[PULL 00/11] target-arm queue
[PULL v2 00/29] target-arm queue
1
Just a collection of bug fixes this time around...
1
v2: drop pvpanic-pci patches.
2
2
3
thanks
3
The following changes since commit f1fcb6851aba6dd9838886dc179717a11e344a1c:
4
-- PMM
5
4
6
The following changes since commit 2a6ae69154542caa91dd17c40fd3f5ffbec300de:
5
Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2021-01-19' into staging (2021-01-19 11:57:07 +0000)
7
8
Merge tag 'pull-maintainer-ominbus-030723-1' of https://gitlab.com/stsquad/qemu into staging (2023-07-04 08:36:44 +0200)
9
6
10
are available in the Git repository at:
7
are available in the Git repository at:
11
8
12
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230704
9
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210119-1
13
10
14
for you to fetch changes up to 86a78272f094857b4eda79d721c116e93942aa9a:
11
for you to fetch changes up to b93f4fbdc48283a39089469c44a5529d79dc40a8:
15
12
16
target/xtensa: Assert that interrupt level is within bounds (2023-07-04 14:27:08 +0100)
13
docs: Build and install all the docs in a single manual (2021-01-19 15:45:14 +0000)
17
14
18
----------------------------------------------------------------
15
----------------------------------------------------------------
19
target-arm queue:
16
target-arm queue:
20
* Add raw_writes ops for register whose write induce TLB maintenance
17
* Implement IMPDEF pauth algorithm
21
* hw/arm/sbsa-ref: use XHCI to replace EHCI
18
* Support ARMv8.4-SEL2
22
* Avoid splitting Zregs across lines in dump
19
* Fix bug where we were truncating predicate vector lengths in SVE insns
23
* Dump ZA[] when active
20
* npcm7xx_adc-test: Fix memleak in adc_qom_set
24
* Fix SME full tile indexing
21
* target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
25
* Handle IC IVAU to improve compatibility with JITs
22
* docs: Build and install all the docs in a single manual
26
* xlnx-canfd-test: Fix code coverity issues
27
* gdbstub: Guard M-profile code with CONFIG_TCG
28
* allwinner-sramc: Set class_size
29
* target/xtensa: Assert that interrupt level is within bounds
30
23
31
----------------------------------------------------------------
24
----------------------------------------------------------------
32
Akihiko Odaki (1):
25
Gan Qixin (1):
33
hw: arm: allwinner-sramc: Set class_size
26
npcm7xx_adc-test: Fix memleak in adc_qom_set
34
35
Eric Auger (1):
36
target/arm: Add raw_writes ops for register whose write induce TLB maintenance
37
38
Fabiano Rosas (1):
39
target/arm: gdbstub: Guard M-profile code with CONFIG_TCG
40
41
John Högberg (2):
42
target/arm: Handle IC IVAU to improve compatibility with JITs
43
tests/tcg/aarch64: Add testcases for IC IVAU and dual-mapped code
44
27
45
Peter Maydell (1):
28
Peter Maydell (1):
46
target/xtensa: Assert that interrupt level is within bounds
29
docs: Build and install all the docs in a single manual
47
30
48
Richard Henderson (3):
31
Philippe Mathieu-Daudé (1):
49
target/arm: Avoid splitting Zregs across lines in dump
32
target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
50
target/arm: Dump ZA[] when active
51
target/arm: Fix SME full tile indexing
52
33
53
Vikram Garhwal (1):
34
Richard Henderson (7):
54
tests/qtest: xlnx-canfd-test: Fix code coverity issues
35
target/arm: Implement an IMPDEF pauth algorithm
36
target/arm: Add cpu properties to control pauth
37
target/arm: Use object_property_add_bool for "sve" property
38
target/arm: Introduce PREDDESC field definitions
39
target/arm: Update PFIRST, PNEXT for pred_desc
40
target/arm: Update ZIP, UZP, TRN for pred_desc
41
target/arm: Update REV, PUNPK for pred_desc
55
42
56
Yuquan Wang (1):
43
Rémi Denis-Courmont (19):
57
hw/arm/sbsa-ref: use XHCI to replace EHCI
44
target/arm: remove redundant tests
45
target/arm: add arm_is_el2_enabled() helper
46
target/arm: use arm_is_el2_enabled() where applicable
47
target/arm: use arm_hcr_el2_eff() where applicable
48
target/arm: factor MDCR_EL2 common handling
49
target/arm: Define isar_feature function to test for presence of SEL2
50
target/arm: add 64-bit S-EL2 to EL exception table
51
target/arm: add MMU stage 1 for Secure EL2
52
target/arm: add ARMv8.4-SEL2 system registers
53
target/arm: handle VMID change in secure state
54
target/arm: do S1_ptw_translate() before address space lookup
55
target/arm: translate NS bit in page-walks
56
target/arm: generalize 2-stage page-walk condition
57
target/arm: secure stage 2 translation regime
58
target/arm: set HPFAR_EL2.NS on secure stage 2 faults
59
target/arm: revector to run-time pick target EL
60
target/arm: Implement SCR_EL2.EEL2
61
target/arm: enable Secure EL2 in max CPU
62
target/arm: refactor vae1_tlbmask()
58
63
59
docs/system/arm/sbsa.rst | 5 +-
64
docs/conf.py | 46 ++++-
60
hw/arm/sbsa-ref.c | 23 +++--
65
docs/devel/conf.py | 15 --
61
hw/misc/allwinner-sramc.c | 1 +
66
docs/index.html.in | 17 --
62
target/arm/cpu.c | 65 ++++++++-----
67
docs/interop/conf.py | 28 ---
63
target/arm/gdbstub.c | 4 +
68
docs/meson.build | 64 +++---
64
target/arm/helper.c | 70 +++++++++++---
69
docs/specs/conf.py | 16 --
65
target/arm/tcg/translate-sme.c | 24 +++--
70
docs/system/arm/cpu-features.rst | 21 ++
66
target/xtensa/exc_helper.c | 3 +
71
docs/system/conf.py | 28 ---
67
tests/qtest/xlnx-canfd-test.c | 33 +++----
72
docs/tools/conf.py | 37 ----
68
tests/tcg/aarch64/icivau.c | 189 ++++++++++++++++++++++++++++++++++++++
73
docs/user/conf.py | 15 --
69
tests/tcg/aarch64/sme-outprod1.c | 83 +++++++++++++++++
74
include/qemu/xxhash.h | 98 +++++++++
70
hw/arm/Kconfig | 2 +-
75
target/arm/cpu-param.h | 2 +-
71
tests/tcg/aarch64/Makefile.target | 13 ++-
76
target/arm/cpu.h | 107 ++++++++--
72
13 files changed, 436 insertions(+), 79 deletions(-)
77
target/arm/internals.h | 45 +++++
73
create mode 100644 tests/tcg/aarch64/icivau.c
78
target/arm/cpu.c | 23 ++-
74
create mode 100644 tests/tcg/aarch64/sme-outprod1.c
79
target/arm/cpu64.c | 65 ++++--
80
target/arm/helper-a64.c | 8 +-
81
target/arm/helper.c | 414 ++++++++++++++++++++++++++-------------
82
target/arm/m_helper.c | 2 +-
83
target/arm/monitor.c | 1 +
84
target/arm/op_helper.c | 4 +-
85
target/arm/pauth_helper.c | 27 ++-
86
target/arm/sve_helper.c | 33 ++--
87
target/arm/tlb_helper.c | 3 +
88
target/arm/translate-a64.c | 4 +
89
target/arm/translate-sve.c | 31 ++-
90
target/arm/translate.c | 36 +++-
91
tests/qtest/arm-cpu-features.c | 13 ++
92
tests/qtest/npcm7xx_adc-test.c | 1 +
93
.gitlab-ci.yml | 4 +-
94
30 files changed, 770 insertions(+), 438 deletions(-)
95
delete mode 100644 docs/devel/conf.py
96
delete mode 100644 docs/index.html.in
97
delete mode 100644 docs/interop/conf.py
98
delete mode 100644 docs/specs/conf.py
99
delete mode 100644 docs/system/conf.py
100
delete mode 100644 docs/tools/conf.py
101
delete mode 100644 docs/user/conf.py
75
102
diff view generated by jsdifflib
[PULL 01/11] target/arm: Add raw_writes ops for register whose write induce TLB maintenance
Deleted patch
1
From: Eric Auger <eric.auger@redhat.com>
2
1
3
Some registers whose 'cooked' writefns induce TLB maintenance do
4
not have raw_writefn ops defined. If only the writefn ops is set
5
(ie. no raw_writefn is provided), it is assumed the cooked also
6
work as the raw one. For those registers it is not obvious the
7
tlb_flush works on KVM mode so better/safer setting the raw write.
8
9
Signed-off-by: Eric Auger <eric.auger@redhat.com>
10
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
11
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
12
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
13
---
14
target/arm/helper.c | 23 +++++++++++++----------
15
1 file changed, 13 insertions(+), 10 deletions(-)
16
17
diff --git a/target/arm/helper.c b/target/arm/helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/arm/helper.c
20
+++ b/target/arm/helper.c
21
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
22
.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
23
.access = PL1_RW, .accessfn = access_tvm_trvm,
24
.fgt = FGT_TTBR0_EL1,
25
- .writefn = vmsa_ttbr_write, .resetvalue = 0,
26
+ .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
27
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
28
offsetof(CPUARMState, cp15.ttbr0_ns) } },
29
{ .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
30
.opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
31
.access = PL1_RW, .accessfn = access_tvm_trvm,
32
.fgt = FGT_TTBR1_EL1,
33
- .writefn = vmsa_ttbr_write, .resetvalue = 0,
34
+ .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
35
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
36
offsetof(CPUARMState, cp15.ttbr1_ns) } },
37
{ .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
38
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
39
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
40
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
41
offsetof(CPUARMState, cp15.ttbr0_ns) },
42
- .writefn = vmsa_ttbr_write, },
43
+ .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
44
{ .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
45
.access = PL1_RW, .accessfn = access_tvm_trvm,
46
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
47
.bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
48
offsetof(CPUARMState, cp15.ttbr1_ns) },
49
- .writefn = vmsa_ttbr_write, },
50
+ .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
51
};
52
53
static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
54
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
55
.type = ARM_CP_IO,
56
.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
57
.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
58
- .writefn = hcr_write },
59
+ .writefn = hcr_write, .raw_writefn = raw_write },
60
{ .name = "HCR", .state = ARM_CP_STATE_AA32,
61
.type = ARM_CP_ALIAS | ARM_CP_IO,
62
.cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
63
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
64
{ .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
65
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
66
.access = PL2_RW, .writefn = vmsa_tcr_el12_write,
67
+ .raw_writefn = raw_write,
68
.fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
69
{ .name = "VTCR", .state = ARM_CP_STATE_AA32,
70
.cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
71
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
72
.type = ARM_CP_64BIT | ARM_CP_ALIAS,
73
.access = PL2_RW, .accessfn = access_el3_aa32ns,
74
.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
75
- .writefn = vttbr_write },
76
+ .writefn = vttbr_write, .raw_writefn = raw_write },
77
{ .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
78
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
79
- .access = PL2_RW, .writefn = vttbr_write,
80
+ .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write,
81
.fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
82
{ .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
83
.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
84
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
85
.fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
86
{ .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
87
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
88
- .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write,
89
+ .access = PL2_RW, .resetvalue = 0,
90
+ .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write,
91
.fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
92
{ .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
93
.access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
94
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
95
{ .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
96
.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
97
.access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
98
- .resetfn = scr_reset, .writefn = scr_write },
99
+ .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write },
100
{ .name = "SCR", .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
101
.cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
102
.access = PL1_RW, .accessfn = access_trap_aa32s_el1,
103
.fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
104
- .writefn = scr_write },
105
+ .writefn = scr_write, .raw_writefn = raw_write },
106
{ .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
107
.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
108
.access = PL3_RW, .resetvalue = 0,
109
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
110
{ .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
111
.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
112
.access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
113
+ .raw_writefn = raw_write,
114
.fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) },
115
#ifndef CONFIG_USER_ONLY
116
{ .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64,
117
--
118
2.34.1
diff view generated by jsdifflib
[PULL 02/11] hw/arm/sbsa-ref: use XHCI to replace EHCI
Deleted patch
1
From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
2
1
3
The current sbsa-ref cannot use EHCI controller which is only
4
able to do 32-bit DMA, since sbsa-ref doesn't have RAM below 4GB.
5
Hence, this uses XHCI to provide a usb controller with 64-bit
6
DMA capablity instead of EHCI.
7
8
We bump the platform version to 0.3 with this change. Although the
9
hardware at the USB controller address changes, the firmware and
10
Linux can both cope with this -- on an older non-XHCI-aware
11
firmware/kernel setup the probe routine simply fails and the guest
12
proceeds without any USB. (This isn't a loss of functionality,
13
because the old USB controller never worked in the first place.) So
14
we can call this a backwards-compatible change and only bump the
15
minor version.
16
17
Signed-off-by: Yuquan Wang <wangyuquan1236@phytium.com.cn>
18
Message-id: 20230621103847.447508-2-wangyuquan1236@phytium.com.cn
19
[PMM: tweaked commit message; add line to docs about what
20
changes in platform version 0.3]
21
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
22
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
23
---
24
docs/system/arm/sbsa.rst | 5 ++++-
25
hw/arm/sbsa-ref.c | 23 +++++++++++++----------
26
hw/arm/Kconfig | 2 +-
27
3 files changed, 18 insertions(+), 12 deletions(-)
28
29
diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
30
index XXXXXXX..XXXXXXX 100644
31
--- a/docs/system/arm/sbsa.rst
32
+++ b/docs/system/arm/sbsa.rst
33
@@ -XXX,XX +XXX,XX @@ The ``sbsa-ref`` board supports:
34
- A configurable number of AArch64 CPUs
35
- GIC version 3
36
- System bus AHCI controller
37
- - System bus EHCI controller
38
+ - System bus XHCI controller
39
- CDROM and hard disc on AHCI bus
40
- E1000E ethernet card on PCIe bus
41
- Bochs display adapter on PCIe bus
42
@@ -XXX,XX +XXX,XX @@ Platform version changes:
43
44
0.2
45
GIC ITS information is present in devicetree.
46
+
47
+0.3
48
+ The USB controller is an XHCI device, not EHCI
49
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
50
index XXXXXXX..XXXXXXX 100644
51
--- a/hw/arm/sbsa-ref.c
52
+++ b/hw/arm/sbsa-ref.c
53
@@ -XXX,XX +XXX,XX @@
54
#include "hw/pci-host/gpex.h"
55
#include "hw/qdev-properties.h"
56
#include "hw/usb.h"
57
+#include "hw/usb/xhci.h"
58
#include "hw/char/pl011.h"
59
#include "hw/watchdog/sbsa_gwdt.h"
60
#include "net/net.h"
61
@@ -XXX,XX +XXX,XX @@ enum {
62
SBSA_SECURE_UART_MM,
63
SBSA_SECURE_MEM,
64
SBSA_AHCI,
65
- SBSA_EHCI,
66
+ SBSA_XHCI,
67
};
68
69
struct SBSAMachineState {
70
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sbsa_ref_memmap[] = {
71
[SBSA_SMMU] = { 0x60050000, 0x00020000 },
72
/* Space here reserved for more SMMUs */
73
[SBSA_AHCI] = { 0x60100000, 0x00010000 },
74
- [SBSA_EHCI] = { 0x60110000, 0x00010000 },
75
+ [SBSA_XHCI] = { 0x60110000, 0x00010000 },
76
/* Space here reserved for other devices */
77
[SBSA_PCIE_PIO] = { 0x7fff0000, 0x00010000 },
78
/* 32-bit address PCIE MMIO space */
79
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
80
[SBSA_SECURE_UART] = 8,
81
[SBSA_SECURE_UART_MM] = 9,
82
[SBSA_AHCI] = 10,
83
- [SBSA_EHCI] = 11,
84
+ [SBSA_XHCI] = 11,
85
[SBSA_SMMU] = 12, /* ... to 15 */
86
[SBSA_GWDT_WS0] = 16,
87
};
88
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
89
* fw compatibility.
90
*/
91
qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
92
- qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
93
+ qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 3);
94
95
if (ms->numa_state->have_numa_distance) {
96
int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
97
@@ -XXX,XX +XXX,XX @@ static void create_ahci(const SBSAMachineState *sms)
98
}
99
}
100
101
-static void create_ehci(const SBSAMachineState *sms)
102
+static void create_xhci(const SBSAMachineState *sms)
103
{
104
- hwaddr base = sbsa_ref_memmap[SBSA_EHCI].base;
105
- int irq = sbsa_ref_irqmap[SBSA_EHCI];
106
+ hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
107
+ int irq = sbsa_ref_irqmap[SBSA_XHCI];
108
+ DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
109
110
- sysbus_create_simple("platform-ehci-usb", base,
111
- qdev_get_gpio_in(sms->gic, irq));
112
+ sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
113
+ sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
114
+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(sms->gic, irq));
115
}
116
117
static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
118
@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
119
120
create_ahci(sms);
121
122
- create_ehci(sms);
123
+ create_xhci(sms);
124
125
create_pcie(sms);
126
127
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
128
index XXXXXXX..XXXXXXX 100644
129
--- a/hw/arm/Kconfig
130
+++ b/hw/arm/Kconfig
131
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
132
select PL011 # UART
133
select PL031 # RTC
134
select PL061 # GPIO
135
- select USB_EHCI_SYSBUS
136
+ select USB_XHCI_SYSBUS
137
select WDT_SBSA
138
select BOCHS_DISPLAY
139
140
--
141
2.34.1
diff view generated by jsdifflib
[PULL 03/11] target/arm: Avoid splitting Zregs across lines in dump
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Allow the line length to extend to 548 columns. While annoyingly wide,
4
it's still less confusing than the continuations we print. Also, the
5
default VL used by Linux (and max for A64FX) uses only 140 columns.
6
7
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
8
Message-id: 20230622151201.1578522-2-richard.henderson@linaro.org
9
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
---
12
target/arm/cpu.c | 36 ++++++++++++++----------------------
13
1 file changed, 14 insertions(+), 22 deletions(-)
14
15
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
16
index XXXXXXX..XXXXXXX 100644
17
--- a/target/arm/cpu.c
18
+++ b/target/arm/cpu.c
19
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
20
ARMCPU *cpu = ARM_CPU(cs);
21
CPUARMState *env = &cpu->env;
22
uint32_t psr = pstate_read(env);
23
- int i;
24
+ int i, j;
25
int el = arm_current_el(env);
26
const char *ns_status;
27
bool sve;
28
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
29
}
30
31
if (sve) {
32
- int j, zcr_len = sve_vqm1_for_el(env, el);
33
+ int zcr_len = sve_vqm1_for_el(env, el);
34
35
for (i = 0; i <= FFR_PRED_NUM; i++) {
36
bool eol;
37
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
38
}
39
}
40
41
- for (i = 0; i < 32; i++) {
42
- if (zcr_len == 0) {
43
+ if (zcr_len == 0) {
44
+ /*
45
+ * With vl=16, there are only 37 columns per register,
46
+ * so output two registers per line.
47
+ */
48
+ for (i = 0; i < 32; i++) {
49
qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64 "%s",
50
i, env->vfp.zregs[i].d[1],
51
env->vfp.zregs[i].d[0], i & 1 ? "\n" : " ");
52
- } else if (zcr_len == 1) {
53
- qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64
54
- ":%016" PRIx64 ":%016" PRIx64 "\n",
55
- i, env->vfp.zregs[i].d[3], env->vfp.zregs[i].d[2],
56
- env->vfp.zregs[i].d[1], env->vfp.zregs[i].d[0]);
57
- } else {
58
+ }
59
+ } else {
60
+ for (i = 0; i < 32; i++) {
61
+ qemu_fprintf(f, "Z%02d=", i);
62
for (j = zcr_len; j >= 0; j--) {
63
- bool odd = (zcr_len - j) % 2 != 0;
64
- if (j == zcr_len) {
65
- qemu_fprintf(f, "Z%02d[%x-%x]=", i, j, j - 1);
66
- } else if (!odd) {
67
- if (j > 0) {
68
- qemu_fprintf(f, " [%x-%x]=", j, j - 1);
69
- } else {
70
- qemu_fprintf(f, " [%x]=", j);
71
- }
72
- }
73
qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%s",
74
env->vfp.zregs[i].d[j * 2 + 1],
75
- env->vfp.zregs[i].d[j * 2],
76
- odd || j == 0 ? "\n" : ":");
77
+ env->vfp.zregs[i].d[j * 2 + 0],
78
+ j ? ":" : "\n");
79
}
80
}
81
}
82
--
83
2.34.1
diff view generated by jsdifflib
[PULL 04/11] target/arm: Dump ZA[] when active
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
Always print each matrix row whole, one per line, so that we
4
get the entire matrix in the proper shape.
5
6
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
7
Message-id: 20230622151201.1578522-3-richard.henderson@linaro.org
8
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
target/arm/cpu.c | 18 ++++++++++++++++++
12
1 file changed, 18 insertions(+)
13
14
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
15
index XXXXXXX..XXXXXXX 100644
16
--- a/target/arm/cpu.c
17
+++ b/target/arm/cpu.c
18
@@ -XXX,XX +XXX,XX @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
19
i, q[1], q[0], (i & 1 ? "\n" : " "));
20
}
21
}
22
+
23
+ if (cpu_isar_feature(aa64_sme, cpu) &&
24
+ FIELD_EX64(env->svcr, SVCR, ZA) &&
25
+ sme_exception_el(env, el) == 0) {
26
+ int zcr_len = sve_vqm1_for_el_sm(env, el, true);
27
+ int svl = (zcr_len + 1) * 16;
28
+ int svl_lg10 = svl < 100 ? 2 : 3;
29
+
30
+ for (i = 0; i < svl; i++) {
31
+ qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);
32
+ for (j = zcr_len; j >= 0; --j) {
33
+ qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",
34
+ env->zarray[i].d[2 * j + 1],
35
+ env->zarray[i].d[2 * j],
36
+ j ? ':' : '\n');
37
+ }
38
+ }
39
+ }
40
}
41
42
#else
43
--
44
2.34.1
diff view generated by jsdifflib
[PULL 05/11] target/arm: Fix SME full tile indexing
Deleted patch
1
From: Richard Henderson <richard.henderson@linaro.org>
2
1
3
For the outer product set of insns, which take an entire matrix
4
tile as output, the argument is not a combined tile+column.
5
Therefore using get_tile_rowcol was incorrect, as we extracted
6
the tile number from itself.
7
8
The test case relies only on assembler support for SME, since
9
no release of GCC recognizes -march=armv9-a+sme yet.
10
11
Cc: qemu-stable@nongnu.org
12
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1620
13
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
14
Message-id: 20230622151201.1578522-5-richard.henderson@linaro.org
15
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
16
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
17
---
18
target/arm/tcg/translate-sme.c | 24 ++++++---
19
tests/tcg/aarch64/sme-outprod1.c | 83 +++++++++++++++++++++++++++++++
20
tests/tcg/aarch64/Makefile.target | 10 ++--
21
3 files changed, 108 insertions(+), 9 deletions(-)
22
create mode 100644 tests/tcg/aarch64/sme-outprod1.c
23
24
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
25
index XXXXXXX..XXXXXXX 100644
26
--- a/target/arm/tcg/translate-sme.c
27
+++ b/target/arm/tcg/translate-sme.c
28
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
29
return addr;
30
}
31
32
+/*
33
+ * Resolve tile.size[0] to a host pointer.
34
+ * Used by e.g. outer product insns where we require the entire tile.
35
+ */
36
+static TCGv_ptr get_tile(DisasContext *s, int esz, int tile)
37
+{
38
+ TCGv_ptr addr = tcg_temp_new_ptr();
39
+ int offset;
40
+
41
+ offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, zarray);
42
+
43
+ tcg_gen_addi_ptr(addr, cpu_env, offset);
44
+ return addr;
45
+}
46
+
47
static bool trans_ZERO(DisasContext *s, arg_ZERO *a)
48
{
49
if (!dc_isar_feature(aa64_sme, s)) {
50
@@ -XXX,XX +XXX,XX @@ static bool do_adda(DisasContext *s, arg_adda *a, MemOp esz,
51
return true;
52
}
53
54
- /* Sum XZR+zad to find ZAd. */
55
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
56
+ za = get_tile(s, esz, a->zad);
57
zn = vec_full_reg_ptr(s, a->zn);
58
pn = pred_full_reg_ptr(s, a->pn);
59
pm = pred_full_reg_ptr(s, a->pm);
60
@@ -XXX,XX +XXX,XX @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz,
61
return true;
62
}
63
64
- /* Sum XZR+zad to find ZAd. */
65
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
66
+ za = get_tile(s, esz, a->zad);
67
zn = vec_full_reg_ptr(s, a->zn);
68
zm = vec_full_reg_ptr(s, a->zm);
69
pn = pred_full_reg_ptr(s, a->pn);
70
@@ -XXX,XX +XXX,XX @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
71
return true;
72
}
73
74
- /* Sum XZR+zad to find ZAd. */
75
- za = get_tile_rowcol(s, esz, 31, a->zad, false);
76
+ za = get_tile(s, esz, a->zad);
77
zn = vec_full_reg_ptr(s, a->zn);
78
zm = vec_full_reg_ptr(s, a->zm);
79
pn = pred_full_reg_ptr(s, a->pn);
80
diff --git a/tests/tcg/aarch64/sme-outprod1.c b/tests/tcg/aarch64/sme-outprod1.c
81
new file mode 100644
82
index XXXXXXX..XXXXXXX
83
--- /dev/null
84
+++ b/tests/tcg/aarch64/sme-outprod1.c
85
@@ -XXX,XX +XXX,XX @@
86
+/*
87
+ * SME outer product, 1 x 1.
88
+ * SPDX-License-Identifier: GPL-2.0-or-later
89
+ */
90
+
91
+#include <stdio.h>
92
+
93
+extern void foo(float *dst);
94
+
95
+asm(
96
+"    .arch_extension sme\n"
97
+"    .type foo, @function\n"
98
+"foo:\n"
99
+"    stp x29, x30, [sp, -80]!\n"
100
+"    mov x29, sp\n"
101
+"    stp d8, d9, [sp, 16]\n"
102
+"    stp d10, d11, [sp, 32]\n"
103
+"    stp d12, d13, [sp, 48]\n"
104
+"    stp d14, d15, [sp, 64]\n"
105
+"    smstart\n"
106
+"    ptrue p0.s, vl4\n"
107
+"    fmov z0.s, #1.0\n"
108
+/*
109
+ * An outer product of a vector of 1.0 by itself should be a matrix of 1.0.
110
+ * Note that we are using tile 1 here (za1.s) rather than tile 0.
111
+ */
112
+"    zero {za}\n"
113
+"    fmopa za1.s, p0/m, p0/m, z0.s, z0.s\n"
114
+/*
115
+ * Read the first 4x4 sub-matrix of elements from tile 1:
116
+ * Note that za1h should be interchangable here.
117
+ */
118
+"    mov w12, #0\n"
119
+"    mova z0.s, p0/m, za1v.s[w12, #0]\n"
120
+"    mova z1.s, p0/m, za1v.s[w12, #1]\n"
121
+"    mova z2.s, p0/m, za1v.s[w12, #2]\n"
122
+"    mova z3.s, p0/m, za1v.s[w12, #3]\n"
123
+/*
124
+ * And store them to the input pointer (dst in the C code):
125
+ */
126
+"    st1w {z0.s}, p0, [x0]\n"
127
+"    add x0, x0, #16\n"
128
+"    st1w {z1.s}, p0, [x0]\n"
129
+"    add x0, x0, #16\n"
130
+"    st1w {z2.s}, p0, [x0]\n"
131
+"    add x0, x0, #16\n"
132
+"    st1w {z3.s}, p0, [x0]\n"
133
+"    smstop\n"
134
+"    ldp d8, d9, [sp, 16]\n"
135
+"    ldp d10, d11, [sp, 32]\n"
136
+"    ldp d12, d13, [sp, 48]\n"
137
+"    ldp d14, d15, [sp, 64]\n"
138
+"    ldp x29, x30, [sp], 80\n"
139
+"    ret\n"
140
+"    .size foo, . - foo"
141
+);
142
+
143
+int main()
144
+{
145
+ float dst[16];
146
+ int i, j;
147
+
148
+ foo(dst);
149
+
150
+ for (i = 0; i < 16; i++) {
151
+ if (dst[i] != 1.0f) {
152
+ break;
153
+ }
154
+ }
155
+
156
+ if (i == 16) {
157
+ return 0; /* success */
158
+ }
159
+
160
+ /* failure */
161
+ for (i = 0; i < 4; ++i) {
162
+ for (j = 0; j < 4; ++j) {
163
+ printf("%f ", (double)dst[i * 4 + j]);
164
+ }
165
+ printf("\n");
166
+ }
167
+ return 1;
168
+}
169
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
170
index XXXXXXX..XXXXXXX 100644
171
--- a/tests/tcg/aarch64/Makefile.target
172
+++ b/tests/tcg/aarch64/Makefile.target
173
@@ -XXX,XX +XXX,XX @@ config-cc.mak: Makefile
174
     $(call cc-option,-march=armv8.5-a, CROSS_CC_HAS_ARMV8_5); \
175
     $(call cc-option,-mbranch-protection=standard, CROSS_CC_HAS_ARMV8_BTI); \
176
     $(call cc-option,-march=armv8.5-a+memtag, CROSS_CC_HAS_ARMV8_MTE); \
177
-     $(call cc-option,-march=armv9-a+sme, CROSS_CC_HAS_ARMV9_SME)) 3> config-cc.mak
178
+     $(call cc-option,-Wa$(COMMA)-march=armv9-a+sme, CROSS_AS_HAS_ARMV9_SME)) 3> config-cc.mak
179
-include config-cc.mak
180
181
ifneq ($(CROSS_CC_HAS_ARMV8_2),)
182
@@ -XXX,XX +XXX,XX @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
183
mte-%: CFLAGS += -march=armv8.5-a+memtag
184
endif
185
186
+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
187
+AARCH64_TESTS += sme-outprod1
188
+endif
189
+
190
ifneq ($(CROSS_CC_HAS_SVE),)
191
# System Registers Tests
192
AARCH64_TESTS += sysregs
193
-ifneq ($(CROSS_CC_HAS_ARMV9_SME),)
194
-sysregs: CFLAGS+=-march=armv9-a+sme -DHAS_ARMV9_SME
195
+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
196
+sysregs: CFLAGS+=-Wa,-march=armv9-a+sme -DHAS_ARMV9_SME
197
else
198
sysregs: CFLAGS+=-march=armv8.1-a+sve
199
endif
200
--
201
2.34.1
diff view generated by jsdifflib
[PULL 06/11] target/arm: Handle IC IVAU to improve compatibility with JITs
Deleted patch
1
From: John Högberg <john.hogberg@ericsson.com>
2
1
3
Unlike architectures with precise self-modifying code semantics
4
(e.g. x86) ARM processors do not maintain coherency for instruction
5
execution and memory, requiring an instruction synchronization
6
barrier on every core that will execute the new code, and on many
7
models also the explicit use of cache management instructions.
8
9
While this is required to make JITs work on actual hardware, QEMU
10
has gotten away with not handling this since it does not emulate
11
caches, and unconditionally invalidates code whenever the softmmu
12
or the user-mode page protection logic detects that code has been
13
modified.
14
15
Unfortunately the latter does not work in the face of dual-mapped
16
code (a common W^X workaround), where one page is executable and
17
the other is writable: user-mode has no way to connect one with the
18
other as that is only known to the kernel and the emulated
19
application.
20
21
This commit works around the issue by telling software that
22
instruction cache invalidation is required by clearing the
23
CPR_EL0.DIC flag (regardless of whether the emulated processor
24
needs it), and then invalidating code in IC IVAU instructions.
25
26
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1034
27
28
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
29
Signed-off-by: John Högberg <john.hogberg@ericsson.com>
30
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
31
Message-id: 168778890374.24232.3402138851538068785-1@git.sr.ht
32
[PMM: removed unnecessary AArch64 feature check; moved
33
"clear CTR_EL1.DIC" code up a bit so it's not in the middle
34
of the vfp/neon related tests]
35
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
36
---
37
target/arm/cpu.c | 11 +++++++++++
38
target/arm/helper.c | 47 ++++++++++++++++++++++++++++++++++++++++++---
39
2 files changed, 55 insertions(+), 3 deletions(-)
40
41
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
42
index XXXXXXX..XXXXXXX 100644
43
--- a/target/arm/cpu.c
44
+++ b/target/arm/cpu.c
45
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
46
return;
47
}
48
49
+#ifdef CONFIG_USER_ONLY
50
+ /*
51
+ * User mode relies on IC IVAU instructions to catch modification of
52
+ * dual-mapped code.
53
+ *
54
+ * Clear CTR_EL0.DIC to ensure that software that honors these flags uses
55
+ * IC IVAU even if the emulated processor does not normally require it.
56
+ */
57
+ cpu->ctr = FIELD_DP64(cpu->ctr, CTR_EL0, DIC, 0);
58
+#endif
59
+
60
if (arm_feature(env, ARM_FEATURE_AARCH64) &&
61
cpu->has_vfp != cpu->has_neon) {
62
/*
63
diff --git a/target/arm/helper.c b/target/arm/helper.c
64
index XXXXXXX..XXXXXXX 100644
65
--- a/target/arm/helper.c
66
+++ b/target/arm/helper.c
67
@@ -XXX,XX +XXX,XX @@ static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
68
}
69
}
70
71
+#ifdef CONFIG_USER_ONLY
72
+/*
73
+ * `IC IVAU` is handled to improve compatibility with JITs that dual-map their
74
+ * code to get around W^X restrictions, where one region is writable and the
75
+ * other is executable.
76
+ *
77
+ * Since the executable region is never written to we cannot detect code
78
+ * changes when running in user mode, and rely on the emulated JIT telling us
79
+ * that the code has changed by executing this instruction.
80
+ */
81
+static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri,
82
+ uint64_t value)
83
+{
84
+ uint64_t icache_line_mask, start_address, end_address;
85
+ const ARMCPU *cpu;
86
+
87
+ cpu = env_archcpu(env);
88
+
89
+ icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1;
90
+ start_address = value & ~icache_line_mask;
91
+ end_address = value | icache_line_mask;
92
+
93
+ mmap_lock();
94
+
95
+ tb_invalidate_phys_range(start_address, end_address);
96
+
97
+ mmap_unlock();
98
+}
99
+#endif
100
+
101
static const ARMCPRegInfo v8_cp_reginfo[] = {
102
/*
103
* Minimal set of EL0-visible registers. This will need to be expanded
104
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
105
{ .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
106
.opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
107
.access = PL1_R, .type = ARM_CP_CURRENTEL },
108
- /* Cache ops: all NOPs since we don't emulate caches */
109
+ /*
110
+ * Instruction cache ops. All of these except `IC IVAU` NOP because we
111
+ * don't emulate caches.
112
+ */
113
{ .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
114
.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
115
.access = PL1_W, .type = ARM_CP_NOP,
116
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
117
.accessfn = access_tocu },
118
{ .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
119
.opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
120
- .access = PL0_W, .type = ARM_CP_NOP,
121
+ .access = PL0_W,
122
.fgt = FGT_ICIVAU,
123
- .accessfn = access_tocu },
124
+ .accessfn = access_tocu,
125
+#ifdef CONFIG_USER_ONLY
126
+ .type = ARM_CP_NO_RAW,
127
+ .writefn = ic_ivau_write
128
+#else
129
+ .type = ARM_CP_NOP
130
+#endif
131
+ },
132
+ /* Cache ops: all NOPs since we don't emulate caches */
133
{ .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
134
.opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
135
.access = PL1_W, .accessfn = aa64_cacheop_poc_access,
136
--
137
2.34.1
138
139
diff view generated by jsdifflib
[PULL 07/11] tests/tcg/aarch64: Add testcases for IC IVAU and dual-mapped code
Deleted patch
1
From: John Högberg <john.hogberg@ericsson.com>
2
1
3
https://gitlab.com/qemu-project/qemu/-/issues/1034
4
5
Signed-off-by: John Högberg <john.hogberg@ericsson.com>
6
Message-id: 168778890374.24232.3402138851538068785-2@git.sr.ht
7
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
8
[PMM: fixed typo in comment]
9
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
10
---
11
tests/tcg/aarch64/icivau.c | 189 ++++++++++++++++++++++++++++++
12
tests/tcg/aarch64/Makefile.target | 3 +-
13
2 files changed, 191 insertions(+), 1 deletion(-)
14
create mode 100644 tests/tcg/aarch64/icivau.c
15
16
diff --git a/tests/tcg/aarch64/icivau.c b/tests/tcg/aarch64/icivau.c
17
new file mode 100644
18
index XXXXXXX..XXXXXXX
19
--- /dev/null
20
+++ b/tests/tcg/aarch64/icivau.c
21
@@ -XXX,XX +XXX,XX @@
22
+/*
23
+ * Tests the IC IVAU-driven workaround for catching changes made to dual-mapped
24
+ * code that would otherwise go unnoticed in user mode.
25
+ *
26
+ * Copyright (c) 2023 Ericsson AB
27
+ * SPDX-License-Identifier: GPL-2.0-or-later
28
+ */
29
+
30
+#include <sys/mman.h>
31
+#include <sys/stat.h>
32
+#include <string.h>
33
+#include <stdint.h>
34
+#include <stdlib.h>
35
+#include <unistd.h>
36
+#include <fcntl.h>
37
+
38
+#define MAX_CODE_SIZE 128
39
+
40
+typedef int (SelfModTest)(uint32_t, uint32_t*);
41
+typedef int (BasicTest)(int);
42
+
43
+static void mark_code_modified(const uint32_t *exec_data, size_t length)
44
+{
45
+ int dc_required, ic_required;
46
+ unsigned long ctr_el0;
47
+
48
+ /*
49
+ * Clear the data/instruction cache, as indicated by the CTR_ELO.{DIC,IDC}
50
+ * flags.
51
+ *
52
+ * For completeness we might be tempted to assert that we should fail when
53
+ * the whole code update sequence is omitted, but that would make the test
54
+ * flaky as it can succeed by coincidence on actual hardware.
55
+ */
56
+ asm ("mrs %0, ctr_el0\n" : "=r"(ctr_el0));
57
+
58
+ /* CTR_EL0.IDC */
59
+ dc_required = !((ctr_el0 >> 28) & 1);
60
+
61
+ /* CTR_EL0.DIC */
62
+ ic_required = !((ctr_el0 >> 29) & 1);
63
+
64
+ if (dc_required) {
65
+ size_t dcache_stride, i;
66
+
67
+ /*
68
+ * Step according to the minimum cache size, as the cache maintenance
69
+ * instructions operate on the cache line of the given address.
70
+ *
71
+ * We assume that exec_data is properly aligned.
72
+ */
73
+ dcache_stride = (4 << ((ctr_el0 >> 16) & 0xF));
74
+
75
+ for (i = 0; i < length; i += dcache_stride) {
76
+ const char *dc_addr = &((const char *)exec_data)[i];
77
+ asm volatile ("dc cvau, %x[dc_addr]\n"
78
+ : /* no outputs */
79
+ : [dc_addr] "r"(dc_addr)
80
+ : "memory");
81
+ }
82
+
83
+ asm volatile ("dmb ish\n");
84
+ }
85
+
86
+ if (ic_required) {
87
+ size_t icache_stride, i;
88
+
89
+ icache_stride = (4 << (ctr_el0 & 0xF));
90
+
91
+ for (i = 0; i < length; i += icache_stride) {
92
+ const char *ic_addr = &((const char *)exec_data)[i];
93
+ asm volatile ("ic ivau, %x[ic_addr]\n"
94
+ : /* no outputs */
95
+ : [ic_addr] "r"(ic_addr)
96
+ : "memory");
97
+ }
98
+
99
+ asm volatile ("dmb ish\n");
100
+ }
101
+
102
+ asm volatile ("isb sy\n");
103
+}
104
+
105
+static int basic_test(uint32_t *rw_data, const uint32_t *exec_data)
106
+{
107
+ /*
108
+ * As user mode only misbehaved for dual-mapped code when previously
109
+ * translated code had been changed, we'll start off with this basic test
110
+ * function to ensure that there's already some translated code at
111
+ * exec_data before the next test. This should cause the next test to fail
112
+ * if `mark_code_modified` fails to invalidate the code.
113
+ *
114
+ * Note that the payload is in binary form instead of inline assembler
115
+ * because we cannot use __attribute__((naked)) on this platform and the
116
+ * workarounds are at least as ugly as this is.
117
+ */
118
+ static const uint32_t basic_payload[] = {
119
+ 0xD65F03C0 /* 0x00: RET */
120
+ };
121
+
122
+ BasicTest *copied_ptr = (BasicTest *)exec_data;
123
+
124
+ memcpy(rw_data, basic_payload, sizeof(basic_payload));
125
+ mark_code_modified(exec_data, sizeof(basic_payload));
126
+
127
+ return copied_ptr(1234) == 1234;
128
+}
129
+
130
+static int self_modification_test(uint32_t *rw_data, const uint32_t *exec_data)
131
+{
132
+ /*
133
+ * This test is self-modifying in an attempt to cover an edge case where
134
+ * the IC IVAU instruction invalidates itself.
135
+ *
136
+ * Note that the IC IVAU instruction is 16 bytes into the function, in what
137
+ * will be the same cache line as the modified instruction on machines with
138
+ * a cache line size >= 16 bytes.
139
+ */
140
+ static const uint32_t self_mod_payload[] = {
141
+ /* Overwrite the placeholder instruction with the new one. */
142
+ 0xB9001C20, /* 0x00: STR w0, [x1, 0x1C] */
143
+
144
+ /* Get the executable address of the modified instruction. */
145
+ 0x100000A8, /* 0x04: ADR x8, <0x1C> */
146
+
147
+ /* Mark the modified instruction as updated. */
148
+ 0xD50B7B28, /* 0x08: DC CVAU x8 */
149
+ 0xD5033BBF, /* 0x0C: DMB ISH */
150
+ 0xD50B7528, /* 0x10: IC IVAU x8 */
151
+ 0xD5033BBF, /* 0x14: DMB ISH */
152
+ 0xD5033FDF, /* 0x18: ISB */
153
+
154
+ /* Placeholder instruction, overwritten above. */
155
+ 0x52800000, /* 0x1C: MOV w0, 0 */
156
+
157
+ 0xD65F03C0 /* 0x20: RET */
158
+ };
159
+
160
+ SelfModTest *copied_ptr = (SelfModTest *)exec_data;
161
+ int i;
162
+
163
+ memcpy(rw_data, self_mod_payload, sizeof(self_mod_payload));
164
+ mark_code_modified(exec_data, sizeof(self_mod_payload));
165
+
166
+ for (i = 1; i < 10; i++) {
167
+ /* Replace the placeholder instruction with `MOV w0, i` */
168
+ uint32_t new_instr = 0x52800000 | (i << 5);
169
+
170
+ if (copied_ptr(new_instr, rw_data) != i) {
171
+ return 0;
172
+ }
173
+ }
174
+
175
+ return 1;
176
+}
177
+
178
+int main(int argc, char **argv)
179
+{
180
+ const char *shm_name = "qemu-test-tcg-aarch64-icivau";
181
+ int fd;
182
+
183
+ fd = shm_open(shm_name, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
184
+
185
+ if (fd < 0) {
186
+ return EXIT_FAILURE;
187
+ }
188
+
189
+ /* Unlink early to avoid leaving garbage in case the test crashes. */
190
+ shm_unlink(shm_name);
191
+
192
+ if (ftruncate(fd, MAX_CODE_SIZE) == 0) {
193
+ const uint32_t *exec_data;
194
+ uint32_t *rw_data;
195
+
196
+ rw_data = mmap(0, MAX_CODE_SIZE, PROT_READ | PROT_WRITE,
197
+ MAP_SHARED, fd, 0);
198
+ exec_data = mmap(0, MAX_CODE_SIZE, PROT_READ | PROT_EXEC,
199
+ MAP_SHARED, fd, 0);
200
+
201
+ if (rw_data && exec_data) {
202
+ if (basic_test(rw_data, exec_data) &&
203
+ self_modification_test(rw_data, exec_data)) {
204
+ return EXIT_SUCCESS;
205
+ }
206
+ }
207
+ }
208
+
209
+ return EXIT_FAILURE;
210
+}
211
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
212
index XXXXXXX..XXXXXXX 100644
213
--- a/tests/tcg/aarch64/Makefile.target
214
+++ b/tests/tcg/aarch64/Makefile.target
215
@@ -XXX,XX +XXX,XX @@ AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
216
VPATH         += $(AARCH64_SRC)
217
218
# Base architecture tests
219
-AARCH64_TESTS=fcvt pcalign-a64
220
+AARCH64_TESTS=fcvt pcalign-a64 icivau
221
222
fcvt: LDFLAGS+=-lm
223
+icivau: LDFLAGS+=-lrt
224
225
run-fcvt: fcvt
226
    $(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")
227
--
228
2.34.1
229
230
diff view generated by jsdifflib
[PULL 08/11] tests/qtest: xlnx-canfd-test: Fix code coverity issues
Deleted patch
1
From: Vikram Garhwal <vikram.garhwal@amd.com>
2
1
3
Following are done to fix the coverity issues:
4
1. Change read_data to fix the CID 1512899: Out-of-bounds access (OVERRUN)
5
2. Fix match_rx_tx_data to fix CID 1512900: Logically dead code (DEADCODE)
6
3. Replace rand() in generate_random_data() with g_rand_int()
7
8
Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com>
9
Message-id: 20230628202758.16398-1-vikram.garhwal@amd.com
10
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
tests/qtest/xlnx-canfd-test.c | 33 +++++++++++----------------------
14
1 file changed, 11 insertions(+), 22 deletions(-)
15
16
diff --git a/tests/qtest/xlnx-canfd-test.c b/tests/qtest/xlnx-canfd-test.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/tests/qtest/xlnx-canfd-test.c
19
+++ b/tests/qtest/xlnx-canfd-test.c
20
@@ -XXX,XX +XXX,XX @@ static void generate_random_data(uint32_t *buf_tx, bool is_canfd_frame)
21
/* Generate random TX data for CANFD frame. */
22
if (is_canfd_frame) {
23
for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
24
- buf_tx[2 + i] = rand();
25
+ buf_tx[2 + i] = g_random_int();
26
}
27
} else {
28
/* Generate random TX data for CAN frame. */
29
for (int i = 0; i < CAN_FRAME_SIZE - 2; i++) {
30
- buf_tx[2 + i] = rand();
31
+ buf_tx[2 + i] = g_random_int();
32
}
33
}
34
}
35
36
-static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
37
+static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx,
38
+ uint32_t frame_size)
39
{
40
uint32_t int_status;
41
uint32_t fifo_status_reg_value;
42
/* At which RX FIFO the received data is stored. */
43
uint8_t store_ind = 0;
44
- bool is_canfd_frame = false;
45
46
/* Read the interrupt on CANFD rx. */
47
int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_RXOK;
48
@@ -XXX,XX +XXX,XX @@ static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
49
buf_rx[0] = qtest_readl(qts, can_base_addr + R_RX0_ID_OFFSET);
50
buf_rx[1] = qtest_readl(qts, can_base_addr + R_RX0_DLC_OFFSET);
51
52
- is_canfd_frame = (buf_rx[1] >> DLC_FD_BIT_SHIFT) & 1;
53
-
54
- if (is_canfd_frame) {
55
- for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
56
- buf_rx[i + 2] = qtest_readl(qts,
57
- can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
58
- }
59
- } else {
60
- buf_rx[2] = qtest_readl(qts, can_base_addr + R_RX0_DATA1_OFFSET);
61
- buf_rx[3] = qtest_readl(qts, can_base_addr + R_RX0_DATA2_OFFSET);
62
+ for (int i = 0; i < frame_size - 2; i++) {
63
+ buf_rx[i + 2] = qtest_readl(qts,
64
+ can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
65
}
66
67
/* Clear the RX interrupt. */
68
@@ -XXX,XX +XXX,XX @@ static void match_rx_tx_data(const uint32_t *buf_tx, const uint32_t *buf_rx,
69
g_assert_cmpint((buf_rx[size] & DLC_FD_BIT_MASK), ==,
70
(buf_tx[size] & DLC_FD_BIT_MASK));
71
} else {
72
- if (!is_canfd_frame && size == 4) {
73
- break;
74
- }
75
-
76
g_assert_cmpint(buf_rx[size], ==, buf_tx[size]);
77
}
78
79
@@ -XXX,XX +XXX,XX @@ static void test_can_data_transfer(void)
80
write_data(qts, CANFD0_BASE_ADDR, buf_tx, false);
81
82
send_data(qts, CANFD0_BASE_ADDR);
83
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
84
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CAN_FRAME_SIZE);
85
match_rx_tx_data(buf_tx, buf_rx, false);
86
87
qtest_quit(qts);
88
@@ -XXX,XX +XXX,XX @@ static void test_canfd_data_transfer(void)
89
write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
90
91
send_data(qts, CANFD0_BASE_ADDR);
92
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
93
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
94
match_rx_tx_data(buf_tx, buf_rx, true);
95
96
qtest_quit(qts);
97
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
98
write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
99
100
send_data(qts, CANFD0_BASE_ADDR);
101
- read_data(qts, CANFD0_BASE_ADDR, buf_rx);
102
+ read_data(qts, CANFD0_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
103
match_rx_tx_data(buf_tx, buf_rx, true);
104
105
generate_random_data(buf_tx, true);
106
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
107
write_data(qts, CANFD1_BASE_ADDR, buf_tx, true);
108
109
send_data(qts, CANFD1_BASE_ADDR);
110
- read_data(qts, CANFD1_BASE_ADDR, buf_rx);
111
+ read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
112
match_rx_tx_data(buf_tx, buf_rx, true);
113
114
qtest_quit(qts);
115
--
116
2.34.1
diff view generated by jsdifflib
[PULL 09/11] target/arm: gdbstub: Guard M-profile code with CONFIG_TCG
Deleted patch
1
From: Fabiano Rosas <farosas@suse.de>
2
1
3
This code is only relevant when TCG is present in the build. Building
4
with --disable-tcg --enable-xen on an x86 host we get:
5
6
$ ../configure --target-list=x86_64-softmmu,aarch64-softmmu --disable-tcg --enable-xen
7
$ make -j$(nproc)
8
...
9
libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `m_sysreg_ptr':
10
../target/arm/gdbstub.c:358: undefined reference to `arm_v7m_get_sp_ptr'
11
../target/arm/gdbstub.c:361: undefined reference to `arm_v7m_get_sp_ptr'
12
13
libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `arm_gdb_get_m_systemreg':
14
../target/arm/gdbstub.c:405: undefined reference to `arm_v7m_mrs_control'
15
16
Signed-off-by: Fabiano Rosas <farosas@suse.de>
17
Message-id: 20230628164821.16771-1-farosas@suse.de
18
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
19
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
20
---
21
target/arm/gdbstub.c | 4 ++++
22
1 file changed, 4 insertions(+)
23
24
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
25
index XXXXXXX..XXXXXXX 100644
26
--- a/target/arm/gdbstub.c
27
+++ b/target/arm/gdbstub.c
28
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
29
return cpu->dyn_sysreg_xml.num;
30
}
31
32
+#ifdef CONFIG_TCG
33
typedef enum {
34
M_SYSREG_MSP,
35
M_SYSREG_PSP,
36
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
37
return cpu->dyn_m_secextreg_xml.num;
38
}
39
#endif
40
+#endif /* CONFIG_TCG */
41
42
const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
43
{
44
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
45
arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
46
"system-registers.xml", 0);
47
48
+#ifdef CONFIG_TCG
49
if (arm_feature(env, ARM_FEATURE_M) && tcg_enabled()) {
50
gdb_register_coprocessor(cs,
51
arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
52
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
53
}
54
#endif
55
}
56
+#endif /* CONFIG_TCG */
57
}
58
--
59
2.34.1
diff view generated by jsdifflib
[PULL 10/11] hw: arm: allwinner-sramc: Set class_size
Deleted patch
1
From: Akihiko Odaki <akihiko.odaki@daynix.com>
2
1
3
AwSRAMCClass is larger than SysBusDeviceClass so the class size must be
4
advertised accordingly.
5
6
Fixes: 05def917e1 ("hw: arm: allwinner-sramc: Add SRAM Controller support for R40")
7
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
8
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
9
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
10
Message-id: 20230628110905.38125-1-akihiko.odaki@daynix.com
11
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
12
---
13
hw/misc/allwinner-sramc.c | 1 +
14
1 file changed, 1 insertion(+)
15
16
diff --git a/hw/misc/allwinner-sramc.c b/hw/misc/allwinner-sramc.c
17
index XXXXXXX..XXXXXXX 100644
18
--- a/hw/misc/allwinner-sramc.c
19
+++ b/hw/misc/allwinner-sramc.c
20
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_sramc_info = {
21
.parent = TYPE_SYS_BUS_DEVICE,
22
.instance_init = allwinner_sramc_init,
23
.instance_size = sizeof(AwSRAMCState),
24
+ .class_size = sizeof(AwSRAMCClass),
25
.class_init = allwinner_sramc_class_init,
26
};
27
28
--
29
2.34.1
30
31
diff view generated by jsdifflib
[PULL 11/11] target/xtensa: Assert that interrupt level is within bounds
Deleted patch
1
In handle_interrupt() we use level as an index into the interrupt_vector[]
2
array. This is safe because we have checked it against env->config->nlevel,
3
but Coverity can't see that (and it is only true because each CPU config
4
sets its XCHAL_NUM_INTLEVELS to something less than MAX_NLEVELS), so it
5
complains about a possible array overrun (CID 1507131)
6
1
7
Add an assert() which will make Coverity happy and catch the unlikely
8
case of a mis-set XCHAL_NUM_INTLEVELS in future.
9
10
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
11
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
12
Message-id: 20230623154135.1930261-1-peter.maydell@linaro.org
13
---
14
target/xtensa/exc_helper.c | 3 +++
15
1 file changed, 3 insertions(+)
16
17
diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c
18
index XXXXXXX..XXXXXXX 100644
19
--- a/target/xtensa/exc_helper.c
20
+++ b/target/xtensa/exc_helper.c
21
@@ -XXX,XX +XXX,XX @@ static void handle_interrupt(CPUXtensaState *env)
22
CPUState *cs = env_cpu(env);
23
24
if (level > 1) {
25
+ /* env->config->nlevel check should have ensured this */
26
+ assert(level < sizeof(env->config->interrupt_vector));
27
+
28
env->sregs[EPC1 + level - 1] = env->pc;
29
env->sregs[EPS2 + level - 2] = env->sregs[PS];
30
env->sregs[PS] =
31
--
32
2.34.1
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.