[PULL 0/2] target-arm queue
[PULL v2 00/39] target-arm queue
1
Two bug fixes for 9.0...
1
v2: fix format-string issue in a test case.
2
2
3
-- PMM
3
-- PMM
4
4
5
The following changes since commit ce64e6224affb8b4e4b019f76d2950270b391af5:
5
The following changes since commit 6f34661b6c97a37a5efc27d31c037ddeda4547e2:
6
6
7
Merge tag 'qemu-sparc-20240404' of https://github.com/mcayland/qemu into staging (2024-04-04 15:28:06 +0100)
7
Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging (2021-03-11 18:55:27 +0000)
8
8
9
are available in the Git repository at:
9
are available in the Git repository at:
10
10
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240408
11
https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210314
12
12
13
for you to fetch changes up to 19b254e86a900dc5ee332e3ac0baf9c521301abf:
13
for you to fetch changes up to 6500ac13ff8e5c64ca69f5ef5d456028cfda6139:
14
14
15
target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3 (2024-04-08 15:38:53 +0100)
15
hw/display/pxa2xx: Inline template header (2021-03-14 13:14:56 +0000)
16
16
17
----------------------------------------------------------------
17
----------------------------------------------------------------
18
target-arm:
18
target-arm queue:
19
* Use correct SecuritySpace for AArch64 AT ops at EL3
19
* versal: Support XRAMs and XRAM controller
20
* Fix CNTPOFF_EL2 trap to missing EL3
20
* smmu: Various minor bug fixes
21
* SVE emulation: fix bugs handling odd vector lengths
22
* allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
23
* tests/acceptance: fix orangepi-pc acceptance tests
24
* hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
25
* hw/arm/virt: KVM: The IPA lower bound is 32
26
* npcm7xx: support MFT module
27
* pl110, pxa2xx_lcd: tidy up template headers
21
28
22
----------------------------------------------------------------
29
----------------------------------------------------------------
23
Peter Maydell (1):
30
Andrew Jones (2):
24
target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3
31
accel: kvm: Fix kvm_type invocation
32
hw/arm/virt: KVM: The IPA lower bound is 32
25
33
26
Pierre-Clément Tosi (1):
34
Edgar E. Iglesias (2):
27
target/arm: Fix CNTPOFF_EL2 trap to missing EL3
35
hw/misc: versal: Add a model of the XRAM controller
36
hw/arm: versal: Add support for the XRAMs
28
37
29
target/arm/helper.c | 10 +++++++---
38
Eric Auger (7):
30
1 file changed, 7 insertions(+), 3 deletions(-)
39
intel_iommu: Fix mask may be uninitialized in vtd_context_device_invalidate
40
dma: Introduce dma_aligned_pow2_mask()
41
virtio-iommu: Handle non power of 2 range invalidations
42
hw/arm/smmu-common: Fix smmu_iotlb_inv_iova when asid is not set
43
hw/arm/smmuv3: Enforce invalidation on a power of two range
44
hw/arm/smmuv3: Fix SMMU_CMD_CFGI_STE_RANGE handling
45
hw/arm/smmuv3: Uniformize sid traces
31
46
47
Hao Wu (5):
48
hw/misc: Add GPIOs for duty in NPCM7xx PWM
49
hw/misc: Add NPCM7XX MFT Module
50
hw/arm: Add MFT device to NPCM7xx Soc
51
hw/arm: Connect PWM fans in NPCM7XX boards
52
tests/qtest: Test PWM fan RPM using MFT in PWM test
53
54
Niek Linnenbank (5):
55
hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value
56
tests/acceptance/boot_linux_console: remove Armbian 19.11.3 bionic test for orangepi-pc machine
57
tests/acceptance/boot_linux_console: change URL for test_arm_orangepi_bionic_20_08
58
tests/acceptance: update sunxi kernel from armbian to 5.10.16
59
tests/acceptance: drop ARMBIAN_ARTIFACTS_CACHED condition for orangepi-pc, cubieboard tests
60
61
Peter Maydell (9):
62
hw/display/pl110: Remove dead code for non-32-bpp surfaces
63
hw/display/pl110: Pull included-once parts of template header into pl110.c
64
hw/display/pl110: Remove use of BITS from pl110_template.h
65
hw/display/pxa2xx_lcd: Remove dead code for non-32-bpp surfaces
66
hw/display/pxa2xx_lcd: Remove dest_width state field
67
hw/display/pxa2xx: Remove use of BITS in pxa2xx_template.h
68
hw/display/pxa2xx: Apply brace-related coding style fixes to template header
69
hw/display/pxa2xx: Apply whitespace-only coding style fixes to template header
70
hw/display/pxa2xx: Inline template header
71
72
Philippe Mathieu-Daudé (1):
73
hw/timer/sse-timer: Propagate eventual error in sse_timer_realize()
74
75
Richard Henderson (8):
76
target/arm: Fix sve_uzp_p vs odd vector lengths
77
target/arm: Fix sve_zip_p vs odd vector lengths
78
target/arm: Fix sve_punpk_p vs odd vector lengths
79
target/arm: Update find_last_active for PREDDESC
80
target/arm: Update BRKA, BRKB, BRKN for PREDDESC
81
target/arm: Update CNTP for PREDDESC
82
target/arm: Update WHILE for PREDDESC
83
target/arm: Update sve reduction vs simd_desc
84
85
docs/system/arm/nuvoton.rst | 2 +-
86
docs/system/arm/xlnx-versal-virt.rst | 1 +
87
hw/arm/smmu-internal.h | 5 +
88
hw/display/pl110_template.h | 120 +-------
89
hw/display/pxa2xx_template.h | 447 ---------------------------
90
include/hw/arm/npcm7xx.h | 13 +-
91
include/hw/arm/xlnx-versal.h | 13 +
92
include/hw/boards.h | 1 +
93
include/hw/misc/npcm7xx_mft.h | 70 +++++
94
include/hw/misc/npcm7xx_pwm.h | 4 +-
95
include/hw/misc/xlnx-versal-xramc.h | 97 ++++++
96
include/sysemu/dma.h | 12 +
97
target/arm/kvm_arm.h | 6 +-
98
accel/kvm/kvm-all.c | 2 +
99
hw/arm/npcm7xx.c | 45 ++-
100
hw/arm/npcm7xx_boards.c | 99 ++++++
101
hw/arm/smmu-common.c | 32 +-
102
hw/arm/smmuv3.c | 58 ++--
103
hw/arm/virt.c | 23 +-
104
hw/arm/xlnx-versal.c | 36 +++
105
hw/display/pl110.c | 123 +++++---
106
hw/display/pxa2xx_lcd.c | 520 ++++++++++++++++++++++++++-----
107
hw/i386/intel_iommu.c | 32 +-
108
hw/misc/npcm7xx_mft.c | 540 +++++++++++++++++++++++++++++++++
109
hw/misc/npcm7xx_pwm.c | 4 +
110
hw/misc/xlnx-versal-xramc.c | 253 +++++++++++++++
111
hw/net/allwinner-sun8i-emac.c | 62 ++--
112
hw/timer/sse-timer.c | 1 +
113
hw/virtio/virtio-iommu.c | 19 +-
114
softmmu/dma-helpers.c | 26 ++
115
target/arm/kvm.c | 4 +-
116
target/arm/sve_helper.c | 107 ++++---
117
target/arm/translate-sve.c | 26 +-
118
tests/qtest/npcm7xx_pwm-test.c | 205 ++++++++++++-
119
hw/arm/trace-events | 24 +-
120
hw/misc/meson.build | 2 +
121
hw/misc/trace-events | 8 +
122
tests/acceptance/boot_linux_console.py | 120 +++-----
123
tests/acceptance/replay_kernel.py | 10 +-
124
39 files changed, 2235 insertions(+), 937 deletions(-)
125
delete mode 100644 hw/display/pxa2xx_template.h
126
create mode 100644 include/hw/misc/npcm7xx_mft.h
127
create mode 100644 include/hw/misc/xlnx-versal-xramc.h
128
create mode 100644 hw/misc/npcm7xx_mft.c
129
create mode 100644 hw/misc/xlnx-versal-xramc.c
130
diff view generated by jsdifflib
[PULL 1/2] target/arm: Fix CNTPOFF_EL2 trap to missing EL3
Deleted patch
1
From: Pierre-Clément Tosi <ptosi@google.com>
2
1
3
EL2 accesses to CNTPOFF_EL2 should only ever trap to EL3 if EL3 is
4
present, as described by the reference manual (for MRS):
5
6
/* ... */
7
elsif PSTATE.EL == EL2 then
8
if Halted() && HaveEL(EL3) && /*...*/ then
9
UNDEFINED;
10
elsif HaveEL(EL3) && SCR_EL3.ECVEn == '0' then
11
/* ... */
12
else
13
X[t, 64] = CNTPOFF_EL2;
14
15
However, the existing implementation of gt_cntpoff_access() always
16
returns CP_ACCESS_TRAP_EL3 for EL2 accesses with SCR_EL3.ECVEn unset. In
17
pseudo-code terminology, this corresponds to assuming that HaveEL(EL3)
18
is always true, which is wrong. As a result, QEMU panics in
19
access_check_cp_reg() when started without EL3 and running EL2 code
20
accessing the register (e.g. any recent KVM booting a guest).
21
22
Therefore, add the HaveEL(EL3) check to gt_cntpoff_access().
23
24
Fixes: 2808d3b38a52 ("target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling")
25
Signed-off-by: Pierre-Clément Tosi <ptosi@google.com>
26
Message-id: m3al6amhdkmsiy2f62w72ufth6dzn45xg5cz6xljceyibphnf4@ezmmpwk4tnhl
27
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
28
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
29
---
30
target/arm/helper.c | 3 ++-
31
1 file changed, 2 insertions(+), 1 deletion(-)
32
33
diff --git a/target/arm/helper.c b/target/arm/helper.c
34
index XXXXXXX..XXXXXXX 100644
35
--- a/target/arm/helper.c
36
+++ b/target/arm/helper.c
37
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_cntpoff_access(CPUARMState *env,
38
const ARMCPRegInfo *ri,
39
bool isread)
40
{
41
- if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
42
+ if (arm_current_el(env) == 2 && arm_feature(env, ARM_FEATURE_EL3) &&
43
+ !(env->cp15.scr_el3 & SCR_ECVEN)) {
44
return CP_ACCESS_TRAP_EL3;
45
}
46
return CP_ACCESS_OK;
47
--
48
2.34.1
49
50
diff view generated by jsdifflib
[PULL 2/2] target/arm: Use correct SecuritySpace for AArch64 AT ops at EL3
Deleted patch
1
When we do an AT address translation operation, the page table walk
2
is supposed to be performed in the context of the EL we're doing the
3
walk for, so for instance an AT S1E2R walk is done for EL2. In the
4
pseudocode an EL is passed to AArch64.AT(), which calls
5
SecurityStateAtEL() to find the security state that we should be
6
doing the walk with.
7
1
8
In ats_write64() we get this wrong, instead using the current
9
security space always. This is fine for AT operations performed from
10
EL1 and EL2, because there the current security state and the
11
security state for the lower EL are the same. But for AT operations
12
performed from EL3, the current security state is always either
13
Secure or Root, whereas we want to use the security state defined by
14
SCR_EL3.{NS,NSE} for the walk. This affects not just guests using
15
FEAT_RME but also ones where EL3 is Secure state and the EL3 code
16
is trying to do an AT for a NonSecure EL2 or EL1.
17
18
Use arm_security_space_below_el3() to get the SecuritySpace to
19
pass to do_ats_write() for all AT operations except the
20
AT S1E3* operations.
21
22
Cc: qemu-stable@nongnu.org
23
Fixes: e1ee56ec2383 ("target/arm: Pass security space rather than flag for AT instructions")
24
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2250
25
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
26
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
27
Message-id: 20240405180232.3570066-1-peter.maydell@linaro.org
28
---
29
target/arm/helper.c | 7 +++++--
30
1 file changed, 5 insertions(+), 2 deletions(-)
31
32
diff --git a/target/arm/helper.c b/target/arm/helper.c
33
index XXXXXXX..XXXXXXX 100644
34
--- a/target/arm/helper.c
35
+++ b/target/arm/helper.c
36
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
37
ARMMMUIdx mmu_idx;
38
uint64_t hcr_el2 = arm_hcr_el2_eff(env);
39
bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
40
+ bool for_el3 = false;
41
+ ARMSecuritySpace ss;
42
43
switch (ri->opc2 & 6) {
44
case 0:
45
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
46
break;
47
case 6: /* AT S1E3R, AT S1E3W */
48
mmu_idx = ARMMMUIdx_E3;
49
+ for_el3 = true;
50
break;
51
default:
52
g_assert_not_reached();
53
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
54
g_assert_not_reached();
55
}
56
57
- env->cp15.par_el[1] = do_ats_write(env, value, access_type,
58
- mmu_idx, arm_security_space(env));
59
+ ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
60
+ env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
61
#else
62
/* Handled by hardware accelerator. */
63
g_assert_not_reached();
64
--
65
2.34.1
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.