Just a collection of bug fixes this time around...

The following changes since commit 2a6ae69154542caa91dd17c40fd3f5ffbec300de:

Merge tag 'pull-maintainer-ominbus-030723-1' of https://gitlab.com/stsquad/qemu into staging (2023-07-04 08:36:44 +0200)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230704

for you to fetch changes up to 86a78272f094857b4eda79d721c116e93942aa9a:

target/xtensa: Assert that interrupt level is within bounds (2023-07-04 14:27:08 +0100)

target-arm queue:

* Add raw_writes ops for register whose write induce TLB maintenance

* hw/arm/sbsa-ref: use XHCI to replace EHCI

* Avoid splitting Zregs across lines in dump

* Dump ZA[] when active

* Fix SME full tile indexing

* Handle IC IVAU to improve compatibility with JITs

* xlnx-canfd-test: Fix code coverity issues

* gdbstub: Guard M-profile code with CONFIG_TCG

* allwinner-sramc: Set class_size

* target/xtensa: Assert that interrupt level is within bounds

Akihiko Odaki (1):

hw: arm: allwinner-sramc: Set class_size

Eric Auger (1):

target/arm: Add raw_writes ops for register whose write induce TLB maintenance

Fabiano Rosas (1):

target/arm: gdbstub: Guard M-profile code with CONFIG_TCG

John Högberg (2):

target/arm: Handle IC IVAU to improve compatibility with JITs

tests/tcg/aarch64: Add testcases for IC IVAU and dual-mapped code

Peter Maydell (1):

target/xtensa: Assert that interrupt level is within bounds

Richard Henderson (3):

target/arm: Avoid splitting Zregs across lines in dump

target/arm: Dump ZA[] when active

target/arm: Fix SME full tile indexing

Vikram Garhwal (1):

tests/qtest: xlnx-canfd-test: Fix code coverity issues

Yuquan Wang (1):

hw/arm/sbsa-ref: use XHCI to replace EHCI

docs/system/arm/sbsa.rst | 5 +-

hw/arm/sbsa-ref.c | 23 +++--

hw/misc/allwinner-sramc.c | 1 +

target/arm/cpu.c | 65 ++++++++-----

target/arm/gdbstub.c | 4 +

target/arm/helper.c | 70 +++++++++++---

target/arm/tcg/translate-sme.c | 24 +++--

target/xtensa/exc_helper.c | 3 +

tests/qtest/xlnx-canfd-test.c | 33 +++----

tests/tcg/aarch64/icivau.c | 189 ++++++++++++++++++++++++++++++++++++++

tests/tcg/aarch64/sme-outprod1.c | 83 +++++++++++++++++

hw/arm/Kconfig | 2 +-

tests/tcg/aarch64/Makefile.target | 13 ++-

13 files changed, 436 insertions(+), 79 deletions(-)

create mode 100644 tests/tcg/aarch64/icivau.c

create mode 100644 tests/tcg/aarch64/sme-outprod1.c

Always print each matrix row whole, one per line, so that we

get the entire matrix in the proper shape.

target/arm/cpu.c | 18 ++++++++++++++++++

1 file changed, 18 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)

i, q[1], q[0], (i & 1 ? "\n" : " "));

}

}

+

+ if (cpu_isar_feature(aa64_sme, cpu) &&

+ FIELD_EX64(env->svcr, SVCR, ZA) &&

+ sme_exception_el(env, el) == 0) {

+ int zcr_len = sve_vqm1_for_el_sm(env, el, true);

+ int svl = (zcr_len + 1) * 16;

+ int svl_lg10 = svl < 100 ? 2 : 3;

+

+ for (i = 0; i < svl; i++) {

+ qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);

+ for (j = zcr_len; j >= 0; --j) {

+ qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",

+ env->zarray[i].d[2 * j + 1],

+ env->zarray[i].d[2 * j],

+ j ? ':' : '\n');

+ }

+ }

+ }

}

#else

For the outer product set of insns, which take an entire matrix

tile as output, the argument is not a combined tile+column.

Therefore using get_tile_rowcol was incorrect, as we extracted

the tile number from itself.

The test case relies only on assembler support for SME, since

no release of GCC recognizes -march=armv9-a+sme yet.

Cc: qemu-stable@nongnu.org

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1620

target/arm/tcg/translate-sme.c | 24 ++++++---

tests/tcg/aarch64/sme-outprod1.c | 83 +++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 10 ++--

3 files changed, 108 insertions(+), 9 deletions(-)

create mode 100644 tests/tcg/aarch64/sme-outprod1.c

diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c

--- a/target/arm/tcg/translate-sme.c

+++ b/target/arm/tcg/translate-sme.c

@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,

return addr;

}

+/*

+ * Resolve tile.size[0] to a host pointer.

+ * Used by e.g. outer product insns where we require the entire tile.

+ */

+static TCGv_ptr get_tile(DisasContext *s, int esz, int tile)

+{

+ TCGv_ptr addr = tcg_temp_new_ptr();

+ int offset;

+

+ offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, zarray);

+

+ tcg_gen_addi_ptr(addr, cpu_env, offset);

+ return addr;

+}

+

static bool trans_ZERO(DisasContext *s, arg_ZERO *a)

{

if (!dc_isar_feature(aa64_sme, s)) {

@@ -XXX,XX +XXX,XX @@ static bool do_adda(DisasContext *s, arg_adda *a, MemOp esz,

return true;

- /* Sum XZR+zad to find ZAd. */

- za = get_tile_rowcol(s, esz, 31, a->zad, false);

+ za = get_tile(s, esz, a->zad);

zn = vec_full_reg_ptr(s, a->zn);

pn = pred_full_reg_ptr(s, a->pn);

pm = pred_full_reg_ptr(s, a->pm);

@@ -XXX,XX +XXX,XX @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz,

return true;

}

- /* Sum XZR+zad to find ZAd. */

- za = get_tile_rowcol(s, esz, 31, a->zad, false);

+ za = get_tile(s, esz, a->zad);

zn = vec_full_reg_ptr(s, a->zn);

zm = vec_full_reg_ptr(s, a->zm);

pn = pred_full_reg_ptr(s, a->pn);

@@ -XXX,XX +XXX,XX @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,

return true;

}

- /* Sum XZR+zad to find ZAd. */

- za = get_tile_rowcol(s, esz, 31, a->zad, false);

+ za = get_tile(s, esz, a->zad);

zn = vec_full_reg_ptr(s, a->zn);

zm = vec_full_reg_ptr(s, a->zm);

pn = pred_full_reg_ptr(s, a->pn);

diff --git a/tests/tcg/aarch64/sme-outprod1.c b/tests/tcg/aarch64/sme-outprod1.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/aarch64/sme-outprod1.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * SME outer product, 1 x 1.

+ * SPDX-License-Identifier: GPL-2.0-or-later

+ */

+

+#include <stdio.h>

+

+extern void foo(float *dst);

+

+asm(

+"    .arch_extension sme\n"

+"    .type foo, @function\n"

+"foo:\n"

+"    stp x29, x30, [sp, -80]!\n"

+"    mov x29, sp\n"

+"    stp d8, d9, [sp, 16]\n"

+"    stp d10, d11, [sp, 32]\n"

+"    stp d12, d13, [sp, 48]\n"

+"    stp d14, d15, [sp, 64]\n"

+"    smstart\n"

+"    ptrue p0.s, vl4\n"

+"    fmov z0.s, #1.0\n"

+/*

+ * An outer product of a vector of 1.0 by itself should be a matrix of 1.0.

+ * Note that we are using tile 1 here (za1.s) rather than tile 0.

+ */

+"    zero {za}\n"

+"    fmopa za1.s, p0/m, p0/m, z0.s, z0.s\n"

+/*

+ * Read the first 4x4 sub-matrix of elements from tile 1:

+ * Note that za1h should be interchangable here.

+ */

+"    mov w12, #0\n"

+"    mova z0.s, p0/m, za1v.s[w12, #0]\n"

+"    mova z1.s, p0/m, za1v.s[w12, #1]\n"

+"    mova z2.s, p0/m, za1v.s[w12, #2]\n"

+"    mova z3.s, p0/m, za1v.s[w12, #3]\n"

+/*

+ * And store them to the input pointer (dst in the C code):

+ */

+"    st1w {z0.s}, p0, [x0]\n"

+"    add x0, x0, #16\n"

+"    st1w {z1.s}, p0, [x0]\n"

+"    add x0, x0, #16\n"

+"    st1w {z2.s}, p0, [x0]\n"

+"    add x0, x0, #16\n"

+"    st1w {z3.s}, p0, [x0]\n"

+"    smstop\n"

+"    ldp d8, d9, [sp, 16]\n"

+"    ldp d10, d11, [sp, 32]\n"

+"    ldp d12, d13, [sp, 48]\n"

+"    ldp d14, d15, [sp, 64]\n"

+"    ldp x29, x30, [sp], 80\n"

+"    ret\n"

+"    .size foo, . - foo"

+);

+

+int main()

+{

+ float dst[16];

+ int i, j;

+

+ foo(dst);

+

+ for (i = 0; i < 16; i++) {

+ if (dst[i] != 1.0f) {

+ break;

+ }

+

+ if (i == 16) {

+ return 0; /* success */

+ }

+

+ /* failure */

+ for (i = 0; i < 4; ++i) {

+ for (j = 0; j < 4; ++j) {

+ printf("%f ", (double)dst[i * 4 + j]);

+ }

+ printf("\n");

+ }

+ return 1;

+}

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/Makefile.target

+++ b/tests/tcg/aarch64/Makefile.target

@@ -XXX,XX +XXX,XX @@ config-cc.mak: Makefile

     $(call cc-option,-march=armv8.5-a, CROSS_CC_HAS_ARMV8_5); \

     $(call cc-option,-mbranch-protection=standard, CROSS_CC_HAS_ARMV8_BTI); \

     $(call cc-option,-march=armv8.5-a+memtag, CROSS_CC_HAS_ARMV8_MTE); \

-     $(call cc-option,-march=armv9-a+sme, CROSS_CC_HAS_ARMV9_SME)) 3> config-cc.mak

+     $(call cc-option,-Wa$(COMMA)-march=armv9-a+sme, CROSS_AS_HAS_ARMV9_SME)) 3> config-cc.mak

-include config-cc.mak

ifneq ($(CROSS_CC_HAS_ARMV8_2),)

@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7

mte-%: CFLAGS += -march=armv8.5-a+memtag

endif

+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)

+AARCH64_TESTS += sme-outprod1

+endif

+

ifneq ($(CROSS_CC_HAS_SVE),)

# System Registers Tests

AARCH64_TESTS += sysregs

-ifneq ($(CROSS_CC_HAS_ARMV9_SME),)

-sysregs: CFLAGS+=-march=armv9-a+sme -DHAS_ARMV9_SME

+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)

+sysregs: CFLAGS+=-Wa,-march=armv9-a+sme -DHAS_ARMV9_SME

else

sysregs: CFLAGS+=-march=armv8.1-a+sve

endif

From: John Högberg <john.hogberg@ericsson.com>

https://gitlab.com/qemu-project/qemu/-/issues/1034

Signed-off-by: John Högberg <john.hogberg@ericsson.com>

Message-id: 168778890374.24232.3402138851538068785-2@git.sr.ht

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

[PMM: fixed typo in comment]

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

tests/tcg/aarch64/icivau.c | 189 ++++++++++++++++++++++++++++++

tests/tcg/aarch64/Makefile.target | 3 +-

2 files changed, 191 insertions(+), 1 deletion(-)

create mode 100644 tests/tcg/aarch64/icivau.c

diff --git a/tests/tcg/aarch64/icivau.c b/tests/tcg/aarch64/icivau.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/tcg/aarch64/icivau.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * Tests the IC IVAU-driven workaround for catching changes made to dual-mapped

+ * code that would otherwise go unnoticed in user mode.

+ *

+ * Copyright (c) 2023 Ericsson AB

+ * SPDX-License-Identifier: GPL-2.0-or-later

+ */

+

+#include <sys/mman.h>

+#include <sys/stat.h>

+#include <string.h>

+#include <stdint.h>

+#include <stdlib.h>

+#include <unistd.h>

+#include <fcntl.h>

+

+#define MAX_CODE_SIZE 128

+

+typedef int (SelfModTest)(uint32_t, uint32_t*);

+typedef int (BasicTest)(int);

+

+static void mark_code_modified(const uint32_t *exec_data, size_t length)

+{

+ int dc_required, ic_required;

+ unsigned long ctr_el0;

+

+ /*

+ * Clear the data/instruction cache, as indicated by the CTR_ELO.{DIC,IDC}

+ * flags.

+ *

+ * For completeness we might be tempted to assert that we should fail when

+ * the whole code update sequence is omitted, but that would make the test

+ * flaky as it can succeed by coincidence on actual hardware.

+ */

+ asm ("mrs %0, ctr_el0\n" : "=r"(ctr_el0));

+

+ /* CTR_EL0.IDC */

+ dc_required = !((ctr_el0 >> 28) & 1);

+

+ /* CTR_EL0.DIC */

+ ic_required = !((ctr_el0 >> 29) & 1);

+

+ if (dc_required) {

+ size_t dcache_stride, i;

+

+ /*

+ * Step according to the minimum cache size, as the cache maintenance

+ * instructions operate on the cache line of the given address.

+ *

+ * We assume that exec_data is properly aligned.

+ */

+ dcache_stride = (4 << ((ctr_el0 >> 16) & 0xF));

+

+ for (i = 0; i < length; i += dcache_stride) {

+ const char *dc_addr = &((const char *)exec_data)[i];

+ asm volatile ("dc cvau, %x[dc_addr]\n"

+ : /* no outputs */

+ : [dc_addr] "r"(dc_addr)

+ : "memory");

+ }

+

+ asm volatile ("dmb ish\n");

+ }

+

+ if (ic_required) {

+ size_t icache_stride, i;

+

+ icache_stride = (4 << (ctr_el0 & 0xF));

+

+ for (i = 0; i < length; i += icache_stride) {

+ const char *ic_addr = &((const char *)exec_data)[i];

+ asm volatile ("ic ivau, %x[ic_addr]\n"

+ : /* no outputs */

+ : [ic_addr] "r"(ic_addr)

+ : "memory");

+ }

+

+ asm volatile ("dmb ish\n");

+ }

+

+ asm volatile ("isb sy\n");

+}

+

+static int basic_test(uint32_t *rw_data, const uint32_t *exec_data)

+{

+ /*

+ * As user mode only misbehaved for dual-mapped code when previously

+ * translated code had been changed, we'll start off with this basic test

+ * function to ensure that there's already some translated code at

+ * exec_data before the next test. This should cause the next test to fail

+ * if `mark_code_modified` fails to invalidate the code.

+ *

+ * Note that the payload is in binary form instead of inline assembler

+ * because we cannot use __attribute__((naked)) on this platform and the

+ * workarounds are at least as ugly as this is.

+ */

+ static const uint32_t basic_payload[] = {

+ 0xD65F03C0 /* 0x00: RET */

+ };

+

+ BasicTest *copied_ptr = (BasicTest *)exec_data;

+

+ memcpy(rw_data, basic_payload, sizeof(basic_payload));

+ mark_code_modified(exec_data, sizeof(basic_payload));

+

+ return copied_ptr(1234) == 1234;

+}

+

+static int self_modification_test(uint32_t *rw_data, const uint32_t *exec_data)

+{

+ /*

+ * This test is self-modifying in an attempt to cover an edge case where

+ * the IC IVAU instruction invalidates itself.

+ *

+ * Note that the IC IVAU instruction is 16 bytes into the function, in what

+ * will be the same cache line as the modified instruction on machines with

+ * a cache line size >= 16 bytes.

+ */

+ static const uint32_t self_mod_payload[] = {

+ /* Overwrite the placeholder instruction with the new one. */

+ 0xB9001C20, /* 0x00: STR w0, [x1, 0x1C] */

+

+ /* Get the executable address of the modified instruction. */

+ 0x100000A8, /* 0x04: ADR x8, <0x1C> */

+

+ /* Mark the modified instruction as updated. */

+ 0xD50B7B28, /* 0x08: DC CVAU x8 */

+ 0xD5033BBF, /* 0x0C: DMB ISH */

+ 0xD50B7528, /* 0x10: IC IVAU x8 */

+ 0xD5033BBF, /* 0x14: DMB ISH */

+ 0xD5033FDF, /* 0x18: ISB */

+

+ /* Placeholder instruction, overwritten above. */

+ 0x52800000, /* 0x1C: MOV w0, 0 */

+

+ 0xD65F03C0 /* 0x20: RET */

+ };

+

+ SelfModTest *copied_ptr = (SelfModTest *)exec_data;

+ int i;

+

+ memcpy(rw_data, self_mod_payload, sizeof(self_mod_payload));

+ mark_code_modified(exec_data, sizeof(self_mod_payload));

+

+ for (i = 1; i < 10; i++) {

+ /* Replace the placeholder instruction with `MOV w0, i` */

+ uint32_t new_instr = 0x52800000 | (i << 5);

+

+ if (copied_ptr(new_instr, rw_data) != i) {

+ return 0;

+ }

+ }

+

+ return 1;

+}

+

+int main(int argc, char **argv)

+{

+ const char *shm_name = "qemu-test-tcg-aarch64-icivau";

+ int fd;

+

+ fd = shm_open(shm_name, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);

+

+ if (fd < 0) {

+ return EXIT_FAILURE;

+ }

+

+ /* Unlink early to avoid leaving garbage in case the test crashes. */

+ shm_unlink(shm_name);

+

+ if (ftruncate(fd, MAX_CODE_SIZE) == 0) {

+ const uint32_t *exec_data;

+ uint32_t *rw_data;

+

+ rw_data = mmap(0, MAX_CODE_SIZE, PROT_READ | PROT_WRITE,

+ MAP_SHARED, fd, 0);

+ exec_data = mmap(0, MAX_CODE_SIZE, PROT_READ | PROT_EXEC,

+ MAP_SHARED, fd, 0);

+

+ if (rw_data && exec_data) {

+ if (basic_test(rw_data, exec_data) &&

+ self_modification_test(rw_data, exec_data)) {

+ return EXIT_SUCCESS;

+ }

+ }

+ }

+

+ return EXIT_FAILURE;

+}

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/Makefile.target

+++ b/tests/tcg/aarch64/Makefile.target

@@ -XXX,XX +XXX,XX @@ AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64

VPATH         += $(AARCH64_SRC)

# Base architecture tests

-AARCH64_TESTS=fcvt pcalign-a64

+AARCH64_TESTS=fcvt pcalign-a64 icivau

fcvt: LDFLAGS+=-lm

+icivau: LDFLAGS+=-lrt

run-fcvt: fcvt

    $(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")

--

2.34.1