id=2 event_id=20

process_its_cmd: invalid command attributes: invalid dte: 0 for 2 (MEM_TX: 0)

PASS: gicv3: its-trigger: mapd valid=false: no LPI after device unmap

SUMMARY: 6 tests, 1 unexpected failures

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20211112170454.3158925-1-alex.bennee@linaro.org

Cc: Shashi Mallela <shashi.mallela@linaro.org>

Cc: Peter Maydell <peter.maydell@linaro.org>

hw/intc/arm_gicv3_its.c | 39 +++++++++++++++++++++++++++------------

1 file changed, 27 insertions(+), 12 deletions(-)

@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,

if (res != MEMTX_OK) {

return result;

+ } else {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: "

+ "invalid dte: %"PRIx64" for %d (MEM_TX: %d)\n",

+ __func__, dte, devid, res);

+ return result;

}

- if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||

- !cte_valid || (eventid > max_eventid)) {

+

+ /*

+ * In this implementation, in case of guest errors we ignore the

+ * command and move onto the next command in the queue.

+ */

+ if (devid > s->dt.maxids.max_devids) {

qemu_log_mask(LOG_GUEST_ERROR,

- "%s: invalid command attributes "

- "devid %d or eventid %d or invalid dte %d or"

- "invalid cte %d or invalid ite %d\n",

- __func__, devid, eventid, dte_valid, cte_valid,

- ite_valid);

- /*

- * in this implementation, in case of error

- * we ignore this command and move onto the next

- * command in the queue

- */

+ "%s: invalid command attributes: devid %d>%d",

+ __func__, devid, s->dt.maxids.max_devids);

+

+ } else if (!dte_valid || !ite_valid || !cte_valid) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: "

+ "dte: %s, ite: %s, cte: %s\n",

+ __func__,

+ dte_valid ? "valid" : "invalid",

+ ite_valid ? "valid" : "invalid",

+ cte_valid ? "valid" : "invalid");

+ } else if (eventid > max_eventid) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: invalid command attributes: eventid %d > %d\n",

+ __func__, eventid, max_eventid);

} else {

/*

* Current implementation only supports rdbase == procnum

From: Philippe Mathieu-Daudé <philmd@redhat.com>

gicv3_set_gicv3state() is used by arm_gicv3_common.c in

arm_gicv3_common_realize(). Since we want to restrict

arm_gicv3_cpuif.c to TCG, extract gicv3_set_gicv3state()

to a new file. Add this file to the meson 'specific'

source set, since it needs access to "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20211115223619.2599282-2-philmd@redhat.com

hw/intc/arm_gicv3_cpuif.c | 10 +---------

hw/intc/arm_gicv3_cpuif_common.c | 22 ++++++++++++++++++++++

hw/intc/meson.build | 1 +

3 files changed, 24 insertions(+), 9 deletions(-)

create mode 100644 hw/intc/arm_gicv3_cpuif_common.c

@@ -XXX,XX +XXX,XX @@

/*

- * ARM Generic Interrupt Controller v3

+ * ARM Generic Interrupt Controller v3 (emulation)

*

* Copyright (c) 2016 Linaro Limited

* Written by Peter Maydell

@@ -XXX,XX +XXX,XX @@

#include "hw/irq.h"

#include "cpu.h"

-void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)

-{

- ARMCPU *arm_cpu = ARM_CPU(cpu);

- CPUARMState *env = &arm_cpu->env;

-

- env->gicv3state = (void *)s;

-};

-

static GICv3CPUState *icc_cs_from_env(CPUARMState *env)

{

return env->gicv3state;

diff --git a/hw/intc/arm_gicv3_cpuif_common.c b/hw/intc/arm_gicv3_cpuif_common.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/intc/arm_gicv3_cpuif_common.c

@@ -XXX,XX +XXX,XX @@

+/* SPDX-License-Identifier: GPL-2.0-or-later */

+/*

+ * ARM Generic Interrupt Controller v3

+ *

+ * Copyright (c) 2016 Linaro Limited

+ * Written by Peter Maydell

+ *

+ * This code is licensed under the GPL, version 2 or (at your option)

+ * any later version.

+ */

+

+#include "qemu/osdep.h"

+#include "gicv3_internal.h"

+#include "cpu.h"

+

+void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)

+{

+ ARMCPU *arm_cpu = ARM_CPU(cpu);

+ CPUARMState *env = &arm_cpu->env;

+

+ env->gicv3state = (void *)s;

+};

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

+specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The TYPE_ARM_GICV3 device is an emulated one. When using

KVM, it is recommended to use the TYPE_KVM_ARM_GICV3 device

(which uses in-kernel support).

When using --with-devices-FOO, it is possible to build a

binary with a specific set of devices. When this binary is

restricted to KVM accelerator, the TYPE_ARM_GICV3 device is

irrelevant, and it is desirable to remove it from the binary.

Therefore introduce the CONFIG_ARM_GIC_TCG Kconfig selector

which select the files required to have the TYPE_ARM_GICV3

device, but also allowing to de-select this device.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20211115223619.2599282-3-philmd@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gicv3.c | 2 +-

hw/intc/Kconfig | 5 +++++

hw/intc/meson.build | 10 ++++++----

3 files changed, 12 insertions(+), 5 deletions(-)

@@ -XXX,XX +XXX,XX @@

/*

- * ARM Generic Interrupt Controller v3

+ * ARM Generic Interrupt Controller v3 (emulation)

*

* Copyright (c) 2015 Huawei.

* Copyright (c) 2016 Linaro Limited

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig

--- a/hw/intc/Kconfig

+++ b/hw/intc/Kconfig

@@ -XXX,XX +XXX,XX @@ config APIC

select MSI_NONBROKEN

select I8259

+config ARM_GIC_TCG

+ bool

+ default y

+ depends on ARM_GIC && TCG

config ARM_GIC_KVM

bool

default y

diff --git a/hw/intc/meson.build b/hw/intc/meson.build

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/meson.build

+++ b/hw/intc/meson.build

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(

'arm_gic.c',

'arm_gic_common.c',

'arm_gicv2m.c',

- 'arm_gicv3.c',

'arm_gicv3_common.c',

- 'arm_gicv3_dist.c',

'arm_gicv3_its_common.c',

- 'arm_gicv3_redist.c',

+))

+softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(

+ 'arm_gicv3.c',

+ 'arm_gicv3_dist.c',

'arm_gicv3_its.c',

+ 'arm_gicv3_redist.c',

))

softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))

softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))

@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in

specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))

specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))

-specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))

+specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))

specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))

specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))

specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))

From: Richard Henderson <richard.henderson@linaro.org>

For A64, any input to an indirect branch can cause this.

For A32, many indirect branch paths force the branch to be aligned,

but BXWritePC does not. This includes the BX instruction but also

other interworking changes to PC. Prior to v8, this case is UNDEFINED.

With v8, this is CONSTRAINED UNPREDICTABLE and may either raise an

exception or force align the PC.

We choose to raise an exception because we have the infrastructure,

it makes the generated code for gen_bx simpler, and it has the

possibility of catching more guest bugs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.h | 1 +

target/arm/syndrome.h | 5 ++++

linux-user/aarch64/cpu_loop.c | 46 ++++++++++++++++++++---------------

target/arm/tlb_helper.c | 18 ++++++++++++++

target/arm/translate-a64.c | 15 ++++++++++++

target/arm/translate.c | 22 ++++++++++++++++-

6 files changed, 87 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.h

+++ b/target/arm/helper.h

@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,

DEF_HELPER_2(exception_internal, void, env, i32)

DEF_HELPER_4(exception_with_syndrome, void, env, i32, i32, i32)

DEF_HELPER_2(exception_bkpt_insn, void, env, i32)

+DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)

DEF_HELPER_1(setend, void, env)

DEF_HELPER_2(wfi, void, env, i32)

DEF_HELPER_1(wfe, void, env)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/syndrome.h

+++ b/target/arm/syndrome.h

@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_illegalstate(void)

return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;

}

+static inline uint32_t syn_pcalignment(void)

+{

+ return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;

+}

+

#endif /* TARGET_ARM_SYNDROME_H */

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/aarch64/cpu_loop.c

+++ b/linux-user/aarch64/cpu_loop.c

@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)

break;

case EXCP_PREFETCH_ABORT:

case EXCP_DATA_ABORT:

- /* We should only arrive here with EC in {DATAABORT, INSNABORT}. */

ec = syn_get_ec(env->exception.syndrome);

- assert(ec == EC_DATAABORT || ec == EC_INSNABORT);

-

- /* Both EC have the same format for FSC, or close enough. */

- fsc = extract32(env->exception.syndrome, 0, 6);

- switch (fsc) {

- case 0x04 ... 0x07: /* Translation fault, level {0-3} */

- si_signo = TARGET_SIGSEGV;

- si_code = TARGET_SEGV_MAPERR;

+ switch (ec) {

+ case EC_DATAABORT:

+ case EC_INSNABORT:

+ /* Both EC have the same format for FSC, or close enough. */

+ fsc = extract32(env->exception.syndrome, 0, 6);

+ switch (fsc) {

+ case 0x04 ... 0x07: /* Translation fault, level {0-3} */

+ si_signo = TARGET_SIGSEGV;

+ si_code = TARGET_SEGV_MAPERR;

+ break;

+ case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */

+ case 0x0d ... 0x0f: /* Permission fault, level {1-3} */

+ si_signo = TARGET_SIGSEGV;

+ si_code = TARGET_SEGV_ACCERR;

+ break;

+ case 0x11: /* Synchronous Tag Check Fault */

+ si_signo = TARGET_SIGSEGV;

+ si_code = TARGET_SEGV_MTESERR;

+ break;

+ case 0x21: /* Alignment fault */

+ si_signo = TARGET_SIGBUS;

+ si_code = TARGET_BUS_ADRALN;

+ break;

+ default:

+ g_assert_not_reached();

+ }

break;

- case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */

- case 0x0d ... 0x0f: /* Permission fault, level {1-3} */

- si_signo = TARGET_SIGSEGV;

- si_code = TARGET_SEGV_ACCERR;

- break;

- case 0x11: /* Synchronous Tag Check Fault */

- si_signo = TARGET_SIGSEGV;

- si_code = TARGET_SEGV_MTESERR;

- break;

- case 0x21: /* Alignment fault */

+ case EC_PCALIGNMENT:

si_signo = TARGET_SIGBUS;

si_code = TARGET_BUS_ADRALN;

break;

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tlb_helper.c

+++ b/target/arm/tlb_helper.c

@@ -XXX,XX +XXX,XX @@

#include "cpu.h"

#include "internals.h"

#include "exec/exec-all.h"

+#include "exec/helper-proto.h"

static inline uint32_t merge_syn_data_abort(uint32_t template_syn,

unsigned int target_el,

@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,

arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);

}

+void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)

+{

+ ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };

+ int target_el = exception_target_el(env);

+ int mmu_idx = cpu_mmu_index(env, true);

+ uint32_t fsc;

+

+ env->exception.vaddress = pc;

+

+ /*

+ * Note that the fsc is not applicable to this exception,

+ * since any syndrome is pcalignment not insn_abort.

+ */

+ env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);

+ raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);

+}

+

#if !defined(CONFIG_USER_ONLY)

/*

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint64_t pc = s->base.pc_next;

uint32_t insn;

+ /* Singlestep exceptions have the highest priority. */

if (s->ss_active && !s->pstate_ss) {

/* Singlestep state is Active-pending.

* If we're in this state at the start of a TB then either

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

return;

}

+ if (pc & 3) {

+ /*

+ * PC alignment fault. This has priority over the instruction abort

+ * that we would receive from a translation fault via arm_ldl_code.

+ * This should only be possible after an indirect branch, at the

+ * start of the TB.

+ */

+ assert(s->base.num_insns == 1);

+ gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));

+ s->base.is_jmp = DISAS_NORETURN;

+ s->base.pc_next = QEMU_ALIGN_UP(pc, 4);

+ return;

+ }

+

s->pc_curr = pc;

insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);

s->insn = insn;

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t pc = dc->base.pc_next;

unsigned int insn;

- if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {

+ /* Singlestep exceptions have the highest priority. */

+ if (arm_check_ss_active(dc)) {

+ dc->base.pc_next = pc + 4;

+ return;

+ }

+

+ if (pc & 3) {

+ /*

+ * PC alignment fault. This has priority over the instruction abort

+ * that we would receive from a translation fault via arm_ldl_code

+ * (or the execution of the kernelpage entrypoint). This should only

+ * be possible after an indirect branch, at the start of the TB.

+ */

+ assert(dc->base.num_insns == 1);

+ gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));

+ dc->base.is_jmp = DISAS_NORETURN;

+ dc->base.pc_next = QEMU_ALIGN_UP(pc, 4);

+ return;

+ }

+

+ if (arm_check_kernelpage(dc)) {

dc->base.pc_next = pc + 4;

return;

}

--

2.25.1