1
Some small arm bug fixes for rc3.
1
Squashed in a trivial fix for 32-bit hosts:
2
3
--- a/target/arm/mve_helper.c
4
+++ b/target/arm/mve_helper.c
5
@@ -XXX,XX +XXX,XX @@ DO_LDAV(vmlsldavxsw, 4, int32_t, true, +=, -=)
6
acc = EVENACC(acc, TO128(n[H##ESIZE(e + 1 * XCHG)] * \
7
m[H##ESIZE(e)])); \
8
} \
9
- acc = int128_add(acc, 1 << 7); \
10
+ acc = int128_add(acc, int128_make64(1 << 7)); \
11
} \
12
} \
13
mve_advance_vpt(env); \
2
14
3
-- PMM
15
-- PMM
4
16
5
The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:
17
The following changes since commit 53f306f316549d20c76886903181413d20842423:
6
18
7
Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)
19
Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2021-06-21 11:26:04 +0100)
8
20
9
are available in the Git repository at:
21
are available in the Git repository at:
10
22
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401
23
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210624
12
24
13
for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:
25
for you to fetch changes up to 90a76c6316cfe6416fc33814a838fb3928f746ee:
14
26
15
target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)
27
docs/system: arm: Add nRF boards description (2021-06-24 14:58:48 +0100)
16
28
17
----------------------------------------------------------------
29
----------------------------------------------------------------
18
target-arm queue:
30
target-arm queue:
19
* target/arm: Fix some bugs in secure EL2 handling
31
* Don't require 'virt' board to be compiled in for ACPI GHES code
20
* target/arm: Fix assert when !HAVE_CMPXCHG128
32
* docs: Document which architecture extensions we emulate
21
* MAINTAINERS: change Fred Konrad's email address
33
* Fix bugs in M-profile FPCXT_NS accesses
34
* First slice of MVE patches
35
* Implement MTE3
36
* docs/system: arm: Add nRF boards description
22
37
23
----------------------------------------------------------------
38
----------------------------------------------------------------
24
Frederic Konrad (1):
39
Alexandre Iooss (1):
25
MAINTAINERS: change Fred Konrad's email address
40
docs/system: arm: Add nRF boards description
26
41
27
Idan Horowitz (4):
42
Peter Collingbourne (1):
28
target/arm: Fix MTE access checks for disabled SEL2
43
target/arm: Implement MTE3
29
target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
30
target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
31
target/arm: Determine final stage 2 output PA space based on original IPA
32
44
33
Peter Maydell (1):
45
Peter Maydell (55):
34
target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
46
hw/acpi: Provide stub version of acpi_ghes_record_errors()
47
hw/acpi: Provide function acpi_ghes_present()
48
target/arm: Use acpi_ghes_present() to see if we report ACPI memory errors
49
docs/system/arm: Document which architecture extensions we emulate
50
target/arm/translate-vfp.c: Whitespace fixes
51
target/arm: Handle FPU being disabled in FPCXT_NS accesses
52
target/arm: Don't NOCP fault for FPCXT_NS accesses
53
target/arm: Handle writeback in VLDR/VSTR sysreg with no memory access
54
target/arm: Factor FP context update code out into helper function
55
target/arm: Split vfp_access_check() into A and M versions
56
target/arm: Handle FPU check for FPCXT_NS insns via vfp_access_check_m()
57
target/arm: Implement MVE VLDR/VSTR (non-widening forms)
58
target/arm: Implement widening/narrowing MVE VLDR/VSTR insns
59
target/arm: Implement MVE VCLZ
60
target/arm: Implement MVE VCLS
61
target/arm: Implement MVE VREV16, VREV32, VREV64
62
target/arm: Implement MVE VMVN (register)
63
target/arm: Implement MVE VABS
64
target/arm: Implement MVE VNEG
65
tcg: Make gen_dup_i32/i64() public as tcg_gen_dup_i32/i64
66
target/arm: Implement MVE VDUP
67
target/arm: Implement MVE VAND, VBIC, VORR, VORN, VEOR
68
target/arm: Implement MVE VADD, VSUB, VMUL
69
target/arm: Implement MVE VMULH
70
target/arm: Implement MVE VRMULH
71
target/arm: Implement MVE VMAX, VMIN
72
target/arm: Implement MVE VABD
73
target/arm: Implement MVE VHADD, VHSUB
74
target/arm: Implement MVE VMULL
75
target/arm: Implement MVE VMLALDAV
76
target/arm: Implement MVE VMLSLDAV
77
target/arm: Implement MVE VRMLALDAVH, VRMLSLDAVH
78
target/arm: Implement MVE VADD (scalar)
79
target/arm: Implement MVE VSUB, VMUL (scalar)
80
target/arm: Implement MVE VHADD, VHSUB (scalar)
81
target/arm: Implement MVE VBRSR
82
target/arm: Implement MVE VPST
83
target/arm: Implement MVE VQADD and VQSUB
84
target/arm: Implement MVE VQDMULH and VQRDMULH (scalar)
85
target/arm: Implement MVE VQDMULL scalar
86
target/arm: Implement MVE VQDMULH, VQRDMULH (vector)
87
target/arm: Implement MVE VQADD, VQSUB (vector)
88
target/arm: Implement MVE VQSHL (vector)
89
target/arm: Implement MVE VQRSHL
90
target/arm: Implement MVE VSHL insn
91
target/arm: Implement MVE VRSHL
92
target/arm: Implement MVE VQDMLADH and VQRDMLADH
93
target/arm: Implement MVE VQDMLSDH and VQRDMLSDH
94
target/arm: Implement MVE VQDMULL (vector)
95
target/arm: Implement MVE VRHADD
96
target/arm: Implement MVE VADC, VSBC
97
target/arm: Implement MVE VCADD
98
target/arm: Implement MVE VHCADD
99
target/arm: Implement MVE VADDV
100
target/arm: Make VMOV scalar <-> gpreg beatwise for MVE
35
101
36
target/arm/internals.h | 2 +-
102
docs/system/arm/emulation.rst | 103 ++++
37
target/arm/helper.c | 18 +++++++++++++++---
103
docs/system/arm/nrf.rst | 51 ++
38
target/arm/translate-a64.c | 7 ++++++-
104
docs/system/target-arm.rst | 7 +
39
.mailmap | 3 ++-
105
include/hw/acpi/ghes.h | 9 +
40
MAINTAINERS | 2 +-
106
include/tcg/tcg-op.h | 8 +
41
5 files changed, 25 insertions(+), 7 deletions(-)
107
include/tcg/tcg.h | 1 -
108
target/arm/helper-mve.h | 357 +++++++++++++
109
target/arm/helper.h | 2 +
110
target/arm/internals.h | 11 +
111
target/arm/translate-a32.h | 3 +
112
target/arm/translate.h | 10 +
113
target/arm/m-nocp.decode | 24 +
114
target/arm/mve.decode | 240 +++++++++
115
target/arm/vfp.decode | 14 -
116
hw/acpi/ghes-stub.c | 22 +
117
hw/acpi/ghes.c | 17 +
118
target/arm/cpu64.c | 2 +-
119
target/arm/kvm64.c | 6 +-
120
target/arm/mte_helper.c | 82 +--
121
target/arm/mve_helper.c | 1160 +++++++++++++++++++++++++++++++++++++++++
122
target/arm/translate-m-nocp.c | 550 +++++++++++++++++++
123
target/arm/translate-mve.c | 759 +++++++++++++++++++++++++++
124
target/arm/translate-vfp.c | 741 +++++++-------------------
125
tcg/tcg-op-gvec.c | 20 +-
126
MAINTAINERS | 1 +
127
hw/acpi/meson.build | 6 +-
128
target/arm/meson.build | 1 +
129
27 files changed, 3578 insertions(+), 629 deletions(-)
130
create mode 100644 docs/system/arm/emulation.rst
131
create mode 100644 docs/system/arm/nrf.rst
132
create mode 100644 target/arm/helper-mve.h
133
create mode 100644 hw/acpi/ghes-stub.c
134
create mode 100644 target/arm/mve_helper.c
135
diff view generated by jsdifflib
Deleted patch
1
From: Idan Horowitz <idan.horowitz@gmail.com>
2
1
3
While not mentioned anywhere in the actual specification text, the
4
HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
5
security state. This can be observed in the psuedo-code implementation
6
of AArch64.AllocationTagAccessIsEnabled().
7
8
Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
target/arm/internals.h | 2 +-
14
target/arm/helper.c | 2 +-
15
2 files changed, 2 insertions(+), 2 deletions(-)
16
17
diff --git a/target/arm/internals.h b/target/arm/internals.h
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/internals.h
20
+++ b/target/arm/internals.h
21
@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
22
&& !(env->cp15.scr_el3 & SCR_ATA)) {
23
return false;
24
}
25
- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
26
+ if (el < 2 && arm_is_el2_enabled(env)) {
27
uint64_t hcr = arm_hcr_el2_eff(env);
28
if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
29
return false;
30
diff --git a/target/arm/helper.c b/target/arm/helper.c
31
index XXXXXXX..XXXXXXX 100644
32
--- a/target/arm/helper.c
33
+++ b/target/arm/helper.c
34
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
35
{
36
int el = arm_current_el(env);
37
38
- if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
39
+ if (el < 2 && arm_is_el2_enabled(env)) {
40
uint64_t hcr = arm_hcr_el2_eff(env);
41
if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
42
return CP_ACCESS_TRAP_EL2;
43
--
44
2.25.1
diff view generated by jsdifflib
Deleted patch
1
From: Idan Horowitz <idan.horowitz@gmail.com>
2
1
3
As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
4
PA space of the IPA is non secure, the output PA space is secure if and only
5
if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
6
7
Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/helper.c | 2 +-
13
1 file changed, 1 insertion(+), 1 deletion(-)
14
15
diff --git a/target/arm/helper.c b/target/arm/helper.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/helper.c
18
+++ b/target/arm/helper.c
19
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
20
} else {
21
attrs->secure =
22
!((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
23
- || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
24
+ || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
25
}
26
}
27
return 0;
28
--
29
2.25.1
diff view generated by jsdifflib
Deleted patch
1
From: Idan Horowitz <idan.horowitz@gmail.com>
2
1
3
As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
4
initial PA space used for stage 2 table walks is assigned based on the SW
5
and NSW bits of the VSTCR and VTCR registers.
6
This was already implemented for the recursive stage 2 page table walks
7
in S1_ptw_translate(), but was missing for the final stage 2 walk.
8
9
Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
10
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
11
Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 10 ++++++++++
15
1 file changed, 10 insertions(+)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
22
return ret;
23
}
24
25
+ if (arm_is_secure_below_el3(env)) {
26
+ if (attrs->secure) {
27
+ attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
28
+ } else {
29
+ attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
30
+ }
31
+ } else {
32
+ assert(!attrs->secure);
33
+ }
34
+
35
s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
36
is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
37
38
--
39
2.25.1
diff view generated by jsdifflib
Deleted patch
1
From: Idan Horowitz <idan.horowitz@gmail.com>
2
1
3
As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
4
decision as to the output address's PA space based on the SA/SW/NSA/NSW
5
bits needs to take the input IPA's PA space into account, and not the
6
PA space of the result of the stage 2 walk itself.
7
8
Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
11
[PMM: fixed commit message typo]
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 8 +++++---
15
1 file changed, 5 insertions(+), 3 deletions(-)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
22
hwaddr ipa;
23
int s2_prot;
24
int ret;
25
+ bool ipa_secure;
26
ARMCacheAttrs cacheattrs2 = {};
27
ARMMMUIdx s2_mmu_idx;
28
bool is_el0;
29
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
30
return ret;
31
}
32
33
+ ipa_secure = attrs->secure;
34
if (arm_is_secure_below_el3(env)) {
35
- if (attrs->secure) {
36
+ if (ipa_secure) {
37
attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
38
} else {
39
attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
40
}
41
} else {
42
- assert(!attrs->secure);
43
+ assert(!ipa_secure);
44
}
45
46
s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
47
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
48
49
/* Check if IPA translates to secure or non-secure PA space. */
50
if (arm_is_secure_below_el3(env)) {
51
- if (attrs->secure) {
52
+ if (ipa_secure) {
53
attrs->secure =
54
!(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
55
} else {
56
--
57
2.25.1
diff view generated by jsdifflib
Deleted patch
1
From: Frederic Konrad <konrad@adacore.com>
2
1
3
frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
4
2022-04-01.
5
6
Use my personal email instead.
7
8
Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
9
Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
10
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
11
Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
.mailmap | 3 ++-
15
MAINTAINERS | 2 +-
16
2 files changed, 3 insertions(+), 2 deletions(-)
17
18
diff --git a/.mailmap b/.mailmap
19
index XXXXXXX..XXXXXXX 100644
20
--- a/.mailmap
21
+++ b/.mailmap
22
@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
23
Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
24
Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
25
Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
26
-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
27
+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
28
+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
29
Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
30
Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
31
Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
32
diff --git a/MAINTAINERS b/MAINTAINERS
33
index XXXXXXX..XXXXXXX 100644
34
--- a/MAINTAINERS
35
+++ b/MAINTAINERS
36
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
37
38
Leon3
39
M: Fabien Chouteau <chouteau@adacore.com>
40
-M: KONRAD Frederic <frederic.konrad@adacore.com>
41
+M: Frederic Konrad <konrad.frederic@yahoo.fr>
42
S: Maintained
43
F: hw/sparc/leon3.c
44
F: hw/*/grlib*
45
--
46
2.25.1
47
48
diff view generated by jsdifflib
Deleted patch
1
In gen_store_exclusive(), if the host does not have a cmpxchg128
2
primitive then we generate bad code for STXP for storing two 64-bit
3
values. We generate a call to the exit_atomic helper, which never
4
returns, and set is_jmp to DISAS_NORETURN. However, this is
5
forgetting that we have already emitted a brcond that jumps over this
6
call for the case where we don't hold the exclusive. The effect is
7
that we don't generate any code to end the TB for the
8
exclusive-not-held execution path, which falls into the "exit with
9
TB_EXIT_REQUESTED" code that gen_tb_end() emits. This then causes an
10
assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
11
return that wasn't for an interrupt or icount.
12
1
13
In particular, you can hit this case when using the clang sanitizers
14
and trying to run the xlnx-versal-virt acceptance test in 'make
15
check-acceptance'. This bug was masked until commit 848126d11e93ff
16
("meson: move int128 checks from configure") because we used to set
17
CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
18
do not.
19
20
Fix the bug by not setting is_jmp. The code after the exit_atomic
21
call up to the fail_label is dead, but TCG is smart enough to
22
eliminate it. We do need to set 'tmp' to some valid value, though
23
(in the same way the exit_atomic-using code in tcg/tcg-op.c does).
24
25
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
26
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
28
Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
29
---
30
target/arm/translate-a64.c | 7 ++++++-
31
1 file changed, 6 insertions(+), 1 deletion(-)
32
33
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/translate-a64.c
36
+++ b/target/arm/translate-a64.c
37
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
38
} else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
39
if (!HAVE_CMPXCHG128) {
40
gen_helper_exit_atomic(cpu_env);
41
- s->base.is_jmp = DISAS_NORETURN;
42
+ /*
43
+ * Produce a result so we have a well-formed opcode
44
+ * stream when the following (dead) code uses 'tmp'.
45
+ * TCG will remove the dead ops for us.
46
+ */
47
+ tcg_gen_movi_i64(tmp, 0);
48
} else if (s->be_data == MO_LE) {
49
gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
50
cpu_exclusive_addr,
51
--
52
2.25.1
diff view generated by jsdifflib