| 1 | Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code. | 1 | This bug seemed worth fixing for 8.0 since we need an rc4 anyway: |
|---|---|---|---|
| 2 | we were using uninitialized data for the guarded bit when | ||
| 3 | combining stage 1 and stage 2 attrs. | ||
| 2 | 4 | ||
| 5 | thanks | ||
| 3 | -- PMM | 6 | -- PMM |
| 4 | 7 | ||
| 5 | The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236: | 8 | The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6: |
| 6 | 9 | ||
| 7 | Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700) | 10 | Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100) |
| 8 | 11 | ||
| 9 | are available in the Git repository at: | 12 | are available in the Git repository at: |
| 10 | 13 | ||
| 11 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801 | 14 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410 |
| 12 | 15 | ||
| 13 | for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc: | 16 | for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308: |
| 14 | 17 | ||
| 15 | target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100) | 18 | target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100) |
| 16 | 19 | ||
| 17 | ---------------------------------------------------------------- | 20 | ---------------------------------------------------------------- |
| 18 | target-arm queue: | 21 | target-arm: Fix bug where we weren't initializing |
| 19 | * Fix KVM SVE ID register probe code | 22 | guarded bit state when combining S1/S2 attrs |
| 20 | 23 | ||
| 21 | ---------------------------------------------------------------- | 24 | ---------------------------------------------------------------- |
| 22 | Richard Henderson (3): | 25 | Richard Henderson (2): |
| 23 | target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features | 26 | target/arm: PTE bit GP only applies to stage1 |
| 24 | target/arm: Set KVM_ARM_VCPU_SVE while probing the host | 27 | target/arm: Copy guarded bit in combine_cacheattrs |
| 25 | target/arm: Move sve probe inside kvm >= 4.15 branch | ||
| 26 | 28 | ||
| 27 | target/arm/kvm64.c | 45 ++++++++++++++++++++++----------------------- | 29 | target/arm/ptw.c | 11 ++++++----- |
| 28 | 1 file changed, 22 insertions(+), 23 deletions(-) | 30 | 1 file changed, 6 insertions(+), 5 deletions(-) | diff view generated by jsdifflib |
Deleted patch | |||
|---|---|---|---|
| 1 | From: Richard Henderson <richard.henderson@linaro.org> | ||
| 2 | 1 | ||
| 3 | Indication for support for SVE will not depend on whether we | ||
| 4 | perform the query on the main kvm_state or the temp vcpu. | ||
| 5 | |||
| 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | ||
| 7 | Message-id: 20220726045828.53697-2-richard.henderson@linaro.org | ||
| 8 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 10 | --- | ||
| 11 | target/arm/kvm64.c | 2 +- | ||
| 12 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 13 | |||
| 14 | diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c | ||
| 15 | index XXXXXXX..XXXXXXX 100644 | ||
| 16 | --- a/target/arm/kvm64.c | ||
| 17 | +++ b/target/arm/kvm64.c | ||
| 18 | @@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) | ||
| 19 | } | ||
| 20 | } | ||
| 21 | |||
| 22 | - sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0; | ||
| 23 | + sve_supported = kvm_arm_sve_supported(); | ||
| 24 | |||
| 25 | /* Add feature bits that can't appear until after VCPU init. */ | ||
| 26 | if (sve_supported) { | ||
| 27 | -- | ||
| 28 | 2.25.1 | diff view generated by jsdifflib |
| 1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | The test for the IF block indicates no ID registers are exposed, much | 3 | Only perform the extract of GP during the stage1 walk. |
| 4 | less host support for SVE. Move the SVE probe into the ELSE block. | ||
| 5 | 4 | ||
| 5 | Reported-by: Peter Maydell <peter.maydell@linaro.org> | ||
| 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
| 7 | Message-id: 20220726045828.53697-4-richard.henderson@linaro.org | ||
| 8 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
| 8 | Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org | ||
| 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 10 | --- | 10 | --- |
| 11 | target/arm/kvm64.c | 22 +++++++++++----------- | 11 | target/arm/ptw.c | 10 +++++----- |
| 12 | 1 file changed, 11 insertions(+), 11 deletions(-) | 12 | 1 file changed, 5 insertions(+), 5 deletions(-) |
| 13 | 13 | ||
| 14 | diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c | 14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
| 15 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
| 16 | --- a/target/arm/kvm64.c | 16 | --- a/target/arm/ptw.c |
| 17 | +++ b/target/arm/kvm64.c | 17 | +++ b/target/arm/ptw.c |
| 18 | @@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) | 18 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, |
| 19 | err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0, | 19 | result->f.attrs.secure = false; |
| 20 | ARM64_SYS_REG(3, 3, 9, 12, 0)); | 20 | } |
| 21 | } | 21 | |
| 22 | - /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ | ||
| 23 | - if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { | ||
| 24 | - result->f.guarded = extract64(attrs, 50, 1); /* GP */ | ||
| 22 | - } | 25 | - } |
| 23 | 26 | - | |
| 24 | - if (sve_supported) { | 27 | if (regime_is_stage2(mmu_idx)) { |
| 25 | - /* | 28 | result->cacheattrs.is_s2_format = true; |
| 26 | - * There is a range of kernels between kernel commit 73433762fcae | 29 | result->cacheattrs.attrs = extract32(attrs, 2, 4); |
| 27 | - * and f81cb2c3ad41 which have a bug where the kernel doesn't expose | 30 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, |
| 28 | - * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled | 31 | assert(attrindx <= 7); |
| 29 | - * SVE support, which resulted in an error rather than RAZ. | 32 | result->cacheattrs.is_s2_format = false; |
| 30 | - * So only read the register if we set KVM_ARM_VCPU_SVE above. | 33 | result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8); |
| 31 | - */ | 34 | + |
| 32 | - err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0, | 35 | + /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */ |
| 33 | - ARM64_SYS_REG(3, 0, 0, 4, 4)); | 36 | + if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) { |
| 34 | + if (sve_supported) { | 37 | + result->f.guarded = extract64(attrs, 50, 1); /* GP */ |
| 35 | + /* | ||
| 36 | + * There is a range of kernels between kernel commit 73433762fcae | ||
| 37 | + * and f81cb2c3ad41 which have a bug where the kernel doesn't | ||
| 38 | + * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has | ||
| 39 | + * enabled SVE support, which resulted in an error rather than RAZ. | ||
| 40 | + * So only read the register if we set KVM_ARM_VCPU_SVE above. | ||
| 41 | + */ | ||
| 42 | + err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0, | ||
| 43 | + ARM64_SYS_REG(3, 0, 0, 4, 4)); | ||
| 44 | + } | 38 | + } |
| 45 | } | 39 | } |
| 46 | 40 | ||
| 47 | kvm_arm_destroy_scratch_host_vcpu(fdarray); | 41 | /* |
| 48 | -- | 42 | -- |
| 49 | 2.25.1 | 43 | 2.34.1 | diff view generated by jsdifflib |
| 1 | From: Richard Henderson <richard.henderson@linaro.org> | 1 | From: Richard Henderson <richard.henderson@linaro.org> |
|---|---|---|---|
| 2 | 2 | ||
| 3 | Because we weren't setting this flag, our probe of ID_AA64ZFR0 | 3 | The guarded bit comes from the stage1 walk. |
| 4 | was always returning zero. This also obviates the adjustment | ||
| 5 | of ID_AA64PFR0, which had sanitized the SVE field. | ||
| 6 | 4 | ||
| 7 | The effects of the bug are not visible, because the only thing that | 5 | Fixes: Coverity CID 1507929 |
| 8 | ID_AA64ZFR0 is used for within qemu at present is tcg translation. | ||
| 9 | The other tests for SVE within KVM are via ID_AA64PFR0.SVE. | ||
| 10 | |||
| 11 | Reported-by: Zenghui Yu <yuzenghui@huawei.com> | ||
| 12 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> | 6 | Signed-off-by: Richard Henderson <richard.henderson@linaro.org> |
| 13 | Message-id: 20220726045828.53697-3-richard.henderson@linaro.org | ||
| 14 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 7 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> |
| 8 | Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org | ||
| 15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 9 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
| 16 | --- | 10 | --- |
| 17 | target/arm/kvm64.c | 27 +++++++++++++-------------- | 11 | target/arm/ptw.c | 1 + |
| 18 | 1 file changed, 13 insertions(+), 14 deletions(-) | 12 | 1 file changed, 1 insertion(+) |
| 19 | 13 | ||
| 20 | diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c | 14 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
| 21 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
| 22 | --- a/target/arm/kvm64.c | 16 | --- a/target/arm/ptw.c |
| 23 | +++ b/target/arm/kvm64.c | 17 | +++ b/target/arm/ptw.c |
| 24 | @@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) | 18 | @@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr, |
| 25 | bool sve_supported; | 19 | |
| 26 | bool pmu_supported = false; | 20 | assert(!s1.is_s2_format); |
| 27 | uint64_t features = 0; | 21 | ret.is_s2_format = false; |
| 28 | - uint64_t t; | 22 | + ret.guarded = s1.guarded; |
| 29 | int err; | 23 | |
| 30 | 24 | if (s1.attrs == 0xf0) { | |
| 31 | /* Old kernels may not know about the PREFERRED_TARGET ioctl: however | 25 | tagged = true; |
| 32 | @@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) | ||
| 33 | struct kvm_vcpu_init init = { .target = -1, }; | ||
| 34 | |||
| 35 | /* | ||
| 36 | - * Ask for Pointer Authentication if supported. We can't play the | ||
| 37 | - * SVE trick of synthesising the ID reg as KVM won't tell us | ||
| 38 | - * whether we have the architected or IMPDEF version of PAuth, so | ||
| 39 | - * we have to use the actual ID regs. | ||
| 40 | + * Ask for SVE if supported, so that we can query ID_AA64ZFR0, | ||
| 41 | + * which is otherwise RAZ. | ||
| 42 | + */ | ||
| 43 | + sve_supported = kvm_arm_sve_supported(); | ||
| 44 | + if (sve_supported) { | ||
| 45 | + init.features[0] |= 1 << KVM_ARM_VCPU_SVE; | ||
| 46 | + } | ||
| 47 | + | ||
| 48 | + /* | ||
| 49 | + * Ask for Pointer Authentication if supported, so that we get | ||
| 50 | + * the unsanitized field values for AA64ISAR1_EL1. | ||
| 51 | */ | ||
| 52 | if (kvm_arm_pauth_supported()) { | ||
| 53 | init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS | | ||
| 54 | @@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf) | ||
| 55 | } | ||
| 56 | } | ||
| 57 | |||
| 58 | - sve_supported = kvm_arm_sve_supported(); | ||
| 59 | - | ||
| 60 | - /* Add feature bits that can't appear until after VCPU init. */ | ||
| 61 | if (sve_supported) { | ||
| 62 | - t = ahcf->isar.id_aa64pfr0; | ||
| 63 | - t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1); | ||
| 64 | - ahcf->isar.id_aa64pfr0 = t; | ||
| 65 | - | ||
| 66 | /* | ||
| 67 | * There is a range of kernels between kernel commit 73433762fcae | ||
| 68 | * and f81cb2c3ad41 which have a bug where the kernel doesn't expose | ||
| 69 | * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled | ||
| 70 | - * SVE support, so we only read it here, rather than together with all | ||
| 71 | - * the other ID registers earlier. | ||
| 72 | + * SVE support, which resulted in an error rather than RAZ. | ||
| 73 | + * So only read the register if we set KVM_ARM_VCPU_SVE above. | ||
| 74 | */ | ||
| 75 | err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0, | ||
| 76 | ARM64_SYS_REG(3, 0, 0, 4, 4)); | ||
| 77 | -- | 26 | -- |
| 78 | 2.25.1 | 27 | 2.34.1 | diff view generated by jsdifflib |