1 | This pullreq has: | 1 | A last small test of bug fixes before rc1. |
---|---|---|---|
2 | * two arm bug fixes which fix some "Linux fails to boot" bugs | ||
3 | * a docs typo-fixing patch | ||
4 | * a couple of compile failure/warning issues | ||
5 | |||
6 | I think they're all pretty safe and worth having in rc3. | ||
7 | 2 | ||
8 | thanks | 3 | thanks |
9 | -- PMM | 4 | -- PMM |
10 | 5 | ||
11 | The following changes since commit a6b1c53e79d08a99a28cc3e67a3e1a7c34102d6b: | 6 | The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637: |
12 | 7 | ||
13 | Merge tag 'linux-user-for-7.1-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-08-10 10:26:57 -0700) | 8 | Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100) |
14 | 9 | ||
15 | are available in the Git repository at: | 10 | are available in the Git repository at: |
16 | 11 | ||
17 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220812 | 12 | https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717 |
18 | 13 | ||
19 | for you to fetch changes up to 4311682ea8293f720730f260e8a7601117d79e65: | 14 | for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4: |
20 | 15 | ||
21 | cutils: Add missing dyld(3) include on macOS (2022-08-12 11:33:52 +0100) | 16 | hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100) |
22 | 17 | ||
23 | ---------------------------------------------------------------- | 18 | ---------------------------------------------------------------- |
24 | target-arm queue: | 19 | target-arm queue: |
25 | * Don't report Statistical Profiling Extension in ID registers | 20 | * hw/arm/sbsa-ref: set 'slots' property of xhci |
26 | * virt ACPI tables: Present the GICR structure properly for GICv4 | 21 | * linux-user: Remove pointless NULL check in clock_adjtime handling |
27 | * Fix some typos in documentation | 22 | * ptw: Fix S1_ptw_translate() debug path |
28 | * tests/unit: fix a -Wformat-truncation warning | 23 | * ptw: Account for FEAT_RME when applying {N}SW, SA bits |
29 | * cutils: Add missing dyld(3) include on macOS | 24 | * accel/tcg: Zero-pad PC in TCG CPU exec trace lines |
25 | * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write | ||
30 | 26 | ||
31 | ---------------------------------------------------------------- | 27 | ---------------------------------------------------------------- |
32 | Marc-André Lureau (1): | 28 | Peter Maydell (5): |
33 | tests/unit: fix a -Wformat-truncation warning | 29 | linux-user: Remove pointless NULL check in clock_adjtime handling |
30 | target/arm/ptw.c: Add comments to S1Translate struct fields | ||
31 | target/arm: Fix S1_ptw_translate() debug path | ||
32 | target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits | ||
33 | accel/tcg: Zero-pad PC in TCG CPU exec trace lines | ||
34 | 34 | ||
35 | Peter Maydell (1): | 35 | Tong Ho (1): |
36 | target/arm: Don't report Statistical Profiling Extension in ID registers | 36 | hw/nvram: Avoid unnecessary Xilinx eFuse backstore write |
37 | 37 | ||
38 | Philippe Mathieu-Daudé (1): | 38 | Yuquan Wang (1): |
39 | cutils: Add missing dyld(3) include on macOS | 39 | hw/arm/sbsa-ref: set 'slots' property of xhci |
40 | 40 | ||
41 | Stefan Weil (1): | 41 | accel/tcg/cpu-exec.c | 4 +-- |
42 | Fix some typos in documentation (most of them found by codespell) | 42 | accel/tcg/translate-all.c | 2 +- |
43 | 43 | hw/arm/sbsa-ref.c | 1 + | |
44 | Zenghui Yu (1): | 44 | hw/nvram/xlnx-efuse.c | 11 ++++-- |
45 | hw/arm/virt-acpi-build: Present the GICR structure properly for GICv4 | 45 | linux-user/syscall.c | 12 +++---- |
46 | 46 | target/arm/ptw.c | 90 +++++++++++++++++++++++++++++++++++++++++------ | |
47 | docs/about/deprecated.rst | 2 +- | 47 | 6 files changed, 98 insertions(+), 22 deletions(-) |
48 | docs/specs/acpi_erst.rst | 4 ++-- | ||
49 | docs/system/devices/canokey.rst | 8 ++++---- | ||
50 | docs/system/devices/cxl.rst | 12 ++++++------ | ||
51 | hw/arm/virt-acpi-build.c | 4 ++-- | ||
52 | target/arm/cpu.c | 11 +++++++++++ | ||
53 | tests/unit/test-qobject-input-visitor.c | 3 +-- | ||
54 | util/cutils.c | 4 ++++ | ||
55 | util/oslib-posix.c | 4 ---- | ||
56 | 9 files changed, 31 insertions(+), 21 deletions(-) | ||
57 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | From: Yuquan Wang <wangyuquan1236@phytium.com.cn> | ||
1 | 2 | ||
3 | This extends the slots of xhci to 64, since the default xhci_sysbus | ||
4 | just supports one slot. | ||
5 | |||
6 | Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn> | ||
7 | Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn> | ||
8 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
9 | Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> | ||
10 | Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> | ||
11 | Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn | ||
12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
13 | --- | ||
14 | hw/arm/sbsa-ref.c | 1 + | ||
15 | 1 file changed, 1 insertion(+) | ||
16 | |||
17 | diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c | ||
18 | index XXXXXXX..XXXXXXX 100644 | ||
19 | --- a/hw/arm/sbsa-ref.c | ||
20 | +++ b/hw/arm/sbsa-ref.c | ||
21 | @@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms) | ||
22 | hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base; | ||
23 | int irq = sbsa_ref_irqmap[SBSA_XHCI]; | ||
24 | DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS); | ||
25 | + qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS); | ||
26 | |||
27 | sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal); | ||
28 | sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base); | ||
29 | -- | ||
30 | 2.34.1 | diff view generated by jsdifflib |
1 | From: Philippe Mathieu-Daudé <f4bug@amsat.org> | 1 | In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to |
---|---|---|---|
2 | the address of the local variable htx. This means it can never be | ||
3 | NULL, but later in the code we check it for NULL anyway. Coverity | ||
4 | complains about this (CID 1507683) because the NULL check comes after | ||
5 | a call to clock_adjtime() that assumes it is non-NULL. | ||
2 | 6 | ||
3 | Commit 06680b15b4 moved qemu_*_exec_dir() to cutils but forgot | 7 | Since phtx is always &htx, and is used only in three places, it's not |
4 | to move the macOS dyld(3) include, resulting in the following | 8 | really necessary. Remove it, bringing the code structure in to line |
5 | error (when building with Homebrew GCC on macOS Monterey 12.4): | 9 | with that for TARGET_NR_clock_adjtime64, which already uses a simple |
10 | '&htx' when it wants a pointer to 'htx'. | ||
6 | 11 | ||
7 | [313/1197] Compiling C object libqemuutil.a.p/util_cutils.c.o | 12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
8 | FAILED: libqemuutil.a.p/util_cutils.c.o | 13 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> |
9 | ../../util/cutils.c:1039:13: error: implicit declaration of function '_NSGetExecutablePath' [-Werror=implicit-function-declaration] | 14 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
10 | 1039 | if (_NSGetExecutablePath(fpath, &len) == 0) { | 15 | Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org |
11 | | ^~~~~~~~~~~~~~~~~~~~ | 16 | --- |
12 | ../../util/cutils.c:1039:13: error: nested extern declaration of '_NSGetExecutablePath' [-Werror=nested-externs] | 17 | linux-user/syscall.c | 12 +++++------- |
18 | 1 file changed, 5 insertions(+), 7 deletions(-) | ||
13 | 19 | ||
14 | Fix by moving the include line to cutils. | 20 | diff --git a/linux-user/syscall.c b/linux-user/syscall.c |
15 | |||
16 | Fixes: 06680b15b4 ("include: move qemu_*_exec_dir() to cutils") | ||
17 | Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | ||
18 | Message-id: 20220809222046.30812-1-f4bug@amsat.org | ||
19 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
20 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
21 | --- | ||
22 | util/cutils.c | 4 ++++ | ||
23 | util/oslib-posix.c | 4 ---- | ||
24 | 2 files changed, 4 insertions(+), 4 deletions(-) | ||
25 | |||
26 | diff --git a/util/cutils.c b/util/cutils.c | ||
27 | index XXXXXXX..XXXXXXX 100644 | 21 | index XXXXXXX..XXXXXXX 100644 |
28 | --- a/util/cutils.c | 22 | --- a/linux-user/syscall.c |
29 | +++ b/util/cutils.c | 23 | +++ b/linux-user/syscall.c |
30 | @@ -XXX,XX +XXX,XX @@ | 24 | @@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, |
31 | #include <kernel/image.h> | 25 | #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME) |
32 | #endif | 26 | case TARGET_NR_clock_adjtime: |
33 | 27 | { | |
34 | +#ifdef __APPLE__ | 28 | - struct timex htx, *phtx = &htx; |
35 | +#include <mach-o/dyld.h> | 29 | + struct timex htx; |
36 | +#endif | 30 | |
37 | + | 31 | - if (target_to_host_timex(phtx, arg2) != 0) { |
38 | #ifdef G_OS_WIN32 | 32 | + if (target_to_host_timex(&htx, arg2) != 0) { |
39 | #include <pathcch.h> | 33 | return -TARGET_EFAULT; |
40 | #include <wchar.h> | 34 | } |
41 | diff --git a/util/oslib-posix.c b/util/oslib-posix.c | 35 | - ret = get_errno(clock_adjtime(arg1, phtx)); |
42 | index XXXXXXX..XXXXXXX 100644 | 36 | - if (!is_error(ret) && phtx) { |
43 | --- a/util/oslib-posix.c | 37 | - if (host_to_target_timex(arg2, phtx) != 0) { |
44 | +++ b/util/oslib-posix.c | 38 | - return -TARGET_EFAULT; |
45 | @@ -XXX,XX +XXX,XX @@ | 39 | - } |
46 | #include <lwp.h> | 40 | + ret = get_errno(clock_adjtime(arg1, &htx)); |
47 | #endif | 41 | + if (!is_error(ret) && host_to_target_timex(arg2, &htx)) { |
48 | 42 | + return -TARGET_EFAULT; | |
49 | -#ifdef __APPLE__ | 43 | } |
50 | -#include <mach-o/dyld.h> | 44 | } |
51 | -#endif | 45 | return ret; |
52 | - | ||
53 | #include "qemu/mmap-alloc.h" | ||
54 | |||
55 | #ifdef CONFIG_DEBUG_STACK_USAGE | ||
56 | -- | 46 | -- |
57 | 2.25.1 | 47 | 2.34.1 |
58 | 48 | ||
59 | 49 | diff view generated by jsdifflib |
1 | The newly added neoverse-n1 CPU has ID register values which indicate | 1 | Add comments to the in_* fields in the S1Translate struct |
---|---|---|---|
2 | the presence of the Statistical Profiling Extension, because the real | 2 | that explain what they're doing. |
3 | hardware has this feature. QEMU's TCG emulation does not yet | ||
4 | implement SPE, though (not even as a minimal stub implementation), so | ||
5 | guests will crash if they try to use it because the SPE system | ||
6 | registers don't exist. | ||
7 | 3 | ||
8 | Force ID_AA64DFR0_EL1.PMSVer to 0 in CPU realize for TCG, so that | ||
9 | we don't advertise to the guest a feature that doesn't exist. | ||
10 | |||
11 | (We could alternatively do this by editing the value that | ||
12 | aarch64_neoverse_n1_initfn() sets for this ID register, but | ||
13 | suppressing the field in realize means we won't re-introduce this bug | ||
14 | when we add other CPUs that have SPE in hardware, such as the | ||
15 | Neoverse-V1.) | ||
16 | |||
17 | An example of a non-booting guest is current mainline Linux (5.19), | ||
18 | when booting in EL2 on the virt board (ie with -machine | ||
19 | virtualization=on). | ||
20 | |||
21 | Reported-by: Zenghui Yu <yuzenghui@huawei.com> | ||
22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 4 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
23 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | 5 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> |
24 | Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> | 6 | Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org |
25 | Reviewed-by: Zenghui Yu <yuzenghui@huawei.com> | ||
26 | Message-id: 20220811131127.947334-1-peter.maydell@linaro.org | ||
27 | --- | 7 | --- |
28 | target/arm/cpu.c | 11 +++++++++++ | 8 | target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++ |
29 | 1 file changed, 11 insertions(+) | 9 | 1 file changed, 40 insertions(+) |
30 | 10 | ||
31 | diff --git a/target/arm/cpu.c b/target/arm/cpu.c | 11 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
32 | index XXXXXXX..XXXXXXX 100644 | 12 | index XXXXXXX..XXXXXXX 100644 |
33 | --- a/target/arm/cpu.c | 13 | --- a/target/arm/ptw.c |
34 | +++ b/target/arm/cpu.c | 14 | +++ b/target/arm/ptw.c |
35 | @@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp) | 15 | @@ -XXX,XX +XXX,XX @@ |
36 | } | ||
37 | #endif | 16 | #endif |
38 | 17 | ||
39 | + if (tcg_enabled()) { | 18 | typedef struct S1Translate { |
40 | + /* | 19 | + /* |
41 | + * Don't report the Statistical Profiling Extension in the ID | 20 | + * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk. |
42 | + * registers, because TCG doesn't implement it yet (not even a | 21 | + * Together with in_space, specifies the architectural translation regime. |
43 | + * minimal stub version) and guests will fall over when they | 22 | + */ |
44 | + * try to access the non-existent system registers for it. | 23 | ARMMMUIdx in_mmu_idx; |
45 | + */ | 24 | + /* |
46 | + cpu->isar.id_aa64dfr0 = | 25 | + * in_ptw_idx: specifies which mmuidx to use for the actual |
47 | + FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0); | 26 | + * page table descriptor load operations. This will be one of the |
48 | + } | 27 | + * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes. |
49 | + | 28 | + * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit, |
50 | /* MPU can be configured out of a PMSA CPU either by setting has-mpu | 29 | + * this field is updated accordingly. |
51 | * to false or by setting pmsav7-dregion to 0. | 30 | + */ |
52 | */ | 31 | ARMMMUIdx in_ptw_idx; |
32 | + /* | ||
33 | + * in_space: the security space for this walk. This plus | ||
34 | + * the in_mmu_idx specify the architectural translation regime. | ||
35 | + * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit, | ||
36 | + * this field is updated accordingly. | ||
37 | + * | ||
38 | + * Note that the security space for the in_ptw_idx may be different | ||
39 | + * from that for the in_mmu_idx. We do not need to explicitly track | ||
40 | + * the in_ptw_idx security space because: | ||
41 | + * - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx | ||
42 | + * itself specifies the security space | ||
43 | + * - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security | ||
44 | + * space used for ptw reads is the same as that of the security | ||
45 | + * space of the stage 1 translation for all cases except where | ||
46 | + * stage 1 is Secure; in that case the only possibilities for | ||
47 | + * the ptw read are Secure and NonSecure, and the in_ptw_idx | ||
48 | + * value being Stage2 vs Stage2_S distinguishes those. | ||
49 | + */ | ||
50 | ARMSecuritySpace in_space; | ||
51 | + /* | ||
52 | + * in_secure: whether the translation regime is a Secure one. | ||
53 | + * This is always equal to arm_space_is_secure(in_space). | ||
54 | + * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit, | ||
55 | + * this field is updated accordingly. | ||
56 | + */ | ||
57 | bool in_secure; | ||
58 | + /* | ||
59 | + * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug | ||
60 | + * accesses will not update the guest page table access flags | ||
61 | + * and will not change the state of the softmmu TLBs. | ||
62 | + */ | ||
63 | bool in_debug; | ||
64 | /* | ||
65 | * If this is stage 2 of a stage 1+2 page table walk, then this must | ||
53 | -- | 66 | -- |
54 | 2.25.1 | 67 | 2.34.1 |
55 | |||
56 | diff view generated by jsdifflib |
1 | From: Stefan Weil <sw@weilnetz.de> | 1 | In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate() |
---|---|---|---|
2 | so that the debug-access "call get_phys_addr_*" codepath is used both | ||
3 | when S1 is doing ptw reads from stage 2 and when it is doing ptw | ||
4 | reads from physical memory. However, we didn't update the | ||
5 | calculation of s2ptw->in_space and s2ptw->in_secure to account for | ||
6 | the "ptw reads from physical memory" case. This meant that debug | ||
7 | accesses when in Secure state broke. | ||
2 | 8 | ||
3 | Signed-off-by: Stefan Weil <sw@weilnetz.de> | 9 | Create a new function S2_security_space() which returns the |
4 | Reviewed-by: Hongren (Zenithal) Zheng <i@zenithal.me> | 10 | correct security space to use for the ptw load, and use it to |
5 | Message-id: 20220812075642.1200578-1-sw@weilnetz.de | 11 | determine the correct .in_secure and .in_space fields for the |
6 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 12 | stage 2 lookup for the ptw load. |
13 | |||
14 | Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org> | ||
15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
16 | Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org> | ||
17 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
18 | Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org | ||
19 | Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate") | ||
7 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 20 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
8 | --- | 21 | --- |
9 | docs/about/deprecated.rst | 2 +- | 22 | target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++----- |
10 | docs/specs/acpi_erst.rst | 4 ++-- | 23 | 1 file changed, 32 insertions(+), 5 deletions(-) |
11 | docs/system/devices/canokey.rst | 8 ++++---- | ||
12 | docs/system/devices/cxl.rst | 12 ++++++------ | ||
13 | 4 files changed, 13 insertions(+), 13 deletions(-) | ||
14 | 24 | ||
15 | diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst | 25 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c |
16 | index XXXXXXX..XXXXXXX 100644 | 26 | index XXXXXXX..XXXXXXX 100644 |
17 | --- a/docs/about/deprecated.rst | 27 | --- a/target/arm/ptw.c |
18 | +++ b/docs/about/deprecated.rst | 28 | +++ b/target/arm/ptw.c |
19 | @@ -XXX,XX +XXX,XX @@ by using ``-machine graphics=off``. | 29 | @@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs) |
20 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | 30 | } |
21 | 31 | } | |
22 | In QEMU versions 6.1, 6.2 and 7.0, the ``nvme-ns`` generates an EUI-64 | 32 | |
23 | -identifer that is not globally unique. If an EUI-64 identifer is required, the | 33 | +static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space, |
24 | +identifier that is not globally unique. If an EUI-64 identifier is required, the | 34 | + ARMMMUIdx s2_mmu_idx) |
25 | user must set it explicitly using the ``nvme-ns`` device parameter ``eui64``. | 35 | +{ |
26 | 36 | + /* | |
27 | ``-device nvme,use-intel-id=on|off`` (since 7.1) | 37 | + * Return the security space to use for stage 2 when doing |
28 | diff --git a/docs/specs/acpi_erst.rst b/docs/specs/acpi_erst.rst | 38 | + * the S1 page table descriptor load. |
29 | index XXXXXXX..XXXXXXX 100644 | 39 | + */ |
30 | --- a/docs/specs/acpi_erst.rst | 40 | + if (regime_is_stage2(s2_mmu_idx)) { |
31 | +++ b/docs/specs/acpi_erst.rst | 41 | + /* |
32 | @@ -XXX,XX +XXX,XX @@ Slot 0 contains a backend storage header that identifies the contents | 42 | + * The security space for ptw reads is almost always the same |
33 | as ERST and also facilitates efficient access to the records. | 43 | + * as that of the security space of the stage 1 translation. |
34 | Depending upon the size of the backend storage, additional slots will | 44 | + * The only exception is when stage 1 is Secure; in that case |
35 | be designated to be a part of the slot 0 header. For example, at 8KiB, | 45 | + * the ptw read might be to the Secure or the NonSecure space |
36 | -the slot 0 header can accomodate 1021 records. Thus a storage size | 46 | + * (but never Realm or Root), and the s2_mmu_idx tells us which. |
37 | +the slot 0 header can accommodate 1021 records. Thus a storage size | 47 | + * Root translations are always single-stage. |
38 | of 8MiB (8KiB * 1024) requires an additional slot for use by the | 48 | + */ |
39 | header. In this scenario, slot 0 and slot 1 form the backend storage | 49 | + if (s1_space == ARMSS_Secure) { |
40 | header, and records can be stored starting at slot 2. | 50 | + return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S); |
41 | @@ -XXX,XX +XXX,XX @@ References | 51 | + } else { |
42 | [2] "Unified Extensible Firmware Interface Specification", | 52 | + assert(s2_mmu_idx != ARMMMUIdx_Stage2_S); |
43 | version 2.1, October 2008. | 53 | + assert(s1_space != ARMSS_Root); |
44 | 54 | + return s1_space; | |
45 | -[3] "Windows Hardware Error Architecture", specfically | 55 | + } |
46 | +[3] "Windows Hardware Error Architecture", specifically | 56 | + } else { |
47 | "Error Record Persistence Mechanism". | 57 | + /* ptw loads are from phys: the mmu idx itself says which space */ |
48 | diff --git a/docs/system/devices/canokey.rst b/docs/system/devices/canokey.rst | 58 | + return arm_phys_to_space(s2_mmu_idx); |
49 | index XXXXXXX..XXXXXXX 100644 | 59 | + } |
50 | --- a/docs/system/devices/canokey.rst | 60 | +} |
51 | +++ b/docs/system/devices/canokey.rst | 61 | + |
52 | @@ -XXX,XX +XXX,XX @@ With the same software configuration as a hardware key, | 62 | /* Translate a S1 pagetable walk through S2 if needed. */ |
53 | the guest OS can use all the functionalities of a secure key as if | 63 | static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, |
54 | there was actually an hardware key plugged in. | 64 | hwaddr addr, ARMMMUFaultInfo *fi) |
55 | 65 | { | |
56 | -CanoKey QEMU provides much convenience for debuging: | 66 | - ARMSecuritySpace space = ptw->in_space; |
57 | +CanoKey QEMU provides much convenience for debugging: | 67 | bool is_secure = ptw->in_secure; |
58 | 68 | ARMMMUIdx mmu_idx = ptw->in_mmu_idx; | |
59 | -* libcanokey-qemu supports debuging output thus developers can | 69 | ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx; |
60 | +* libcanokey-qemu supports debugging output thus developers can | 70 | @@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw, |
61 | inspect what happens inside a secure key | 71 | * From gdbstub, do not use softmmu so that we don't modify the |
62 | * CanoKey QEMU supports trace event thus event | 72 | * state of the cpu at all, including softmmu tlb contents. |
63 | * QEMU USB stack supports pcap thus USB packet between the guest | 73 | */ |
64 | @@ -XXX,XX +XXX,XX @@ and find CanoKey QEMU there: | 74 | + ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx); |
65 | 75 | S1Translate s2ptw = { | |
66 | You may setup the key as guided in [6]_. The console for the key is at [7]_. | 76 | .in_mmu_idx = s2_mmu_idx, |
67 | 77 | .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx), | |
68 | -Debuging | 78 | - .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S, |
69 | -======== | 79 | - .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure |
70 | +Debugging | 80 | - : space == ARMSS_Realm ? ARMSS_Realm |
71 | +========= | 81 | - : ARMSS_NonSecure), |
72 | 82 | + .in_secure = arm_space_is_secure(s2_space), | |
73 | CanoKey QEMU consists of two parts, ``libcanokey-qemu.so`` and ``canokey.c``, | 83 | + .in_space = s2_space, |
74 | the latter of which resides in QEMU. The former provides core functionality | 84 | .in_debug = true, |
75 | diff --git a/docs/system/devices/cxl.rst b/docs/system/devices/cxl.rst | 85 | }; |
76 | index XXXXXXX..XXXXXXX 100644 | 86 | GetPhysAddrResult s2 = { }; |
77 | --- a/docs/system/devices/cxl.rst | ||
78 | +++ b/docs/system/devices/cxl.rst | ||
79 | @@ -XXX,XX +XXX,XX @@ CXL Fixed Memory Windows (CFMW) | ||
80 | A CFMW consists of a particular range of Host Physical Address space | ||
81 | which is routed to particular CXL Host Bridges. At time of generic | ||
82 | software initialization it will have a particularly interleaving | ||
83 | -configuration and associated Quality of Serice Throtling Group (QTG). | ||
84 | +configuration and associated Quality of Service Throttling Group (QTG). | ||
85 | This information is available to system software, when making | ||
86 | decisions about how to configure interleave across available CXL | ||
87 | memory devices. It is provide as CFMW Structures (CFMWS) in | ||
88 | @@ -XXX,XX +XXX,XX @@ specification defined register interface called CXL Host Bridge | ||
89 | Component Registers (CHBCR). The location of this CHBCR MMIO | ||
90 | space is described to system software via a CXL Host Bridge | ||
91 | Structure (CHBS) in the CEDT ACPI table. The actual interfaces | ||
92 | -are identical to those used for other parts of the CXL heirarchy | ||
93 | +are identical to those used for other parts of the CXL hierarchy | ||
94 | as CXL Component Registers in PCI BARs. | ||
95 | |||
96 | Interfaces provided include: | ||
97 | @@ -XXX,XX +XXX,XX @@ CXL Memory Devices - Type 3 | ||
98 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
99 | CXL type 3 devices use a PCI class code and are intended to be supported | ||
100 | by a generic operating system driver. They have HDM decoders | ||
101 | -though in these EP devices, the decoder is reponsible not for | ||
102 | +though in these EP devices, the decoder is responsible not for | ||
103 | routing but for translation of the incoming host physical address (HPA) | ||
104 | into a Device Physical Address (DPA). | ||
105 | |||
106 | @@ -XXX,XX +XXX,XX @@ Notes: | ||
107 | ranges of the system physical address map. Each CFMW has | ||
108 | particular interleave setup across the CXL Host Bridges (HB) | ||
109 | CFMW0 provides uninterleaved access to HB0, CFW2 provides | ||
110 | - uninterleaved acess to HB1. CFW1 provides interleaved memory access | ||
111 | + uninterleaved access to HB1. CFW1 provides interleaved memory access | ||
112 | across HB0 and HB1. | ||
113 | |||
114 | (2) **Two CXL Host Bridges**. Each of these has 2 CXL Root Ports and | ||
115 | @@ -XXX,XX +XXX,XX @@ Example topology involving a switch:: | ||
116 | --------------------------------------------------- | ||
117 | | Switch 0 USP as PCI 0d:00.0 | | ||
118 | | USP has HDM decoder which direct traffic to | | ||
119 | - | appropiate downstream port | | ||
120 | + | appropriate downstream port | | ||
121 | | Switch BUS appears as 0e | | ||
122 | |x__________________________________________________| | ||
123 | | | | | | ||
124 | @@ -XXX,XX +XXX,XX @@ An example of 4 devices below a switch suitable for 1, 2 or 4 way interleave:: | ||
125 | Kernel Configuration Options | ||
126 | ---------------------------- | ||
127 | |||
128 | -In Linux 5.18 the followings options are necessary to make use of | ||
129 | +In Linux 5.18 the following options are necessary to make use of | ||
130 | OS management of CXL memory devices as described here. | ||
131 | |||
132 | * CONFIG_CXL_BUS | ||
133 | -- | 87 | -- |
134 | 2.25.1 | 88 | 2.34.1 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | In get_phys_addr_twostage() the code that applies the effects of | ||
2 | VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure. | ||
3 | Now we also have f.attrs.space for FEAT_RME, we need to keep the two | ||
4 | in sync. | ||
1 | 5 | ||
6 | These bits only have an effect for Secure space translations, not | ||
7 | for Root, so use the input in_space field to determine whether to | ||
8 | apply them rather than the input is_secure. This doesn't actually | ||
9 | make a difference because Root translations are never two-stage, | ||
10 | but it's a little clearer. | ||
11 | |||
12 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | ||
13 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
14 | Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org | ||
15 | --- | ||
16 | target/arm/ptw.c | 13 ++++++++----- | ||
17 | 1 file changed, 8 insertions(+), 5 deletions(-) | ||
18 | |||
19 | diff --git a/target/arm/ptw.c b/target/arm/ptw.c | ||
20 | index XXXXXXX..XXXXXXX 100644 | ||
21 | --- a/target/arm/ptw.c | ||
22 | +++ b/target/arm/ptw.c | ||
23 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, | ||
24 | hwaddr ipa; | ||
25 | int s1_prot, s1_lgpgsz; | ||
26 | bool is_secure = ptw->in_secure; | ||
27 | + ARMSecuritySpace in_space = ptw->in_space; | ||
28 | bool ret, ipa_secure; | ||
29 | ARMCacheAttrs cacheattrs1; | ||
30 | ARMSecuritySpace ipa_space; | ||
31 | @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw, | ||
32 | * Check if IPA translates to secure or non-secure PA space. | ||
33 | * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA. | ||
34 | */ | ||
35 | - result->f.attrs.secure = | ||
36 | - (is_secure | ||
37 | - && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)) | ||
38 | - && (ipa_secure | ||
39 | - || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)))); | ||
40 | + if (in_space == ARMSS_Secure) { | ||
41 | + result->f.attrs.secure = | ||
42 | + !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW)) | ||
43 | + && (ipa_secure | ||
44 | + || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))); | ||
45 | + result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure); | ||
46 | + } | ||
47 | |||
48 | return false; | ||
49 | } | ||
50 | -- | ||
51 | 2.34.1 | diff view generated by jsdifflib |
1 | From: Marc-André Lureau <marcandre.lureau@redhat.com> | 1 | In commit f0a08b0913befbd we changed the type of the PC from |
---|---|---|---|
2 | target_ulong to vaddr. In doing so we inadvertently dropped the | ||
3 | zero-padding on the PC in trace lines (the second item inside the [] | ||
4 | in these lines). They used to look like this on AArch64, for | ||
5 | instance: | ||
2 | 6 | ||
3 | ../tests/test-qobject-input-visitor.c: In function ‘test_visitor_in_list’: | 7 | Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000] |
4 | ../tests/test-qobject-input-visitor.c:454:49: warning: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 6 [-Wformat-truncation=] | ||
5 | 454 | snprintf(string, sizeof(string), "string%d", i); | ||
6 | | ^~ | ||
7 | ../tests/test-qobject-input-visitor.c:454:42: note: directive argument in the range [0, 2147483606] | ||
8 | 454 | snprintf(string, sizeof(string), "string%d", i); | ||
9 | | ^~~~~~~~~~ | ||
10 | ../tests/test-qobject-input-visitor.c:454:9: note: ‘snprintf’ output between 8 and 17 bytes into a destination of size 12 | ||
11 | 454 | snprintf(string, sizeof(string), "string%d", i); | ||
12 | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
13 | 8 | ||
14 | Rather than trying to be clever, since this is called 3 times during | 9 | and now they look like this: |
15 | tests, let's simply use g_strdup_printf(). | 10 | Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000] |
16 | 11 | ||
17 | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> | 12 | and if the PC happens to be somewhere low like 0x5000 |
18 | Reviewed-by: Markus Armbruster <armbru@redhat.com> | 13 | then the field is shown as /5000/. |
19 | Message-id: 20220810121513.1356081-1-marcandre.lureau@redhat.com | 14 | |
20 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 15 | This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier, |
21 | [PMM: fixed commit message typos] | 16 | depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64 |
17 | with no width specifier. | ||
18 | |||
19 | Restore the zero-padding by adding an 016 width specifier to | ||
20 | this tracing and a couple of others that were similarly recently | ||
21 | changed to use VADDR_PRIx without a width specifier. | ||
22 | |||
23 | We can't unfortunately restore the "32-bit guests are padded to | ||
24 | 8 hex digits and 64-bit guests to 16 hex digits" behaviour so | ||
25 | easily. | ||
26 | |||
27 | Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr") | ||
22 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 28 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
29 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
30 | Reviewed-by: Anton Johansson <anjo@rev.ng> | ||
31 | Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org | ||
23 | --- | 32 | --- |
24 | tests/unit/test-qobject-input-visitor.c | 3 +-- | 33 | accel/tcg/cpu-exec.c | 4 ++-- |
25 | 1 file changed, 1 insertion(+), 2 deletions(-) | 34 | accel/tcg/translate-all.c | 2 +- |
35 | 2 files changed, 3 insertions(+), 3 deletions(-) | ||
26 | 36 | ||
27 | diff --git a/tests/unit/test-qobject-input-visitor.c b/tests/unit/test-qobject-input-visitor.c | 37 | diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c |
28 | index XXXXXXX..XXXXXXX 100644 | 38 | index XXXXXXX..XXXXXXX 100644 |
29 | --- a/tests/unit/test-qobject-input-visitor.c | 39 | --- a/accel/tcg/cpu-exec.c |
30 | +++ b/tests/unit/test-qobject-input-visitor.c | 40 | +++ b/accel/tcg/cpu-exec.c |
31 | @@ -XXX,XX +XXX,XX @@ static void test_visitor_in_list(TestInputVisitorData *data, | 41 | @@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu, |
32 | g_assert(head != NULL); | 42 | if (qemu_log_in_addr_range(pc)) { |
33 | 43 | qemu_log_mask(CPU_LOG_EXEC, | |
34 | for (i = 0, item = head; item; item = item->next, i++) { | 44 | "Trace %d: %p [%08" PRIx64 |
35 | - char string[12]; | 45 | - "/%" VADDR_PRIx "/%08x/%08x] %s\n", |
36 | + g_autofree char *string = g_strdup_printf("string%d", i); | 46 | + "/%016" VADDR_PRIx "/%08x/%08x] %s\n", |
37 | 47 | cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc, | |
38 | - snprintf(string, sizeof(string), "string%d", i); | 48 | tb->flags, tb->cflags, lookup_symbol(pc)); |
39 | g_assert_cmpstr(item->value->string, ==, string); | 49 | |
40 | g_assert_cmpint(item->value->integer, ==, 42 + i); | 50 | @@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit) |
51 | if (qemu_loglevel_mask(CPU_LOG_EXEC)) { | ||
52 | vaddr pc = log_pc(cpu, last_tb); | ||
53 | if (qemu_log_in_addr_range(pc)) { | ||
54 | - qemu_log("Stopped execution of TB chain before %p [%" | ||
55 | + qemu_log("Stopped execution of TB chain before %p [%016" | ||
56 | VADDR_PRIx "] %s\n", | ||
57 | last_tb->tc.ptr, pc, lookup_symbol(pc)); | ||
58 | } | ||
59 | diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c | ||
60 | index XXXXXXX..XXXXXXX 100644 | ||
61 | --- a/accel/tcg/translate-all.c | ||
62 | +++ b/accel/tcg/translate-all.c | ||
63 | @@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr) | ||
64 | if (qemu_loglevel_mask(CPU_LOG_EXEC)) { | ||
65 | vaddr pc = log_pc(cpu, tb); | ||
66 | if (qemu_log_in_addr_range(pc)) { | ||
67 | - qemu_log("cpu_io_recompile: rewound execution of TB to %" | ||
68 | + qemu_log("cpu_io_recompile: rewound execution of TB to %016" | ||
69 | VADDR_PRIx "\n", pc); | ||
70 | } | ||
41 | } | 71 | } |
42 | -- | 72 | -- |
43 | 2.25.1 | 73 | 2.34.1 |
44 | 74 | ||
45 | 75 | diff view generated by jsdifflib |
1 | From: Zenghui Yu <yuzenghui@huawei.com> | 1 | From: Tong Ho <tong.ho@amd.com> |
---|---|---|---|
2 | 2 | ||
3 | With the introduction of the new TCG GICv4, build_madt() is badly broken | 3 | Add a check in the bit-set operation to write the backstore |
4 | as we do not present any GIC Redistributor structure in MADT for GICv4 | 4 | only if the affected bit is 0 before. |
5 | guests, so that they have no idea about where the Redistributor | ||
6 | register frames are. This fixes a Linux guest crash at boot time with | ||
7 | ACPI enabled and '-machine gic-version=4'. | ||
8 | 5 | ||
9 | While at it, let's convert the remaining hard coded gic_version into | 6 | With this in place, there will be no need for callers to |
10 | enumeration VIRT_GIC_VERSION_2 for consistency. | 7 | do the checking in order to avoid unnecessary writes. |
11 | 8 | ||
12 | Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> | 9 | Signed-off-by: Tong Ho <tong.ho@amd.com> |
13 | Message-id: 20220812022018.1069-1-yuzenghui@huawei.com | 10 | Reviewed-by: Alistair Francis <alistair.francis@wdc.com> |
14 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | 11 | Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> |
12 | Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> | ||
15 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> | 13 | Signed-off-by: Peter Maydell <peter.maydell@linaro.org> |
16 | --- | 14 | --- |
17 | hw/arm/virt-acpi-build.c | 4 ++-- | 15 | hw/nvram/xlnx-efuse.c | 11 +++++++++-- |
18 | 1 file changed, 2 insertions(+), 2 deletions(-) | 16 | 1 file changed, 9 insertions(+), 2 deletions(-) |
19 | 17 | ||
20 | diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c | 18 | diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c |
21 | index XXXXXXX..XXXXXXX 100644 | 19 | index XXXXXXX..XXXXXXX 100644 |
22 | --- a/hw/arm/virt-acpi-build.c | 20 | --- a/hw/nvram/xlnx-efuse.c |
23 | +++ b/hw/arm/virt-acpi-build.c | 21 | +++ b/hw/nvram/xlnx-efuse.c |
24 | @@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) | 22 | @@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k) |
25 | uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ? | 23 | |
26 | PPI(VIRTUAL_PMU_IRQ) : 0; | 24 | bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit) |
27 | 25 | { | |
28 | - if (vms->gic_version == 2) { | 26 | + uint32_t set, *row; |
29 | + if (vms->gic_version == VIRT_GIC_VERSION_2) { | 27 | + |
30 | physical_base_address = memmap[VIRT_GIC_CPU].base; | 28 | if (efuse_ro_bits_find(s, bit)) { |
31 | gicv = memmap[VIRT_GIC_VCPU].base; | 29 | g_autofree char *path = object_get_canonical_path(OBJECT(s)); |
32 | gich = memmap[VIRT_GIC_HYP].base; | 30 | |
33 | @@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) | 31 | @@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit) |
34 | build_append_int_noprefix(table_data, armcpu->mp_affinity, 8); | 32 | return false; |
35 | } | 33 | } |
36 | 34 | ||
37 | - if (vms->gic_version == 3) { | 35 | - s->fuse32[bit / 32] |= 1 << (bit % 32); |
38 | + if (vms->gic_version != VIRT_GIC_VERSION_2) { | 36 | - efuse_bdrv_sync(s, bit); |
39 | build_append_gicr(table_data, memmap[VIRT_GIC_REDIST].base, | 37 | + /* Avoid back-end write unless there is a real update */ |
40 | memmap[VIRT_GIC_REDIST].size); | 38 | + row = &s->fuse32[bit / 32]; |
41 | if (virt_gicv3_redist_region_count(vms) == 2) { | 39 | + set = 1 << (bit % 32); |
40 | + if (!(set & *row)) { | ||
41 | + *row |= set; | ||
42 | + efuse_bdrv_sync(s, bit); | ||
43 | + } | ||
44 | return true; | ||
45 | } | ||
46 | |||
42 | -- | 47 | -- |
43 | 2.25.1 | 48 | 2.34.1 |
49 | |||
50 | diff view generated by jsdifflib |