[PULL 0/2] target-arm queue
[PULL 0/6] target-arm queue
1
This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
1
Hi; here's a target-arm pull for rc2. Four arm-related fixes,
2
we were using uninitialized data for the guarded bit when
2
and a couple of bug fixes for other areas of the codebase
3
combining stage 1 and stage 2 attrs.
3
that seemed like they'd fallen through the cracks.
4
4
5
thanks
5
thanks
6
-- PMM
6
-- PMM
7
7
8
The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:
8
The following changes since commit ccb86f079a9e4d94918086a9df18c1844347aff8:
9
9
10
Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)
10
Merge tag 'pull-nbd-2023-07-28' of https://repo.or.cz/qemu/ericb into staging (2023-07-28 09:56:57 -0700)
11
11
12
are available in the Git repository at:
12
are available in the Git repository at:
13
13
14
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410
14
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230731
15
15
16
for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:
16
for you to fetch changes up to 108e8180c6b0c315711aa54e914030a313505c17:
17
17
18
target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)
18
gdbstub: Fix client Ctrl-C handling (2023-07-31 14:57:32 +0100)
19
19
20
----------------------------------------------------------------
20
----------------------------------------------------------------
21
target-arm: Fix bug where we weren't initializing
21
target-arm queue:
22
guarded bit state when combining S1/S2 attrs
22
* Don't build AArch64 decodetree files for qemu-system-arm
23
* Fix TCG assert in v8.1M CSEL etc
24
* Fix MemOp for STGP
25
* gdbstub: Fix client Ctrl-C handling
26
* kvm: Fix crash due to access uninitialized kvm_state
27
* elf2dmp: Don't abandon when Prcb is set to 0
23
28
24
----------------------------------------------------------------
29
----------------------------------------------------------------
25
Richard Henderson (2):
30
Akihiko Odaki (1):
26
target/arm: PTE bit GP only applies to stage1
31
elf2dmp: Don't abandon when Prcb is set to 0
27
target/arm: Copy guarded bit in combine_cacheattrs
28
32
29
target/arm/ptw.c | 11 ++++++-----
33
Gavin Shan (1):
30
1 file changed, 6 insertions(+), 5 deletions(-)
34
kvm: Fix crash due to access uninitialized kvm_state
35
36
Nicholas Piggin (1):
37
gdbstub: Fix client Ctrl-C handling
38
39
Peter Maydell (2):
40
target/arm: Avoid writing to constant TCGv in trans_CSEL()
41
target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-arm
42
43
Richard Henderson (1):
44
target/arm: Fix MemOp for STGP
45
46
accel/kvm/kvm-all.c | 2 +-
47
contrib/elf2dmp/main.c | 5 +++++
48
gdbstub/gdbstub.c | 13 +++++++++++--
49
target/arm/tcg/translate-a64.c | 21 ++++++++++++++++++---
50
target/arm/tcg/translate.c | 15 ++++++++-------
51
target/arm/tcg/meson.build | 10 +++++++---
52
6 files changed, 50 insertions(+), 16 deletions(-)
diff view generated by jsdifflib
[PULL 1/2] target/arm: PTE bit GP only applies to stage1
[PULL 1/6] target/arm: Fix MemOp for STGP
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Richard Henderson <richard.henderson@linaro.org>
2
2
3
Only perform the extract of GP during the stage1 walk.
3
When converting to decodetree, the code to rebuild mop for the pair
4
only made it into trans_STP and not into trans_STGP.
4
5
5
Reported-by: Peter Maydell <peter.maydell@linaro.org>
6
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1790
7
Fixes: 8c212eb6594 ("target/arm: Convert load/store-pair to decodetree")
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
9
Message-id: 20230726165416.309624-1-richard.henderson@linaro.org
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
12
---
11
target/arm/ptw.c | 10 +++++-----
13
target/arm/tcg/translate-a64.c | 21 ++++++++++++++++++---
12
1 file changed, 5 insertions(+), 5 deletions(-)
14
1 file changed, 18 insertions(+), 3 deletions(-)
13
15
14
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
16
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
15
index XXXXXXX..XXXXXXX 100644
17
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/ptw.c
18
--- a/target/arm/tcg/translate-a64.c
17
+++ b/target/arm/ptw.c
19
+++ b/target/arm/tcg/translate-a64.c
18
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
20
@@ -XXX,XX +XXX,XX @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
19
result->f.attrs.secure = false;
21
MemOp mop;
22
TCGv_i128 tmp;
23
24
+ /* STGP only comes in one size. */
25
+ tcg_debug_assert(a->sz == MO_64);
26
+
27
if (!dc_isar_feature(aa64_mte_insn_reg, s)) {
28
return false;
20
}
29
}
21
30
@@ -XXX,XX +XXX,XX @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
22
- /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
31
gen_helper_stg(cpu_env, dirty_addr, dirty_addr);
23
- if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
24
- result->f.guarded = extract64(attrs, 50, 1); /* GP */
25
- }
26
-
27
if (regime_is_stage2(mmu_idx)) {
28
result->cacheattrs.is_s2_format = true;
29
result->cacheattrs.attrs = extract32(attrs, 2, 4);
30
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
31
assert(attrindx <= 7);
32
result->cacheattrs.is_s2_format = false;
33
result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
34
+
35
+ /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
36
+ if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
37
+ result->f.guarded = extract64(attrs, 50, 1); /* GP */
38
+ }
39
}
32
}
40
33
41
/*
34
- mop = finalize_memop(s, a->sz);
35
- clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << a->sz, mop);
36
+ mop = finalize_memop(s, MO_64);
37
+ clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << MO_64, mop);
38
39
tcg_rt = cpu_reg(s, a->rt);
40
tcg_rt2 = cpu_reg(s, a->rt2);
41
42
- assert(a->sz == 3);
43
+ /*
44
+ * STGP is defined as two 8-byte memory operations and one tag operation.
45
+ * We implement it as one single 16-byte memory operation for convenience.
46
+ * Rebuild mop as for STP.
47
+ * TODO: The atomicity with LSE2 is stronger than required.
48
+ * Need a form of MO_ATOM_WITHIN16_PAIR that never requires
49
+ * 16-byte atomicity.
50
+ */
51
+ mop = MO_128;
52
+ if (s->align_mem) {
53
+ mop |= MO_ALIGN_8;
54
+ }
55
+ mop = finalize_memop_pair(s, mop);
56
57
tmp = tcg_temp_new_i128();
58
if (s->be_data == MO_LE) {
42
--
59
--
43
2.34.1
60
2.34.1
diff view generated by jsdifflib
New patch
[PULL 2/6] elf2dmp: Don't abandon when Prcb is set to 0
1
From: Akihiko Odaki <akihiko.odaki@daynix.com>
1
2
3
Prcb may be set to 0 for some CPUs if the dump was taken before they
4
start. The dump may still contain valuable information for started CPUs
5
so don't abandon conversion in such a case.
6
7
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
8
Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
9
Message-id: 20230611033434.14659-1-akihiko.odaki@daynix.com
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
contrib/elf2dmp/main.c | 5 +++++
13
1 file changed, 5 insertions(+)
14
15
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/contrib/elf2dmp/main.c
18
+++ b/contrib/elf2dmp/main.c
19
@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
20
return 1;
21
}
22
23
+ if (!Prcb) {
24
+ eprintf("Context for CPU #%d is missing\n", i);
25
+ continue;
26
+ }
27
+
28
if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
29
&Context, sizeof(Context), 0)) {
30
eprintf("Failed to read CPU #%d ContextFrame location\n", i);
31
--
32
2.34.1
diff view generated by jsdifflib
New patch
[PULL 3/6] target/arm: Avoid writing to constant TCGv in trans_CSEL()
1
In commit 0b188ea05acb5 we changed the implementation of
2
trans_CSEL() to use tcg_constant_i32(). However, this change
3
was incorrect, because the implementation of the function
4
sets up the TCGv_i32 rn and rm to be either zero or else
5
a TCG temp created in load_reg(), and these TCG temps are
6
then in both cases written to by the emitted TCG ops.
7
The result is that we hit a TCG assertion:
1
8
9
qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed.
10
11
(or on a non-debug build, just produce a garbage result)
12
13
Adjust the code so that rn and rm are always writeable
14
temporaries whether the instruction is using the special
15
case "0" or a normal register as input.
16
17
Cc: qemu-stable@nongnu.org
18
Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL")
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
21
Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
22
---
23
target/arm/tcg/translate.c | 15 ++++++++-------
24
1 file changed, 8 insertions(+), 7 deletions(-)
25
26
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
27
index XXXXXXX..XXXXXXX 100644
28
--- a/target/arm/tcg/translate.c
29
+++ b/target/arm/tcg/translate.c
30
@@ -XXX,XX +XXX,XX @@ static bool trans_IT(DisasContext *s, arg_IT *a)
31
/* v8.1M CSEL/CSINC/CSNEG/CSINV */
32
static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
33
{
34
- TCGv_i32 rn, rm, zero;
35
+ TCGv_i32 rn, rm;
36
DisasCompare c;
37
38
if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
39
@@ -XXX,XX +XXX,XX @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
40
}
41
42
/* In this insn input reg fields of 0b1111 mean "zero", not "PC" */
43
- zero = tcg_constant_i32(0);
44
+ rn = tcg_temp_new_i32();
45
+ rm = tcg_temp_new_i32();
46
if (a->rn == 15) {
47
- rn = zero;
48
+ tcg_gen_movi_i32(rn, 0);
49
} else {
50
- rn = load_reg(s, a->rn);
51
+ load_reg_var(s, rn, a->rn);
52
}
53
if (a->rm == 15) {
54
- rm = zero;
55
+ tcg_gen_movi_i32(rm, 0);
56
} else {
57
- rm = load_reg(s, a->rm);
58
+ load_reg_var(s, rm, a->rm);
59
}
60
61
switch (a->op) {
62
@@ -XXX,XX +XXX,XX @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
63
}
64
65
arm_test_cc(&c, a->fcond);
66
- tcg_gen_movcond_i32(c.cond, rn, c.value, zero, rn, rm);
67
+ tcg_gen_movcond_i32(c.cond, rn, c.value, tcg_constant_i32(0), rn, rm);
68
69
store_reg(s, a->rd, rn);
70
return true;
71
--
72
2.34.1
diff view generated by jsdifflib
New patch
[PULL 4/6] target/arm/tcg: Don't build AArch64 decodetree files for qemu-system-arm
1
Currently we list all the Arm decodetree files together and add them
2
unconditionally to arm_ss. This means we build them for both
3
qemu-system-aarch64 and qemu-system-arm. However, some of them are
4
AArch64-specific, so there is no need to build them for
5
qemu-system-arm. (Meson is smart enough to notice that the generated
6
.c.inc file is not used by any objects that go into qemu-system-arm,
7
so we only unnecessarily run decodetree, not anything more
8
heavyweight like a recompile or relink, but it's still unnecessary
9
work.)
1
10
11
Split gen into gen_a32 and gen_a64, and only add gen_a64 for
12
TARGET_AARCH64 compiles.
13
14
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
15
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
16
Message-id: 20230718104628.1137734-1-peter.maydell@linaro.org
17
---
18
target/arm/tcg/meson.build | 10 +++++++---
19
1 file changed, 7 insertions(+), 3 deletions(-)
20
21
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
22
index XXXXXXX..XXXXXXX 100644
23
--- a/target/arm/tcg/meson.build
24
+++ b/target/arm/tcg/meson.build
25
@@ -XXX,XX +XXX,XX @@
26
-gen = [
27
+gen_a64 = [
28
+ decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
29
decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
30
decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
31
decodetree.process('sme-fa64.decode', extra_args: '--static-decode=disas_sme_fa64'),
32
+]
33
+
34
+gen_a32 = [
35
decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
36
decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
37
decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
38
@@ -XXX,XX +XXX,XX @@ gen = [
39
decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
40
decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
41
decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
42
- decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
43
]
44
45
-arm_ss.add(gen)
46
+arm_ss.add(gen_a32)
47
+arm_ss.add(when: 'TARGET_AARCH64', if_true: gen_a64)
48
49
arm_ss.add(files(
50
'cpu32.c',
51
--
52
2.34.1
53
54
diff view generated by jsdifflib
New patch
[PULL 5/6] kvm: Fix crash due to access uninitialized kvm_state
1
From: Gavin Shan <gshan@redhat.com>
1
2
3
Runs into core dump on arm64 and the backtrace extracted from the
4
core dump is shown as below. It's caused by accessing uninitialized
5
@kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
6
("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
7
memory region is added earlier than before.
8
9
main
10
qemu_init
11
configure_accelerators
12
qemu_opts_foreach
13
do_configure_accelerator
14
accel_init_machine
15
kvm_init
16
virt_kvm_type
17
virt_set_memmap
18
machine_memory_devices_init
19
memory_region_add_subregion
20
memory_region_add_subregion_common
21
memory_region_update_container_subregions
22
memory_region_transaction_begin
23
qemu_flush_coalesced_mmio_buffer
24
kvm_flush_coalesced_mmio_buffer
25
26
Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
27
uninitialized @kvm_state. With this applied, no crash is observed on
28
arm64.
29
30
Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
31
Signed-off-by: Gavin Shan <gshan@redhat.com>
32
Reviewed-by: David Hildenbrand <david@redhat.com>
33
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
34
Message-id: 20230731125946.2038742-1-gshan@redhat.com
35
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
36
---
37
accel/kvm/kvm-all.c | 2 +-
38
1 file changed, 1 insertion(+), 1 deletion(-)
39
40
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
41
index XXXXXXX..XXXXXXX 100644
42
--- a/accel/kvm/kvm-all.c
43
+++ b/accel/kvm/kvm-all.c
44
@@ -XXX,XX +XXX,XX @@ void kvm_flush_coalesced_mmio_buffer(void)
45
{
46
KVMState *s = kvm_state;
47
48
- if (s->coalesced_flush_in_progress) {
49
+ if (!s || s->coalesced_flush_in_progress) {
50
return;
51
}
52
53
--
54
2.34.1
55
56
diff view generated by jsdifflib
[PULL 2/2] target/arm: Copy guarded bit in combine_cacheattrs
[PULL 6/6] gdbstub: Fix client Ctrl-C handling
1
From: Richard Henderson <richard.henderson@linaro.org>
1
From: Nicholas Piggin <npiggin@gmail.com>
2
2
3
The guarded bit comes from the stage1 walk.
3
The gdb remote protocol has a special interrupt character (0x03) that is
4
transmitted outside the regular packet processing, and represents a
5
Ctrl-C pressed in the client. Despite not being a regular packet, it
6
does expect a regular stop response if the stub successfully stops the
7
running program.
4
8
5
Fixes: Coverity CID 1507929
9
See: https://sourceware.org/gdb/onlinedocs/gdb/Interrupts.html
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
10
11
Inhibiting the stop reply packet can lead to gdb client hang. So permit
12
a stop response when receiving a character from gdb that stops the vm.
13
Additionally, add a warning if that was not a 0x03 character, because
14
the gdb session is likely to end up getting confused if this happens.
15
16
Cc: qemu-stable@nongnu.org
17
Fixes: 758370052fb ("gdbstub: only send stop-reply packets when allowed to")
18
Reported-by: Frederic Barrat <fbarrat@linux.ibm.com>
19
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
20
Tested-by: Joel Stanley <joel@jms.id.au>
21
Message-id: 20230711085903.304496-1-npiggin@gmail.com
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
22
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
24
---
11
target/arm/ptw.c | 1 +
25
gdbstub/gdbstub.c | 13 +++++++++++--
12
1 file changed, 1 insertion(+)
26
1 file changed, 11 insertions(+), 2 deletions(-)
13
27
14
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
28
diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
15
index XXXXXXX..XXXXXXX 100644
29
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/ptw.c
30
--- a/gdbstub/gdbstub.c
17
+++ b/target/arm/ptw.c
31
+++ b/gdbstub/gdbstub.c
18
@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
32
@@ -XXX,XX +XXX,XX @@ void gdb_read_byte(uint8_t ch)
19
33
return;
20
assert(!s1.is_s2_format);
34
}
21
ret.is_s2_format = false;
35
if (runstate_is_running()) {
22
+ ret.guarded = s1.guarded;
36
- /* when the CPU is running, we cannot do anything except stop
23
37
- it when receiving a char */
24
if (s1.attrs == 0xf0) {
38
+ /*
25
tagged = true;
39
+ * When the CPU is running, we cannot do anything except stop
40
+ * it when receiving a char. This is expected on a Ctrl-C in the
41
+ * gdb client. Because we are in all-stop mode, gdb sends a
42
+ * 0x03 byte which is not a usual packet, so we handle it specially
43
+ * here, but it does expect a stop reply.
44
+ */
45
+ if (ch != 0x03) {
46
+ warn_report("gdbstub: client sent packet while target running\n");
47
+ }
48
+ gdbserver_state.allow_stop_reply = true;
49
vm_stop(RUN_STATE_PAUSED);
50
} else
51
#endif
26
--
52
--
27
2.34.1
53
2.34.1
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.