[PULL 0/2] target-arm queue
[PULL v2 00/14] target-arm queue
1
Couple of trivial fixes for rc3...
1
Changes v1->v2 (fixing CI failures in v1, added a couple of
2
extra patches in an attempt to avoid having to do a last
3
minute arm pullreq next week):
4
* new patch to hopefully fix the build issue with the SVE/SME sysregs test
5
* dropped the IC IVAU test case patch
6
* new patch: fix over-length shift
7
* new patches: define neoverse-v1
2
8
3
The following changes since commit 20661b75ea6093f5e59079d00a778a972d6732c5:
9
thanks
10
-- PMM
4
11
5
Merge tag 'pull-ppc-20220404' of https://github.com/legoater/qemu into staging (2022-04-04 15:48:55 +0100)
12
The following changes since commit 2a6ae69154542caa91dd17c40fd3f5ffbec300de:
13
14
Merge tag 'pull-maintainer-ominbus-030723-1' of https://gitlab.com/stsquad/qemu into staging (2023-07-04 08:36:44 +0200)
6
15
7
are available in the Git repository at:
16
are available in the Git repository at:
8
17
9
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220405
18
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230706
10
19
11
for you to fetch changes up to 80b952bb694a90f7e530d407b01066894e64a443:
20
for you to fetch changes up to c41077235168140cdd4a34fce9bd95c3d30efe9c:
12
21
13
docs/system/devices/can.rst: correct links to CTU CAN FD IP core documentation. (2022-04-05 09:29:28 +0100)
22
target/arm: Avoid over-length shift in arm_cpu_sve_finalize() error case (2023-07-06 13:36:51 +0100)
14
23
15
----------------------------------------------------------------
24
----------------------------------------------------------------
16
target-arm queue:
25
target-arm queue:
17
* docs/system/devices/can.rst: correct links to CTU CAN FD IP core documentation.
26
* Add raw_writes ops for register whose write induce TLB maintenance
18
* xlnx-bbram: hw/nvram: Fix uninitialized Error *
27
* hw/arm/sbsa-ref: use XHCI to replace EHCI
28
* Avoid splitting Zregs across lines in dump
29
* Dump ZA[] when active
30
* Fix SME full tile indexing
31
* Handle IC IVAU to improve compatibility with JITs
32
* xlnx-canfd-test: Fix code coverity issues
33
* gdbstub: Guard M-profile code with CONFIG_TCG
34
* allwinner-sramc: Set class_size
35
* target/xtensa: Assert that interrupt level is within bounds
36
* Avoid over-length shift in arm_cpu_sve_finalize() error case
37
* Define new 'neoverse-v1' CPU type
19
38
20
----------------------------------------------------------------
39
----------------------------------------------------------------
21
Pavel Pisa (1):
40
Akihiko Odaki (1):
22
docs/system/devices/can.rst: correct links to CTU CAN FD IP core documentation.
41
hw: arm: allwinner-sramc: Set class_size
23
42
24
Tong Ho (1):
43
Eric Auger (1):
25
xlnx-bbram: hw/nvram: Fix uninitialized Error *
44
target/arm: Add raw_writes ops for register whose write induce TLB maintenance
26
45
27
docs/system/devices/can.rst | 6 +++---
46
Fabiano Rosas (1):
28
hw/nvram/xlnx-bbram.c | 2 +-
47
target/arm: gdbstub: Guard M-profile code with CONFIG_TCG
29
2 files changed, 4 insertions(+), 4 deletions(-)
48
49
John Högberg (1):
50
target/arm: Handle IC IVAU to improve compatibility with JITs
51
52
Peter Maydell (5):
53
tests/tcg/aarch64/sysregs.c: Use S syntax for id_aa64zfr0_el1 and id_aa64smfr0_el1
54
target/xtensa: Assert that interrupt level is within bounds
55
target/arm: Suppress more TCG unimplemented features in ID registers
56
target/arm: Define neoverse-v1
57
target/arm: Avoid over-length shift in arm_cpu_sve_finalize() error case
58
59
Richard Henderson (3):
60
target/arm: Avoid splitting Zregs across lines in dump
61
target/arm: Dump ZA[] when active
62
target/arm: Fix SME full tile indexing
63
64
Vikram Garhwal (1):
65
tests/qtest: xlnx-canfd-test: Fix code coverity issues
66
67
Yuquan Wang (1):
68
hw/arm/sbsa-ref: use XHCI to replace EHCI
69
70
docs/system/arm/sbsa.rst | 5 +-
71
docs/system/arm/virt.rst | 1 +
72
hw/arm/sbsa-ref.c | 24 ++++---
73
hw/arm/virt.c | 1 +
74
hw/misc/allwinner-sramc.c | 1 +
75
target/arm/cpu.c | 98 +++++++++++++++++++++--------
76
target/arm/cpu64.c | 4 +-
77
target/arm/gdbstub.c | 4 ++
78
target/arm/helper.c | 70 +++++++++++++++++----
79
target/arm/tcg/cpu64.c | 128 ++++++++++++++++++++++++++++++++++++++
80
target/arm/tcg/translate-sme.c | 24 +++++--
81
target/xtensa/exc_helper.c | 3 +
82
tests/qtest/xlnx-canfd-test.c | 33 ++++------
83
tests/tcg/aarch64/sme-outprod1.c | 83 ++++++++++++++++++++++++
84
tests/tcg/aarch64/sysregs.c | 11 ++--
85
hw/arm/Kconfig | 2 +-
86
tests/tcg/aarch64/Makefile.target | 16 ++---
87
17 files changed, 415 insertions(+), 93 deletions(-)
88
create mode 100644 tests/tcg/aarch64/sme-outprod1.c
89
diff view generated by jsdifflib
New patch
[PULL 01/14] target/arm: Add raw_writes ops for register whose write induce TLB maintenance
1
From: Eric Auger <eric.auger@redhat.com>
1
2
3
Some registers whose 'cooked' writefns induce TLB maintenance do
4
not have raw_writefn ops defined. If only the writefn ops is set
5
(ie. no raw_writefn is provided), it is assumed the cooked also
6
work as the raw one. For those registers it is not obvious the
7
tlb_flush works on KVM mode so better/safer setting the raw write.
8
9
Signed-off-by: Eric Auger <eric.auger@redhat.com>
10
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 23 +++++++++++++----------
15
1 file changed, 13 insertions(+), 10 deletions(-)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
22
.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
23
.access = PL1_RW, .accessfn = access_tvm_trvm,
24
.fgt = FGT_TTBR0_EL1,
25
- .writefn = vmsa_ttbr_write, .resetvalue = 0,
26
+ .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
27
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
28
offsetof(CPUARMState, cp15.ttbr0_ns) } },
29
{ .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
30
.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
31
.access = PL1_RW, .accessfn = access_tvm_trvm,
32
.fgt = FGT_TTBR1_EL1,
33
- .writefn = vmsa_ttbr_write, .resetvalue = 0,
34
+ .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
35
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
36
offsetof(CPUARMState, cp15.ttbr1_ns) } },
37
{ .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
38
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
39
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
40
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
41
offsetof(CPUARMState, cp15.ttbr0_ns) },
42
- .writefn = vmsa_ttbr_write, },
43
+ .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
44
{ .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
45
.access = PL1_RW, .accessfn = access_tvm_trvm,
46
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
47
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
48
offsetof(CPUARMState, cp15.ttbr1_ns) },
49
- .writefn = vmsa_ttbr_write, },
50
+ .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
51
};
52
53
static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
54
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
55
.type = ARM_CP_IO,
56
.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
57
.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
58
- .writefn = hcr_write },
59
+ .writefn = hcr_write, .raw_writefn = raw_write },
60
{ .name = "HCR", .state = ARM_CP_STATE_AA32,
61
.type = ARM_CP_ALIAS | ARM_CP_IO,
62
.cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
63
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
64
{ .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
65
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
66
.access = PL2_RW, .writefn = vmsa_tcr_el12_write,
67
+ .raw_writefn = raw_write,
68
.fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
69
{ .name = "VTCR", .state = ARM_CP_STATE_AA32,
70
.cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
71
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
72
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
73
.access = PL2_RW, .accessfn = access_el3_aa32ns,
74
.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
75
- .writefn = vttbr_write },
76
+ .writefn = vttbr_write, .raw_writefn = raw_write },
77
{ .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
78
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
79
- .access = PL2_RW, .writefn = vttbr_write,
80
+ .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write,
81
.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
82
{ .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
83
.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
84
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
85
.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
86
{ .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
87
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
88
- .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write,
89
+ .access = PL2_RW, .resetvalue = 0,
90
+ .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write,
91
.fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
92
{ .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
93
.access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
94
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
95
{ .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
96
.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
97
.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
98
- .resetfn = scr_reset, .writefn = scr_write },
99
+ .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write },
100
{ .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
101
.cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
102
.access = PL1_RW, .accessfn = access_trap_aa32s_el1,
103
.fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
104
- .writefn = scr_write },
105
+ .writefn = scr_write, .raw_writefn = raw_write },
106
{ .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
107
.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
108
.access = PL3_RW, .resetvalue = 0,
109
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
110
{ .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
111
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
112
.access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
113
+ .raw_writefn = raw_write,
114
.fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) },
115
#ifndef CONFIG_USER_ONLY
116
{ .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64,
117
--
118
2.34.1
diff view generated by jsdifflib
New patch
[PULL 02/14] hw/arm/sbsa-ref: use XHCI to replace EHCI
1
From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
1
2
3
The current sbsa-ref cannot use EHCI controller which is only
4
able to do 32-bit DMA, since sbsa-ref doesn't have RAM below 4GB.
5
Hence, this uses XHCI to provide a usb controller with 64-bit
6
DMA capablity instead of EHCI.
7
8
We bump the platform version to 0.3 with this change. Although the
9
hardware at the USB controller address changes, the firmware and
10
Linux can both cope with this -- on an older non-XHCI-aware
11
firmware/kernel setup the probe routine simply fails and the guest
12
proceeds without any USB. (This isn't a loss of functionality,
13
because the old USB controller never worked in the first place.) So
14
we can call this a backwards-compatible change and only bump the
15
minor version.
16
17
Signed-off-by: Yuquan Wang <wangyuquan1236@phytium.com.cn>
18
Message-id: 20230621103847.447508-2-wangyuquan1236@phytium.com.cn
19
[PMM: tweaked commit message; add line to docs about what
20
changes in platform version 0.3]
21
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
---
24
docs/system/arm/sbsa.rst | 5 ++++-
25
hw/arm/sbsa-ref.c | 23 +++++++++++++----------
26
hw/arm/Kconfig | 2 +-
27
3 files changed, 18 insertions(+), 12 deletions(-)
28
29
diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
30
index XXXXXXX..XXXXXXX 100644
31
--- a/docs/system/arm/sbsa.rst
32
+++ b/docs/system/arm/sbsa.rst
33
@@ -XXX,XX +XXX,XX @@ The ``sbsa-ref`` board supports:
34
- A configurable number of AArch64 CPUs
35
- GIC version 3
36
- System bus AHCI controller
37
- - System bus EHCI controller
38
+ - System bus XHCI controller
39
- CDROM and hard disc on AHCI bus
40
- E1000E ethernet card on PCIe bus
41
- Bochs display adapter on PCIe bus
42
@@ -XXX,XX +XXX,XX @@ Platform version changes:
43
44
0.2
45
GIC ITS information is present in devicetree.
46
+
47
+0.3
48
+ The USB controller is an XHCI device, not EHCI
49
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/hw/arm/sbsa-ref.c
52
+++ b/hw/arm/sbsa-ref.c
53
@@ -XXX,XX +XXX,XX @@
54
#include "hw/pci-host/gpex.h"
55
#include "hw/qdev-properties.h"
56
#include "hw/usb.h"
57
+#include "hw/usb/xhci.h"
58
#include "hw/char/pl011.h"
59
#include "hw/watchdog/sbsa_gwdt.h"
60
#include "net/net.h"
61
@@ -XXX,XX +XXX,XX @@ enum {
62
SBSA_SECURE_UART_MM,
63
SBSA_SECURE_MEM,
64
SBSA_AHCI,
65
- SBSA_EHCI,
66
+ SBSA_XHCI,
67
};
68
69
struct SBSAMachineState {
70
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sbsa_ref_memmap[] = {
71
[SBSA_SMMU] = { 0x60050000, 0x00020000 },
72
/* Space here reserved for more SMMUs */
73
[SBSA_AHCI] = { 0x60100000, 0x00010000 },
74
- [SBSA_EHCI] = { 0x60110000, 0x00010000 },
75
+ [SBSA_XHCI] = { 0x60110000, 0x00010000 },
76
/* Space here reserved for other devices */
77
[SBSA_PCIE_PIO] = { 0x7fff0000, 0x00010000 },
78
/* 32-bit address PCIE MMIO space */
79
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
80
[SBSA_SECURE_UART] = 8,
81
[SBSA_SECURE_UART_MM] = 9,
82
[SBSA_AHCI] = 10,
83
- [SBSA_EHCI] = 11,
84
+ [SBSA_XHCI] = 11,
85
[SBSA_SMMU] = 12, /* ... to 15 */
86
[SBSA_GWDT_WS0] = 16,
87
};
88
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
89
* fw compatibility.
90
*/
91
qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
92
- qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
93
+ qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 3);
94
95
if (ms->numa_state->have_numa_distance) {
96
int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
97
@@ -XXX,XX +XXX,XX @@ static void create_ahci(const SBSAMachineState *sms)
98
}
99
}
100
101
-static void create_ehci(const SBSAMachineState *sms)
102
+static void create_xhci(const SBSAMachineState *sms)
103
{
104
- hwaddr base = sbsa_ref_memmap[SBSA_EHCI].base;
105
- int irq = sbsa_ref_irqmap[SBSA_EHCI];
106
+ hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
107
+ int irq = sbsa_ref_irqmap[SBSA_XHCI];
108
+ DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
109
110
- sysbus_create_simple("platform-ehci-usb", base,
111
- qdev_get_gpio_in(sms->gic, irq));
112
+ sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
113
+ sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
114
+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(sms->gic, irq));
115
}
116
117
static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
118
@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
119
120
create_ahci(sms);
121
122
- create_ehci(sms);
123
+ create_xhci(sms);
124
125
create_pcie(sms);
126
127
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
128
index XXXXXXX..XXXXXXX 100644
129
--- a/hw/arm/Kconfig
130
+++ b/hw/arm/Kconfig
131
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
132
select PL011 # UART
133
select PL031 # RTC
134
select PL061 # GPIO
135
- select USB_EHCI_SYSBUS
136
+ select USB_XHCI_SYSBUS
137
select WDT_SBSA
138
select BOCHS_DISPLAY
139
140
--
141
2.34.1
diff view generated by jsdifflib
New patch
[PULL 03/14] tests/tcg/aarch64/sysregs.c: Use S syntax for id_aa64zfr0_el1 and id_aa64smfr0_el1
1
Some assemblers will complain about attempts to access
2
id_aa64zfr0_el1 and id_aa64smfr0_el1 by name if the test
3
binary isn't built for the right processor type:
1
4
5
/tmp/ccASXpLo.s:782: Error: selected processor does not support system register name 'id_aa64zfr0_el1'
6
/tmp/ccASXpLo.s:829: Error: selected processor does not support system register name 'id_aa64smfr0_el1'
7
8
However, these registers are in the ID space and are guaranteed to
9
read-as-zero on older CPUs, so the access is both safe and sensible.
10
Switch to using the S syntax, as we already do for ID_AA64ISAR2_EL1
11
and ID_AA64MMFR2_EL1. This allows us to drop the HAS_ARMV9_SME check
12
and the makefile machinery to adjust the CFLAGS for this test, so we
13
don't rely on having a sufficiently new compiler to be able to check
14
these registers.
15
16
This means we're actually testing the SME ID register: no released
17
GCC yet recognizes -march=armv9-a+sme, so that was always skipped.
18
It also avoids a future problem if we try to switch the "do we have
19
SME support in the toolchain" check from "in the compiler" to "in the
20
assembler" (at which point we would otherwise run into the above
21
errors).
22
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
24
---
25
tests/tcg/aarch64/sysregs.c | 11 +++++++----
26
tests/tcg/aarch64/Makefile.target | 7 +------
27
2 files changed, 8 insertions(+), 10 deletions(-)
28
29
diff --git a/tests/tcg/aarch64/sysregs.c b/tests/tcg/aarch64/sysregs.c
30
index XXXXXXX..XXXXXXX 100644
31
--- a/tests/tcg/aarch64/sysregs.c
32
+++ b/tests/tcg/aarch64/sysregs.c
33
@@ -XXX,XX +XXX,XX @@
34
/*
35
* Older assemblers don't recognize newer system register names,
36
* but we can still access them by the Sn_n_Cn_Cn_n syntax.
37
+ * This also means we don't need to specifically request that the
38
+ * assembler enables whatever architectural features the ID registers
39
+ * syntax might be gated behind.
40
*/
41
#define SYS_ID_AA64ISAR2_EL1 S3_0_C0_C6_2
42
#define SYS_ID_AA64MMFR2_EL1 S3_0_C0_C7_2
43
+#define SYS_ID_AA64ZFR0_EL1 S3_0_C0_C4_4
44
+#define SYS_ID_AA64SMFR0_EL1 S3_0_C0_C4_5
45
46
int failed_bit_count;
47
48
@@ -XXX,XX +XXX,XX @@ int main(void)
49
/* all hidden, DebugVer fixed to 0x6 (ARMv8 debug architecture) */
50
get_cpu_reg_check_mask(id_aa64dfr0_el1, _m(0000,0000,0000,0006));
51
get_cpu_reg_check_zero(id_aa64dfr1_el1);
52
- get_cpu_reg_check_mask(id_aa64zfr0_el1, _m(0ff0,ff0f,00ff,00ff));
53
-#ifdef HAS_ARMV9_SME
54
- get_cpu_reg_check_mask(id_aa64smfr0_el1, _m(80f1,00fd,0000,0000));
55
-#endif
56
+ get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1, _m(0ff0,ff0f,00ff,00ff));
57
+ get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(80f1,00fd,0000,0000));
58
59
get_cpu_reg_check_zero(id_aa64afr0_el1);
60
get_cpu_reg_check_zero(id_aa64afr1_el1);
61
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
62
index XXXXXXX..XXXXXXX 100644
63
--- a/tests/tcg/aarch64/Makefile.target
64
+++ b/tests/tcg/aarch64/Makefile.target
65
@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
66
mte-%: CFLAGS += -march=armv8.5-a+memtag
67
endif
68
69
-ifneq ($(CROSS_CC_HAS_SVE),)
70
# System Registers Tests
71
AARCH64_TESTS += sysregs
72
-ifneq ($(CROSS_CC_HAS_ARMV9_SME),)
73
-sysregs: CFLAGS+=-march=armv9-a+sme -DHAS_ARMV9_SME
74
-else
75
-sysregs: CFLAGS+=-march=armv8.1-a+sve
76
-endif
77
78
+ifneq ($(CROSS_CC_HAS_SVE),)
79
# SVE ioctl test
80
AARCH64_TESTS += sve-ioctls
81
sve-ioctls: CFLAGS+=-march=armv8.1-a+sve
82
--
83
2.34.1
diff view generated by jsdifflib
New patch
[PULL 04/14] target/arm: Avoid splitting Zregs across lines in dump
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Allow the line length to extend to 548 columns. While annoyingly wide,
4
it's still less confusing than the continuations we print. Also, the
5
default VL used by Linux (and max for A64FX) uses only 140 columns.
6
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20230622151201.1578522-2-richard.henderson@linaro.org
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/cpu.c | 36 ++++++++++++++----------------------
13
1 file changed, 14 insertions(+), 22 deletions(-)
14
15
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/cpu.c
18
+++ b/target/arm/cpu.c
19
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
20
ARMCPU *cpu = ARM_CPU(cs);
21
CPUARMState *env = &cpu->env;
22
uint32_t psr = pstate_read(env);
23
- int i;
24
+ int i, j;
25
int el = arm_current_el(env);
26
const char *ns_status;
27
bool sve;
28
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
29
}
30
31
if (sve) {
32
- int j, zcr_len = sve_vqm1_for_el(env, el);
33
+ int zcr_len = sve_vqm1_for_el(env, el);
34
35
for (i = 0; i <= FFR_PRED_NUM; i++) {
36
bool eol;
37
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
38
}
39
}
40
41
- for (i = 0; i < 32; i++) {
42
- if (zcr_len == 0) {
43
+ if (zcr_len == 0) {
44
+ /*
45
+ * With vl=16, there are only 37 columns per register,
46
+ * so output two registers per line.
47
+ */
48
+ for (i = 0; i < 32; i++) {
49
qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64 "%s",
50
i, env->vfp.zregs[i].d[1],
51
env->vfp.zregs[i].d[0], i & 1 ? "\n" : " ");
52
- } else if (zcr_len == 1) {
53
- qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64
54
- ":%016" PRIx64 ":%016" PRIx64 "\n",
55
- i, env->vfp.zregs[i].d[3], env->vfp.zregs[i].d[2],
56
- env->vfp.zregs[i].d[1], env->vfp.zregs[i].d[0]);
57
- } else {
58
+ }
59
+ } else {
60
+ for (i = 0; i < 32; i++) {
61
+ qemu_fprintf(f, "Z%02d=", i);
62
for (j = zcr_len; j >= 0; j--) {
63
- bool odd = (zcr_len - j) % 2 != 0;
64
- if (j == zcr_len) {
65
- qemu_fprintf(f, "Z%02d[%x-%x]=", i, j, j - 1);
66
- } else if (!odd) {
67
- if (j > 0) {
68
- qemu_fprintf(f, " [%x-%x]=", j, j - 1);
69
- } else {
70
- qemu_fprintf(f, " [%x]=", j);
71
- }
72
- }
73
qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%s",
74
env->vfp.zregs[i].d[j * 2 + 1],
75
- env->vfp.zregs[i].d[j * 2],
76
- odd || j == 0 ? "\n" : ":");
77
+ env->vfp.zregs[i].d[j * 2 + 0],
78
+ j ? ":" : "\n");
79
}
80
}
81
}
82
--
83
2.34.1
diff view generated by jsdifflib
New patch
[PULL 05/14] target/arm: Dump ZA[] when active
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
Always print each matrix row whole, one per line, so that we
4
get the entire matrix in the proper shape.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20230622151201.1578522-3-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/cpu.c | 18 ++++++++++++++++++
12
1 file changed, 18 insertions(+)
13
14
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.c
17
+++ b/target/arm/cpu.c
18
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
19
i, q[1], q[0], (i & 1 ? "\n" : " "));
20
}
21
}
22
+
23
+ if (cpu_isar_feature(aa64_sme, cpu) &&
24
+ FIELD_EX64(env->svcr, SVCR, ZA) &&
25
+ sme_exception_el(env, el) == 0) {
26
+ int zcr_len = sve_vqm1_for_el_sm(env, el, true);
27
+ int svl = (zcr_len + 1) * 16;
28
+ int svl_lg10 = svl < 100 ? 2 : 3;
29
+
30
+ for (i = 0; i < svl; i++) {
31
+ qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);
32
+ for (j = zcr_len; j >= 0; --j) {
33
+ qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",
34
+ env->zarray[i].d[2 * j + 1],
35
+ env->zarray[i].d[2 * j],
36
+ j ? ':' : '\n');
37
+ }
38
+ }
39
+ }
40
}
41
42
#else
43
--
44
2.34.1
diff view generated by jsdifflib
New patch
[PULL 06/14] target/arm: Fix SME full tile indexing
1
From: Richard Henderson <richard.henderson@linaro.org>
1
2
3
For the outer product set of insns, which take an entire matrix
4
tile as output, the argument is not a combined tile+column.
5
Therefore using get_tile_rowcol was incorrect, as we extracted
6
the tile number from itself.
7
8
The test case relies only on assembler support for SME, since
9
no release of GCC recognizes -march=armv9-a+sme yet.
10
11
Cc: qemu-stable@nongnu.org
12
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1620
13
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 20230622151201.1578522-5-richard.henderson@linaro.org
15
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
16
[PMM: dropped now-unneeded changes to sysregs CFLAGS]
17
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
18
---
19
target/arm/tcg/translate-sme.c | 24 ++++++---
20
tests/tcg/aarch64/sme-outprod1.c | 83 +++++++++++++++++++++++++++++++
21
tests/tcg/aarch64/Makefile.target | 7 ++-
22
3 files changed, 107 insertions(+), 7 deletions(-)
23
create mode 100644 tests/tcg/aarch64/sme-outprod1.c
24
25
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
26
index XXXXXXX..XXXXXXX 100644
27
--- a/target/arm/tcg/translate-sme.c
28
+++ b/target/arm/tcg/translate-sme.c
29
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
30
return addr;
31
}
32
33
+/*
34
+ * Resolve tile.size[0] to a host pointer.
35
+ * Used by e.g. outer product insns where we require the entire tile.
36
+ */
37
+static TCGv_ptr get_tile(DisasContext *s, int esz, int tile)
38
+{
39
+ TCGv_ptr addr = tcg_temp_new_ptr();
40
+ int offset;
41
+
42
+ offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, zarray);
43
+
44
+ tcg_gen_addi_ptr(addr, cpu_env, offset);
45
+ return addr;
46
+}
47
+
48
static bool trans_ZERO(DisasContext *s, arg_ZERO *a)
49
{
50
if (!dc_isar_feature(aa64_sme, s)) {
51
@@ -XXX,XX +XXX,XX @@ static bool do_adda(DisasContext *s, arg_adda *a, MemOp esz,
52
return true;
53
}
54
55
- /* Sum XZR+zad to find ZAd. */
56
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
57
+ za = get_tile(s, esz, a->zad);
58
zn = vec_full_reg_ptr(s, a->zn);
59
pn = pred_full_reg_ptr(s, a->pn);
60
pm = pred_full_reg_ptr(s, a->pm);
61
@@ -XXX,XX +XXX,XX @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz,
62
return true;
63
}
64
65
- /* Sum XZR+zad to find ZAd. */
66
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
67
+ za = get_tile(s, esz, a->zad);
68
zn = vec_full_reg_ptr(s, a->zn);
69
zm = vec_full_reg_ptr(s, a->zm);
70
pn = pred_full_reg_ptr(s, a->pn);
71
@@ -XXX,XX +XXX,XX @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
72
return true;
73
}
74
75
- /* Sum XZR+zad to find ZAd. */
76
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
77
+ za = get_tile(s, esz, a->zad);
78
zn = vec_full_reg_ptr(s, a->zn);
79
zm = vec_full_reg_ptr(s, a->zm);
80
pn = pred_full_reg_ptr(s, a->pn);
81
diff --git a/tests/tcg/aarch64/sme-outprod1.c b/tests/tcg/aarch64/sme-outprod1.c
82
new file mode 100644
83
index XXXXXXX..XXXXXXX
84
--- /dev/null
85
+++ b/tests/tcg/aarch64/sme-outprod1.c
86
@@ -XXX,XX +XXX,XX @@
87
+/*
88
+ * SME outer product, 1 x 1.
89
+ * SPDX-License-Identifier: GPL-2.0-or-later
90
+ */
91
+
92
+#include <stdio.h>
93
+
94
+extern void foo(float *dst);
95
+
96
+asm(
97
+"    .arch_extension sme\n"
98
+"    .type foo, @function\n"
99
+"foo:\n"
100
+"    stp x29, x30, [sp, -80]!\n"
101
+"    mov x29, sp\n"
102
+"    stp d8, d9, [sp, 16]\n"
103
+"    stp d10, d11, [sp, 32]\n"
104
+"    stp d12, d13, [sp, 48]\n"
105
+"    stp d14, d15, [sp, 64]\n"
106
+"    smstart\n"
107
+"    ptrue p0.s, vl4\n"
108
+"    fmov z0.s, #1.0\n"
109
+/*
110
+ * An outer product of a vector of 1.0 by itself should be a matrix of 1.0.
111
+ * Note that we are using tile 1 here (za1.s) rather than tile 0.
112
+ */
113
+"    zero {za}\n"
114
+"    fmopa za1.s, p0/m, p0/m, z0.s, z0.s\n"
115
+/*
116
+ * Read the first 4x4 sub-matrix of elements from tile 1:
117
+ * Note that za1h should be interchangable here.
118
+ */
119
+"    mov w12, #0\n"
120
+"    mova z0.s, p0/m, za1v.s[w12, #0]\n"
121
+"    mova z1.s, p0/m, za1v.s[w12, #1]\n"
122
+"    mova z2.s, p0/m, za1v.s[w12, #2]\n"
123
+"    mova z3.s, p0/m, za1v.s[w12, #3]\n"
124
+/*
125
+ * And store them to the input pointer (dst in the C code):
126
+ */
127
+"    st1w {z0.s}, p0, [x0]\n"
128
+"    add x0, x0, #16\n"
129
+"    st1w {z1.s}, p0, [x0]\n"
130
+"    add x0, x0, #16\n"
131
+"    st1w {z2.s}, p0, [x0]\n"
132
+"    add x0, x0, #16\n"
133
+"    st1w {z3.s}, p0, [x0]\n"
134
+"    smstop\n"
135
+"    ldp d8, d9, [sp, 16]\n"
136
+"    ldp d10, d11, [sp, 32]\n"
137
+"    ldp d12, d13, [sp, 48]\n"
138
+"    ldp d14, d15, [sp, 64]\n"
139
+"    ldp x29, x30, [sp], 80\n"
140
+"    ret\n"
141
+"    .size foo, . - foo"
142
+);
143
+
144
+int main()
145
+{
146
+ float dst[16];
147
+ int i, j;
148
+
149
+ foo(dst);
150
+
151
+ for (i = 0; i < 16; i++) {
152
+ if (dst[i] != 1.0f) {
153
+ break;
154
+ }
155
+ }
156
+
157
+ if (i == 16) {
158
+ return 0; /* success */
159
+ }
160
+
161
+ /* failure */
162
+ for (i = 0; i < 4; ++i) {
163
+ for (j = 0; j < 4; ++j) {
164
+ printf("%f ", (double)dst[i * 4 + j]);
165
+ }
166
+ printf("\n");
167
+ }
168
+ return 1;
169
+}
170
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
171
index XXXXXXX..XXXXXXX 100644
172
--- a/tests/tcg/aarch64/Makefile.target
173
+++ b/tests/tcg/aarch64/Makefile.target
174
@@ -XXX,XX +XXX,XX @@ config-cc.mak: Makefile
175
     $(call cc-option,-march=armv8.5-a, CROSS_CC_HAS_ARMV8_5); \
176
     $(call cc-option,-mbranch-protection=standard, CROSS_CC_HAS_ARMV8_BTI); \
177
     $(call cc-option,-march=armv8.5-a+memtag, CROSS_CC_HAS_ARMV8_MTE); \
178
-     $(call cc-option,-march=armv9-a+sme, CROSS_CC_HAS_ARMV9_SME)) 3> config-cc.mak
179
+     $(call cc-option,-Wa$(COMMA)-march=armv9-a+sme, CROSS_AS_HAS_ARMV9_SME)) 3> config-cc.mak
180
-include config-cc.mak
181
182
ifneq ($(CROSS_CC_HAS_ARMV8_2),)
183
@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
184
mte-%: CFLAGS += -march=armv8.5-a+memtag
185
endif
186
187
+# SME Tests
188
+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
189
+AARCH64_TESTS += sme-outprod1
190
+endif
191
+
192
# System Registers Tests
193
AARCH64_TESTS += sysregs
194
195
--
196
2.34.1
diff view generated by jsdifflib
New patch
[PULL 07/14] target/arm: Handle IC IVAU to improve compatibility with JITs
1
From: John Högberg <john.hogberg@ericsson.com>
1
2
3
Unlike architectures with precise self-modifying code semantics
4
(e.g. x86) ARM processors do not maintain coherency for instruction
5
execution and memory, requiring an instruction synchronization
6
barrier on every core that will execute the new code, and on many
7
models also the explicit use of cache management instructions.
8
9
While this is required to make JITs work on actual hardware, QEMU
10
has gotten away with not handling this since it does not emulate
11
caches, and unconditionally invalidates code whenever the softmmu
12
or the user-mode page protection logic detects that code has been
13
modified.
14
15
Unfortunately the latter does not work in the face of dual-mapped
16
code (a common W^X workaround), where one page is executable and
17
the other is writable: user-mode has no way to connect one with the
18
other as that is only known to the kernel and the emulated
19
application.
20
21
This commit works around the issue by telling software that
22
instruction cache invalidation is required by clearing the
23
CPR_EL0.DIC flag (regardless of whether the emulated processor
24
needs it), and then invalidating code in IC IVAU instructions.
25
26
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1034
27
28
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
29
Signed-off-by: John Högberg <john.hogberg@ericsson.com>
30
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
31
Message-id: 168778890374.24232.3402138851538068785-1@git.sr.ht
32
[PMM: removed unnecessary AArch64 feature check; moved
33
"clear CTR_EL1.DIC" code up a bit so it's not in the middle
34
of the vfp/neon related tests]
35
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
36
---
37
target/arm/cpu.c | 11 +++++++++++
38
target/arm/helper.c | 47 ++++++++++++++++++++++++++++++++++++++++++---
39
2 files changed, 55 insertions(+), 3 deletions(-)
40
41
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
42
index XXXXXXX..XXXXXXX 100644
43
--- a/target/arm/cpu.c
44
+++ b/target/arm/cpu.c
45
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
46
return;
47
}
48
49
+#ifdef CONFIG_USER_ONLY
50
+ /*
51
+ * User mode relies on IC IVAU instructions to catch modification of
52
+ * dual-mapped code.
53
+ *
54
+ * Clear CTR_EL0.DIC to ensure that software that honors these flags uses
55
+ * IC IVAU even if the emulated processor does not normally require it.
56
+ */
57
+ cpu->ctr = FIELD_DP64(cpu->ctr, CTR_EL0, DIC, 0);
58
+#endif
59
+
60
if (arm_feature(env, ARM_FEATURE_AARCH64) &&
61
cpu->has_vfp != cpu->has_neon) {
62
/*
63
diff --git a/target/arm/helper.c b/target/arm/helper.c
64
index XXXXXXX..XXXXXXX 100644
65
--- a/target/arm/helper.c
66
+++ b/target/arm/helper.c
67
@@ -XXX,XX +XXX,XX @@ static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
68
}
69
}
70
71
+#ifdef CONFIG_USER_ONLY
72
+/*
73
+ * `IC IVAU` is handled to improve compatibility with JITs that dual-map their
74
+ * code to get around W^X restrictions, where one region is writable and the
75
+ * other is executable.
76
+ *
77
+ * Since the executable region is never written to we cannot detect code
78
+ * changes when running in user mode, and rely on the emulated JIT telling us
79
+ * that the code has changed by executing this instruction.
80
+ */
81
+static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri,
82
+ uint64_t value)
83
+{
84
+ uint64_t icache_line_mask, start_address, end_address;
85
+ const ARMCPU *cpu;
86
+
87
+ cpu = env_archcpu(env);
88
+
89
+ icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1;
90
+ start_address = value & ~icache_line_mask;
91
+ end_address = value | icache_line_mask;
92
+
93
+ mmap_lock();
94
+
95
+ tb_invalidate_phys_range(start_address, end_address);
96
+
97
+ mmap_unlock();
98
+}
99
+#endif
100
+
101
static const ARMCPRegInfo v8_cp_reginfo[] = {
102
/*
103
* Minimal set of EL0-visible registers. This will need to be expanded
104
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
105
{ .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
106
.opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
107
.access = PL1_R, .type = ARM_CP_CURRENTEL },
108
- /* Cache ops: all NOPs since we don't emulate caches */
109
+ /*
110
+ * Instruction cache ops. All of these except `IC IVAU` NOP because we
111
+ * don't emulate caches.
112
+ */
113
{ .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
114
.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
115
.access = PL1_W, .type = ARM_CP_NOP,
116
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
117
.accessfn = access_tocu },
118
{ .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
119
.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
120
- .access = PL0_W, .type = ARM_CP_NOP,
121
+ .access = PL0_W,
122
.fgt = FGT_ICIVAU,
123
- .accessfn = access_tocu },
124
+ .accessfn = access_tocu,
125
+#ifdef CONFIG_USER_ONLY
126
+ .type = ARM_CP_NO_RAW,
127
+ .writefn = ic_ivau_write
128
+#else
129
+ .type = ARM_CP_NOP
130
+#endif
131
+ },
132
+ /* Cache ops: all NOPs since we don't emulate caches */
133
{ .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
134
.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
135
.access = PL1_W, .accessfn = aa64_cacheop_poc_access,
136
--
137
2.34.1
138
139
diff view generated by jsdifflib
New patch
[PULL 08/14] tests/qtest: xlnx-canfd-test: Fix code coverity issues
1
From: Vikram Garhwal <vikram.garhwal@amd.com>
1
2
3
Following are done to fix the coverity issues:
4
1. Change read_data to fix the CID 1512899: Out-of-bounds access (OVERRUN)
5
2. Fix match_rx_tx_data to fix CID 1512900: Logically dead code (DEADCODE)
6
3. Replace rand() in generate_random_data() with g_rand_int()
7
8
Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com>
9
Message-id: 20230628202758.16398-1-vikram.garhwal@amd.com
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
tests/qtest/xlnx-canfd-test.c | 33 +++++++++++----------------------
14
1 file changed, 11 insertions(+), 22 deletions(-)
15
16
diff --git a/tests/qtest/xlnx-canfd-test.c b/tests/qtest/xlnx-canfd-test.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/tests/qtest/xlnx-canfd-test.c
19
+++ b/tests/qtest/xlnx-canfd-test.c
20
@@ -XXX,XX +XXX,XX @@ static void generate_random_data(uint32_t *buf_tx, bool is_canfd_frame)
21
/* Generate random TX data for CANFD frame. */
22
if (is_canfd_frame) {
23
for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
24
- buf_tx[2 + i] = rand();
25
+ buf_tx[2 + i] = g_random_int();
26
}
27
} else {
28
/* Generate random TX data for CAN frame. */
29
for (int i = 0; i < CAN_FRAME_SIZE - 2; i++) {
30
- buf_tx[2 + i] = rand();
31
+ buf_tx[2 + i] = g_random_int();
32
}
33
}
34
}
35
36
-static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
37
+static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx,
38
+ uint32_t frame_size)
39
{
40
uint32_t int_status;
41
uint32_t fifo_status_reg_value;
42
/* At which RX FIFO the received data is stored. */
43
uint8_t store_ind = 0;
44
- bool is_canfd_frame = false;
45
46
/* Read the interrupt on CANFD rx. */
47
int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_RXOK;
48
@@ -XXX,XX +XXX,XX @@ static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
49
buf_rx[0] = qtest_readl(qts, can_base_addr + R_RX0_ID_OFFSET);
50
buf_rx[1] = qtest_readl(qts, can_base_addr + R_RX0_DLC_OFFSET);
51
52
- is_canfd_frame = (buf_rx[1] >> DLC_FD_BIT_SHIFT) & 1;
53
-
54
- if (is_canfd_frame) {
55
- for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
56
- buf_rx[i + 2] = qtest_readl(qts,
57
- can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
58
- }
59
- } else {
60
- buf_rx[2] = qtest_readl(qts, can_base_addr + R_RX0_DATA1_OFFSET);
61
- buf_rx[3] = qtest_readl(qts, can_base_addr + R_RX0_DATA2_OFFSET);
62
+ for (int i = 0; i < frame_size - 2; i++) {
63
+ buf_rx[i + 2] = qtest_readl(qts,
64
+ can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
65
}
66
67
/* Clear the RX interrupt. */
68
@@ -XXX,XX +XXX,XX @@ static void match_rx_tx_data(const uint32_t *buf_tx, const uint32_t *buf_rx,
69
g_assert_cmpint((buf_rx[size] & DLC_FD_BIT_MASK), ==,
70
(buf_tx[size] & DLC_FD_BIT_MASK));
71
} else {
72
- if (!is_canfd_frame && size == 4) {
73
- break;
74
- }
75
-
76
g_assert_cmpint(buf_rx[size], ==, buf_tx[size]);
77
}
78
79
@@ -XXX,XX +XXX,XX @@ static void test_can_data_transfer(void)
80
write_data(qts, CANFD0_BASE_ADDR, buf_tx, false);
81
82
send_data(qts, CANFD0_BASE_ADDR);
83
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
84
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CAN_FRAME_SIZE);
85
match_rx_tx_data(buf_tx, buf_rx, false);
86
87
qtest_quit(qts);
88
@@ -XXX,XX +XXX,XX @@ static void test_canfd_data_transfer(void)
89
write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
90
91
send_data(qts, CANFD0_BASE_ADDR);
92
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
93
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
94
match_rx_tx_data(buf_tx, buf_rx, true);
95
96
qtest_quit(qts);
97
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
98
write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
99
100
send_data(qts, CANFD0_BASE_ADDR);
101
- read_data(qts, CANFD0_BASE_ADDR, buf_rx);
102
+ read_data(qts, CANFD0_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
103
match_rx_tx_data(buf_tx, buf_rx, true);
104
105
generate_random_data(buf_tx, true);
106
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
107
write_data(qts, CANFD1_BASE_ADDR, buf_tx, true);
108
109
send_data(qts, CANFD1_BASE_ADDR);
110
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
111
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
112
match_rx_tx_data(buf_tx, buf_rx, true);
113
114
qtest_quit(qts);
115
--
116
2.34.1
diff view generated by jsdifflib
[PULL 2/2] docs/system/devices/can.rst: correct links to CTU CAN FD IP core documentation.
[PULL 09/14] target/arm: gdbstub: Guard M-profile code with CONFIG_TCG
1
From: Pavel Pisa <pisa@cmp.felk.cvut.cz>
1
From: Fabiano Rosas <farosas@suse.de>
2
2
3
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
3
This code is only relevant when TCG is present in the build. Building
4
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
4
with --disable-tcg --enable-xen on an x86 host we get:
5
Message-id: 20220402204523.32643-1-pisa@cmp.felk.cvut.cz
5
6
$ ../configure --target-list=x86_64-softmmu,aarch64-softmmu --disable-tcg --enable-xen
7
$ make -j$(nproc)
8
...
9
libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `m_sysreg_ptr':
10
../target/arm/gdbstub.c:358: undefined reference to `arm_v7m_get_sp_ptr'
11
../target/arm/gdbstub.c:361: undefined reference to `arm_v7m_get_sp_ptr'
12
13
libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `arm_gdb_get_m_systemreg':
14
../target/arm/gdbstub.c:405: undefined reference to `arm_v7m_mrs_control'
15
16
Signed-off-by: Fabiano Rosas <farosas@suse.de>
17
Message-id: 20230628164821.16771-1-farosas@suse.de
18
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
6
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
7
---
20
---
8
docs/system/devices/can.rst | 6 +++---
21
target/arm/gdbstub.c | 4 ++++
9
1 file changed, 3 insertions(+), 3 deletions(-)
22
1 file changed, 4 insertions(+)
10
23
11
diff --git a/docs/system/devices/can.rst b/docs/system/devices/can.rst
24
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
12
index XXXXXXX..XXXXXXX 100644
25
index XXXXXXX..XXXXXXX 100644
13
--- a/docs/system/devices/can.rst
26
--- a/target/arm/gdbstub.c
14
+++ b/docs/system/devices/can.rst
27
+++ b/target/arm/gdbstub.c
15
@@ -XXX,XX +XXX,XX @@ Links to other resources
28
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
16
(5) `GNU/Linux, CAN and CANopen in Real-time Control Applications Slides from LinuxDays 2017 (include updated RTLWS 2015 content) <https://www.linuxdays.cz/2017/video/Pavel_Pisa-CAN_canopen.pdf>`_
29
return cpu->dyn_sysreg_xml.num;
17
(6) `Linux SocketCAN utilities <https://github.com/linux-can/can-utils>`_
30
}
18
(7) `CTU CAN FD project including core VHDL design, Linux driver, test utilities etc. <https://gitlab.fel.cvut.cz/canbus/ctucanfd_ip_core>`_
31
19
- (8) `CTU CAN FD Core Datasheet Documentation <http://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/Progdokum.pdf>`_
32
+#ifdef CONFIG_TCG
20
- (9) `CTU CAN FD Core System Architecture Documentation <http://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/ctu_can_fd_architecture.pdf>`_
33
typedef enum {
21
- (10) `CTU CAN FD Driver Documentation <http://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/driver_doc/ctucanfd-driver.html>`_
34
M_SYSREG_MSP,
22
+ (8) `CTU CAN FD Core Datasheet Documentation <http://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/doc/Datasheet.pdf>`_
35
M_SYSREG_PSP,
23
+ (9) `CTU CAN FD Core System Architecture Documentation <http://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/doc/System_Architecture.pdf>`_
36
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
24
+ (10) `CTU CAN FD Driver Documentation <https://canbus.pages.fel.cvut.cz/ctucanfd_ip_core/doc/linux_driver/build/ctucanfd-driver.html>`_
37
return cpu->dyn_m_secextreg_xml.num;
25
(11) `Integration with PCIe interfacing for Intel/Altera Cyclone IV based board <https://gitlab.fel.cvut.cz/canbus/pcie-ctu_can_fd>`_
38
}
39
#endif
40
+#endif /* CONFIG_TCG */
41
42
const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
43
{
44
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
45
arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
46
"system-registers.xml", 0);
47
48
+#ifdef CONFIG_TCG
49
if (arm_feature(env, ARM_FEATURE_M) && tcg_enabled()) {
50
gdb_register_coprocessor(cs,
51
arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
52
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
53
}
54
#endif
55
}
56
+#endif /* CONFIG_TCG */
57
}
26
--
58
--
27
2.25.1
59
2.34.1
diff view generated by jsdifflib
[PULL 1/2] xlnx-bbram: hw/nvram: Fix uninitialized Error *
[PULL 10/14] hw: arm: allwinner-sramc: Set class_size
1
From: Tong Ho <tong.ho@xilinx.com>
1
From: Akihiko Odaki <akihiko.odaki@daynix.com>
2
2
3
This adds required initialization of Error * variable.
3
AwSRAMCClass is larger than SysBusDeviceClass so the class size must be
4
advertised accordingly.
4
5
5
Signed-off-by: Tong Ho <tong.ho@xilinx.com>
6
Fixes: 05def917e1 ("hw: arm: allwinner-sramc: Add SRAM Controller support for R40")
6
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
7
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230628110905.38125-1-akihiko.odaki@daynix.com
7
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
8
---
12
---
9
hw/nvram/xlnx-bbram.c | 2 +-
13
hw/misc/allwinner-sramc.c | 1 +
10
1 file changed, 1 insertion(+), 1 deletion(-)
14
1 file changed, 1 insertion(+)
11
15
12
diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
16
diff --git a/hw/misc/allwinner-sramc.c b/hw/misc/allwinner-sramc.c
13
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
14
--- a/hw/nvram/xlnx-bbram.c
18
--- a/hw/misc/allwinner-sramc.c
15
+++ b/hw/nvram/xlnx-bbram.c
19
+++ b/hw/misc/allwinner-sramc.c
16
@@ -XXX,XX +XXX,XX @@ static bool bbram_pgm_enabled(XlnxBBRam *s)
20
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_sramc_info = {
17
21
.parent = TYPE_SYS_BUS_DEVICE,
18
static void bbram_bdrv_error(XlnxBBRam *s, int rc, gchar *detail)
22
.instance_init = allwinner_sramc_init,
19
{
23
.instance_size = sizeof(AwSRAMCState),
20
- Error *errp;
24
+ .class_size = sizeof(AwSRAMCClass),
21
+ Error *errp = NULL;
25
.class_init = allwinner_sramc_class_init,
22
26
};
23
error_setg_errno(&errp, -rc, "%s: BBRAM backstore %s failed.",
27
24
blk_name(s->blk), detail);
25
--
28
--
26
2.25.1
29
2.34.1
30
31
diff view generated by jsdifflib
New patch
[PULL 11/14] target/xtensa: Assert that interrupt level is within bounds
1
In handle_interrupt() we use level as an index into the interrupt_vector[]
2
array. This is safe because we have checked it against env->config->nlevel,
3
but Coverity can't see that (and it is only true because each CPU config
4
sets its XCHAL_NUM_INTLEVELS to something less than MAX_NLEVELS), so it
5
complains about a possible array overrun (CID 1507131)
1
6
7
Add an assert() which will make Coverity happy and catch the unlikely
8
case of a mis-set XCHAL_NUM_INTLEVELS in future.
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
12
Message-id: 20230623154135.1930261-1-peter.maydell@linaro.org
13
---
14
target/xtensa/exc_helper.c | 3 +++
15
1 file changed, 3 insertions(+)
16
17
diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/xtensa/exc_helper.c
20
+++ b/target/xtensa/exc_helper.c
21
@@ -XXX,XX +XXX,XX @@ static void handle_interrupt(CPUXtensaState *env)
22
CPUState *cs = env_cpu(env);
23
24
if (level > 1) {
25
+ /* env->config->nlevel check should have ensured this */
26
+ assert(level < sizeof(env->config->interrupt_vector));
27
+
28
env->sregs[EPC1 + level - 1] = env->pc;
29
env->sregs[EPS2 + level - 2] = env->sregs[PS];
30
env->sregs[PS] =
31
--
32
2.34.1
diff view generated by jsdifflib
New patch
[PULL 12/14] target/arm: Suppress more TCG unimplemented features in ID registers
1
We already squash the ID register field for FEAT_SPE (the Statistical
2
Profiling Extension) because TCG does not implement it and if we
3
advertise it to the guest the guest will crash trying to look at
4
non-existent system registers. Do the same for some other features
5
which a real hardware Neoverse-V1 implements but which TCG doesn't:
6
* FEAT_TRF (Self-hosted Trace Extension)
7
* Trace Macrocell system register access
8
* Memory mapped trace
9
* FEAT_AMU (Activity Monitors Extension)
10
* FEAT_MPAM (Memory Partitioning and Monitoring Extension)
11
* FEAT_NV (Nested Virtualization)
1
12
13
Most of these, like FEAT_SPE, are "introspection/trace" type features
14
which QEMU is unlikely to ever implement. The odd-one-out here is
15
FEAT_NV -- we could implement that and at some point we probably
16
will.
17
18
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
19
Message-id: 20230704130647.2842917-2-peter.maydell@linaro.org
20
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
21
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
22
---
23
target/arm/cpu.c | 33 +++++++++++++++++++++++++++++----
24
1 file changed, 29 insertions(+), 4 deletions(-)
25
26
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
27
index XXXXXXX..XXXXXXX 100644
28
--- a/target/arm/cpu.c
29
+++ b/target/arm/cpu.c
30
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
31
32
if (tcg_enabled()) {
33
/*
34
- * Don't report the Statistical Profiling Extension in the ID
35
- * registers, because TCG doesn't implement it yet (not even a
36
- * minimal stub version) and guests will fall over when they
37
- * try to access the non-existent system registers for it.
38
+ * Don't report some architectural features in the ID registers
39
+ * where TCG does not yet implement it (not even a minimal
40
+ * stub version). This avoids guests falling over when they
41
+ * try to access the non-existent system registers for them.
42
*/
43
+ /* FEAT_SPE (Statistical Profiling Extension) */
44
cpu->isar.id_aa64dfr0 =
45
FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
46
+ /* FEAT_TRF (Self-hosted Trace Extension) */
47
+ cpu->isar.id_aa64dfr0 =
48
+ FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEFILT, 0);
49
+ cpu->isar.id_dfr0 =
50
+ FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, TRACEFILT, 0);
51
+ /* Trace Macrocell system register access */
52
+ cpu->isar.id_aa64dfr0 =
53
+ FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEVER, 0);
54
+ cpu->isar.id_dfr0 =
55
+ FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPTRC, 0);
56
+ /* Memory mapped trace */
57
+ cpu->isar.id_dfr0 =
58
+ FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
59
+ /* FEAT_AMU (Activity Monitors Extension) */
60
+ cpu->isar.id_aa64pfr0 =
61
+ FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, AMU, 0);
62
+ cpu->isar.id_pfr0 =
63
+ FIELD_DP32(cpu->isar.id_pfr0, ID_PFR0, AMU, 0);
64
+ /* FEAT_MPAM (Memory Partitioning and Monitoring Extension) */
65
+ cpu->isar.id_aa64pfr0 =
66
+ FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, MPAM, 0);
67
+ /* FEAT_NV (Nested Virtualization) */
68
+ cpu->isar.id_aa64mmfr2 =
69
+ FIELD_DP64(cpu->isar.id_aa64mmfr2, ID_AA64MMFR2, NV, 0);
70
}
71
72
/* MPU can be configured out of a PMSA CPU either by setting has-mpu
73
--
74
2.34.1
75
76
diff view generated by jsdifflib
New patch
[PULL 13/14] target/arm: Define neoverse-v1
1
1
Now that we have implemented support for FEAT_LSE2, we can define
2
a CPU model for the Neoverse-V1, and enable it for the virt and
3
sbsa-ref boards.
4
5
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
6
Message-id: 20230704130647.2842917-3-peter.maydell@linaro.org
7
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
8
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
9
---
10
docs/system/arm/virt.rst | 1 +
11
hw/arm/sbsa-ref.c | 1 +
12
hw/arm/virt.c | 1 +
13
target/arm/tcg/cpu64.c | 128 +++++++++++++++++++++++++++++++++++++++
14
4 files changed, 131 insertions(+)
15
16
diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
17
index XXXXXXX..XXXXXXX 100644
18
--- a/docs/system/arm/virt.rst
19
+++ b/docs/system/arm/virt.rst
20
@@ -XXX,XX +XXX,XX @@ Supported guest CPU types:
21
- ``a64fx`` (64-bit)
22
- ``host`` (with KVM only)
23
- ``neoverse-n1`` (64-bit)
24
+- ``neoverse-v1`` (64-bit)
25
- ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
26
27
Note that the default is ``cortex-a15``, so for an AArch64 guest you must
28
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
29
index XXXXXXX..XXXXXXX 100644
30
--- a/hw/arm/sbsa-ref.c
31
+++ b/hw/arm/sbsa-ref.c
32
@@ -XXX,XX +XXX,XX @@ static const char * const valid_cpus[] = {
33
ARM_CPU_TYPE_NAME("cortex-a57"),
34
ARM_CPU_TYPE_NAME("cortex-a72"),
35
ARM_CPU_TYPE_NAME("neoverse-n1"),
36
+ ARM_CPU_TYPE_NAME("neoverse-v1"),
37
ARM_CPU_TYPE_NAME("max"),
38
};
39
40
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
41
index XXXXXXX..XXXXXXX 100644
42
--- a/hw/arm/virt.c
43
+++ b/hw/arm/virt.c
44
@@ -XXX,XX +XXX,XX @@ static const char *valid_cpus[] = {
45
ARM_CPU_TYPE_NAME("cortex-a76"),
46
ARM_CPU_TYPE_NAME("a64fx"),
47
ARM_CPU_TYPE_NAME("neoverse-n1"),
48
+ ARM_CPU_TYPE_NAME("neoverse-v1"),
49
#endif
50
ARM_CPU_TYPE_NAME("cortex-a53"),
51
ARM_CPU_TYPE_NAME("cortex-a57"),
52
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
53
index XXXXXXX..XXXXXXX 100644
54
--- a/target/arm/tcg/cpu64.c
55
+++ b/target/arm/tcg/cpu64.c
56
@@ -XXX,XX +XXX,XX @@ static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
57
define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
58
}
59
60
+static const ARMCPRegInfo neoverse_v1_cp_reginfo[] = {
61
+ { .name = "CPUECTLR2_EL1", .state = ARM_CP_STATE_AA64,
62
+ .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 5,
63
+ .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
64
+ { .name = "CPUPPMCR_EL3", .state = ARM_CP_STATE_AA64,
65
+ .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 0,
66
+ .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
67
+ { .name = "CPUPPMCR2_EL3", .state = ARM_CP_STATE_AA64,
68
+ .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 1,
69
+ .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
70
+ { .name = "CPUPPMCR3_EL3", .state = ARM_CP_STATE_AA64,
71
+ .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 6,
72
+ .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
73
+};
74
+
75
+static void define_neoverse_v1_cp_reginfo(ARMCPU *cpu)
76
+{
77
+ /*
78
+ * The Neoverse V1 has all of the Neoverse N1's IMPDEF
79
+ * registers and a few more of its own.
80
+ */
81
+ define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
82
+ define_arm_cp_regs(cpu, neoverse_v1_cp_reginfo);
83
+}
84
+
85
static void aarch64_neoverse_n1_initfn(Object *obj)
86
{
87
ARMCPU *cpu = ARM_CPU(obj);
88
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
89
define_neoverse_n1_cp_reginfo(cpu);
90
}
91
92
+static void aarch64_neoverse_v1_initfn(Object *obj)
93
+{
94
+ ARMCPU *cpu = ARM_CPU(obj);
95
+
96
+ cpu->dtb_compatible = "arm,neoverse-v1";
97
+ set_feature(&cpu->env, ARM_FEATURE_V8);
98
+ set_feature(&cpu->env, ARM_FEATURE_NEON);
99
+ set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
100
+ set_feature(&cpu->env, ARM_FEATURE_AARCH64);
101
+ set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
102
+ set_feature(&cpu->env, ARM_FEATURE_EL2);
103
+ set_feature(&cpu->env, ARM_FEATURE_EL3);
104
+ set_feature(&cpu->env, ARM_FEATURE_PMU);
105
+
106
+ /* Ordered by 3.2.4 AArch64 registers by functional group */
107
+ cpu->clidr = 0x82000023;
108
+ cpu->ctr = 0xb444c004; /* With DIC and IDC set */
109
+ cpu->dcz_blocksize = 4;
110
+ cpu->id_aa64afr0 = 0x00000000;
111
+ cpu->id_aa64afr1 = 0x00000000;
112
+ cpu->isar.id_aa64dfr0 = 0x000001f210305519ull;
113
+ cpu->isar.id_aa64dfr1 = 0x00000000;
114
+ cpu->isar.id_aa64isar0 = 0x1011111110212120ull; /* with FEAT_RNG */
115
+ cpu->isar.id_aa64isar1 = 0x0111000001211032ull;
116
+ cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
117
+ cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
118
+ cpu->isar.id_aa64mmfr2 = 0x0220011102101011ull;
119
+ cpu->isar.id_aa64pfr0 = 0x1101110120111112ull; /* GIC filled in later */
120
+ cpu->isar.id_aa64pfr1 = 0x0000000000000020ull;
121
+ cpu->id_afr0 = 0x00000000;
122
+ cpu->isar.id_dfr0 = 0x15011099;
123
+ cpu->isar.id_isar0 = 0x02101110;
124
+ cpu->isar.id_isar1 = 0x13112111;
125
+ cpu->isar.id_isar2 = 0x21232042;
126
+ cpu->isar.id_isar3 = 0x01112131;
127
+ cpu->isar.id_isar4 = 0x00010142;
128
+ cpu->isar.id_isar5 = 0x11011121;
129
+ cpu->isar.id_isar6 = 0x01100111;
130
+ cpu->isar.id_mmfr0 = 0x10201105;
131
+ cpu->isar.id_mmfr1 = 0x40000000;
132
+ cpu->isar.id_mmfr2 = 0x01260000;
133
+ cpu->isar.id_mmfr3 = 0x02122211;
134
+ cpu->isar.id_mmfr4 = 0x01021110;
135
+ cpu->isar.id_pfr0 = 0x21110131;
136
+ cpu->isar.id_pfr1 = 0x00010000; /* GIC filled in later */
137
+ cpu->isar.id_pfr2 = 0x00000011;
138
+ cpu->midr = 0x411FD402; /* r1p2 */
139
+ cpu->revidr = 0;
140
+
141
+ /*
142
+ * The Neoverse-V1 r1p2 TRM lists 32-bit format CCSIDR_EL1 values,
143
+ * but also says it implements CCIDX, which means they should be
144
+ * 64-bit format. So we here use values which are based on the textual
145
+ * information in chapter 2 of the TRM (and on the fact that
146
+ * sets * associativity * linesize == cachesize).
147
+ *
148
+ * The 64-bit CCSIDR_EL1 format is:
149
+ * [55:32] number of sets - 1
150
+ * [23:3] associativity - 1
151
+ * [2:0] log2(linesize) - 4
152
+ * so 0 == 16 bytes, 1 == 32 bytes, 2 == 64 bytes, etc
153
+ *
154
+ * L1: 4-way set associative 64-byte line size, total size 64K,
155
+ * so sets is 256.
156
+ *
157
+ * L2: 8-way set associative, 64 byte line size, either 512K or 1MB.
158
+ * We pick 1MB, so this has 2048 sets.
159
+ *
160
+ * L3: No L3 (this matches the CLIDR_EL1 value).
161
+ */
162
+ cpu->ccsidr[0] = 0x000000ff0000001aull; /* 64KB L1 dcache */
163
+ cpu->ccsidr[1] = 0x000000ff0000001aull; /* 64KB L1 icache */
164
+ cpu->ccsidr[2] = 0x000007ff0000003aull; /* 1MB L2 cache */
165
+
166
+ /* From 3.2.115 SCTLR_EL3 */
167
+ cpu->reset_sctlr = 0x30c50838;
168
+
169
+ /* From 3.4.8 ICC_CTLR_EL3 and 3.4.23 ICH_VTR_EL2 */
170
+ cpu->gic_num_lrs = 4;
171
+ cpu->gic_vpribits = 5;
172
+ cpu->gic_vprebits = 5;
173
+ cpu->gic_pribits = 5;
174
+
175
+ /* From 3.5.1 AdvSIMD AArch64 register summary */
176
+ cpu->isar.mvfr0 = 0x10110222;
177
+ cpu->isar.mvfr1 = 0x13211111;
178
+ cpu->isar.mvfr2 = 0x00000043;
179
+
180
+ /* From 3.7.5 ID_AA64ZFR0_EL1 */
181
+ cpu->isar.id_aa64zfr0 = 0x0000100000100000;
182
+ cpu->sve_vq.supported = (1 << 0) /* 128bit */
183
+ | (1 << 1); /* 256bit */
184
+
185
+ /* From 5.5.1 AArch64 PMU register summary */
186
+ cpu->isar.reset_pmcr_el0 = 0x41213000;
187
+
188
+ define_neoverse_v1_cp_reginfo(cpu);
189
+
190
+ aarch64_add_pauth_properties(obj);
191
+ aarch64_add_sve_properties(obj);
192
+}
193
+
194
/*
195
* -cpu max: a CPU with as many features enabled as our emulation supports.
196
* The version of '-cpu max' for qemu-system-arm is defined in cpu32.c;
197
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo aarch64_cpus[] = {
198
{ .name = "cortex-a76", .initfn = aarch64_a76_initfn },
199
{ .name = "a64fx", .initfn = aarch64_a64fx_initfn },
200
{ .name = "neoverse-n1", .initfn = aarch64_neoverse_n1_initfn },
201
+ { .name = "neoverse-v1", .initfn = aarch64_neoverse_v1_initfn },
202
};
203
204
static void aarch64_cpu_register_types(void)
205
--
206
2.34.1
207
208
diff view generated by jsdifflib
New patch
[PULL 14/14] target/arm: Avoid over-length shift in arm_cpu_sve_finalize() error case
1
If you build QEMU with the clang sanitizer enabled, you can see it
2
fire when running the arm-cpu-features test:
1
3
4
$ QTEST_QEMU_BINARY=./build/arm-clang/qemu-system-aarch64 ./build/arm-clang/tests/qtest/arm-cpu-features
5
[...]
6
../../target/arm/cpu64.c:125:19: runtime error: shift exponent 64 is too large for 64-bit type 'unsigned long long'
7
[...]
8
9
This happens because the user can specify some incorrect SVE
10
properties that result in our calculating a max_vq of 0. We catch
11
this and error out, but before we do that we calculate
12
13
vq_mask = MAKE_64BIT_MASK(0, max_vq);$
14
15
and the MAKE_64BIT_MASK() call is only valid for lengths that are
16
greater than zero, so we hit the undefined behaviour.
17
18
Change the logic so that if max_vq is 0 we specifically set vq_mask
19
to 0 without going via MAKE_64BIT_MASK(). This lets us drop the
20
max_vq check from the error-exit logic, because if max_vq is 0 then
21
vq_map must now be 0.
22
23
The UB only happens in the case where the user passed us an incorrect
24
set of SVE properties, so it's not a big problem in practice.
25
26
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
27
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
28
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
29
Message-id: 20230704154332.3014896-1-peter.maydell@linaro.org
30
---
31
target/arm/cpu64.c | 4 ++--
32
1 file changed, 2 insertions(+), 2 deletions(-)
33
34
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
35
index XXXXXXX..XXXXXXX 100644
36
--- a/target/arm/cpu64.c
37
+++ b/target/arm/cpu64.c
38
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
39
vq = ctz32(tmp) + 1;
40
41
max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
42
- vq_mask = MAKE_64BIT_MASK(0, max_vq);
43
+ vq_mask = max_vq > 0 ? MAKE_64BIT_MASK(0, max_vq) : 0;
44
vq_map = vq_supported & ~vq_init & vq_mask;
45
46
- if (max_vq == 0 || vq_map == 0) {
47
+ if (vq_map == 0) {
48
error_setg(errp, "cannot disable sve%d", vq * 128);
49
error_append_hint(errp, "Disabling sve%d results in all "
50
"vector lengths being disabled.\n",
51
--
52
2.34.1
53
54
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.