The following changes since commit 23901b2b721c0576007ab7580da8aa855d6042a9:

Merge tag 'pull-target-arm-20240711' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-07-11 12:00:00 -0700)

https://gitlab.com/gaosong/qemu.git tags/pull-loongarch-20240712

for you to fetch changes up to 3ef4b21a5c767ff0b15047e709762abef490ad07:

target/loongarch: Fix cpu_reset set wrong CSR_CRMD (2024-07-12 09:41:18 +0800)

pull-loongarch-20240712

v2: drop patch 'hw/loongarch: Modify flash block size to 256K'.

Bibo Mao (2):

hw/loongarch/virt: Remove unused assignment

target/loongarch/kvm: Add software breakpoint support

Dmitry Frolov (1):

hw/loongarch/boot.c: fix out-of-bound reading

Feiyang Chen (1):

target/loongarch: Remove avail_64 in trans_srai_w() and simplify it

Jiaxun Yang (1):

MAINTAINERS: Add myself as a reviewer of LoongArch virt machine

Song Gao (2):

target/loongarch: Set CSR_PRCFG1 and CSR_PRCFG2 values

target/loongarch: Fix cpu_reset set wrong CSR_CRMD

Xianglai Li (1):

hw/loongarch: Change the tpm support by default

MAINTAINERS | 1 +

configs/targets/loongarch64-softmmu.mak | 1 +

hw/loongarch/Kconfig | 1 +

hw/loongarch/acpi-build.c | 3 +

hw/loongarch/boot.c | 2 +-

hw/loongarch/virt.c | 15 +++--

target/loongarch/cpu.c | 23 ++++---

target/loongarch/kvm/kvm.c | 76 +++++++++++++++++++++++

target/loongarch/tcg/insn_trans/trans_shift.c.inc | 15 +----

9 files changed, 108 insertions(+), 29 deletions(-)

From: Dmitry Frolov <frolov@swemel.ru>

memcpy() is trying to READ 512 bytes from memory,

pointed by info->kernel_cmdline,

which was (presumable) allocated by g_strdup("");

Found with ASAN, making check with enabled sanitizers.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>

hw/loongarch/boot.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c

--- a/hw/loongarch/boot.c

+++ b/hw/loongarch/boot.c

@@ -XXX,XX +XXX,XX @@ static void init_cmdline(struct loongarch_boot_info *info, void *p, void *start)

info->a0 = 1;

info->a1 = cmdline_addr;

- memcpy(p, info->kernel_cmdline, COMMAND_LINE_SIZE);

+ g_strlcpy(p, info->kernel_cmdline, COMMAND_LINE_SIZE);

static uint64_t cpu_loongarch_virt_to_phys(void *opaque, uint64_t addr)

2.34.1

From: Xianglai Li <lixianglai@loongson.cn>

Add devices that support tpm by default,

Fixed incomplete tpm acpi table information.

Signed-off-by: Xianglai Li <lixianglai@loongson.cn>

hw/loongarch/Kconfig | 1 +

hw/loongarch/acpi-build.c | 3 +++

2 files changed, 4 insertions(+)

diff --git a/hw/loongarch/Kconfig b/hw/loongarch/Kconfig

--- a/hw/loongarch/Kconfig

+++ b/hw/loongarch/Kconfig

@@ -XXX,XX +XXX,XX @@ config LOONGARCH_VIRT

imply VIRTIO_VGA

imply PCI_DEVICES

imply NVDIMM

+ imply TPM_TIS_SYSBUS

select SERIAL

select VIRTIO_PCI

select PLATFORM_BUS

diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c

--- a/hw/loongarch/acpi-build.c

+++ b/hw/loongarch/acpi-build.c

@@ -XXX,XX +XXX,XX @@ void loongarch_acpi_setup(LoongArchVirtMachineState *lvms)

build_state, tables.rsdp,

ACPI_BUILD_RSDP_FILE);

+ fw_cfg_add_file(lvms->fw_cfg, ACPI_BUILD_TPMLOG_FILE, tables.tcpalog->data,

+ acpi_data_len(tables.tcpalog));

+

qemu_register_reset(acpi_build_reset, build_state);

acpi_build_reset(build_state);

vmstate_register(NULL, 0, &vmstate_acpi_build, build_state);

2.34.1

From: Bibo Mao <maobibo@loongson.cn>

hw/loongarch/virt.c | 15 +++++++--------

1 file changed, 7 insertions(+), 8 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void fw_cfg_add_memory(MachineState *ms)

memmap_add_entry(base, gap, 1);

size -= gap;

base = VIRT_HIGHMEM_BASE;

- gap = ram_size - VIRT_LOWMEM_SIZE;

}

if (size) {

@@ -XXX,XX +XXX,XX @@ static void fw_cfg_add_memory(MachineState *ms)

}

/* add fw_cfg memory map of other nodes */

- size = ram_size - numa_info[0].node_mem;

- gap = VIRT_LOWMEM_BASE + VIRT_LOWMEM_SIZE;

- if (base < gap && (base + size) > gap) {

+ if (numa_info[0].node_mem < gap && ram_size > gap) {

/*

* memory map for the maining nodes splited into two part

- * lowram: [base, +(gap - base))

- * highram: [VIRT_HIGHMEM_BASE, +(size - (gap - base)))

+ * lowram: [base, +(gap - numa_info[0].node_mem))

+ * highram: [VIRT_HIGHMEM_BASE, +(ram_size - gap))

*/

- memmap_add_entry(base, gap - base, 1);

- size -= gap - base;

+ memmap_add_entry(base, gap - numa_info[0].node_mem, 1);

+ size = ram_size - gap;

base = VIRT_HIGHMEM_BASE;

+ } else {

+ size = ram_size - numa_info[0].node_mem;

}

if (size)

2.34.1

From: Jiaxun Yang <jiaxun.yang@flygoat.com>

I would like to be informed on changes made to the LoongArch virt machine.

I'm fairly familiar with Loongson-3 series platform hardware and doing

firmwre (U-Boot) development as hobbyist on LoongArch virt platform,

so I believe I can give positive review input to changes on that machine.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ LoongArch Machines

------------------

Virt

M: Song Gao <gaosong@loongson.cn>

+R: Jiaxun Yang <jiaxun.yang@flygoat.com>

S: Maintained

F: docs/system/loongarch/virt.rst

F: configs/targets/loongarch64-softmmu.mak

2.34.1

From: Bibo Mao <maobibo@loongson.cn>

With KVM virtualization, debug exception is injected to guest kernel

rather than host for normal break intruction. Here hypercall

instruction with special code is used for sw breakpoint usage,

and detailed instruction comes from kvm kernel with user API

KVM_REG_LOONGARCH_DEBUG_INST.

Now only software breakpoint is supported, and it is allowed to

insert/remove software breakpoint. We can debug guest kernel with gdb

method after kernel is loaded, hardware breakpoint will be added in later.

configs/targets/loongarch64-softmmu.mak | 1 +

target/loongarch/kvm/kvm.c | 76 +++++++++++++++++++++++++

2 files changed, 77 insertions(+)

diff --git a/configs/targets/loongarch64-softmmu.mak b/configs/targets/loongarch64-softmmu.mak

--- a/configs/targets/loongarch64-softmmu.mak

+++ b/configs/targets/loongarch64-softmmu.mak

TARGET_ARCH=loongarch64

TARGET_BASE_ARCH=loongarch

+TARGET_KVM_HAVE_GUEST_DEBUG=y

TARGET_SUPPORTS_MTTCG=y

TARGET_XML_FILES= gdb-xml/loongarch-base32.xml gdb-xml/loongarch-base64.xml gdb-xml/loongarch-fpu.xml

# all boards require libfdt

diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/target/loongarch/kvm/kvm.c

+++ b/target/loongarch/kvm/kvm.c

@@ -XXX,XX +XXX,XX @@

#include "trace.h"

static bool cap_has_mp_state;

+static unsigned int brk_insn;

const KVMCapabilityInfo kvm_arch_required_capabilities[] = {

KVM_CAP_LAST_INFO

};

@@ -XXX,XX +XXX,XX @@ static void kvm_loongarch_vm_stage_change(void *opaque, bool running,

int kvm_arch_init_vcpu(CPUState *cs)

{

+ uint64_t val;

qemu_add_vm_change_state_handler(kvm_loongarch_vm_stage_change, cs);

+

+ if (!kvm_get_one_reg(cs, KVM_REG_LOONGARCH_DEBUG_INST, &val)) {

+ brk_insn = val;

+int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)

+ static uint32_t brk;

+ if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&brk, 4, 0) ||

+ brk != brk_insn ||

+ cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 4, 1)) {

+ error_report("%s failed", __func__);

+ return -EINVAL;

+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)

+{

+ return -ENOSYS;

+}

+

+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)

+{

+ return -ENOSYS;

+}

+

+void kvm_arch_remove_all_hw_breakpoints(void)

+{

+}

+

+static bool kvm_loongarch_handle_debug(CPUState *cs, struct kvm_run *run)

+{

+ LoongArchCPU *cpu = LOONGARCH_CPU(cs);

+ CPULoongArchState *env = &cpu->env;

+

+ kvm_cpu_synchronize_state(cs);

+ if (cs->singlestep_enabled) {

+ return true;

+ }

+

+ if (kvm_find_sw_breakpoint(cs, env->pc)) {

+ return true;

+ }

+

+ return false;

+}

+

int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

int ret = 0;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

run->iocsr_io.len,

run->iocsr_io.is_write);

break;

+

+ case KVM_EXIT_DEBUG:

+ if (kvm_loongarch_handle_debug(cs, run)) {

+ ret = EXCP_DEBUG;

+ }

+ break;

+

default:

ret = -1;

warn_report("KVM: unknown exit reason %d", run->exit_reason);

2.34.1

From: Feiyang Chen <chris.chenfeiyang@gmail.com>

Since srai.w is a valid instruction on la32, remove the avail_64 check

and simplify trans_srai_w().

Fixes: c0c0461e3a06 ("target/loongarch: Add avail_64 to check la64-only instructions")

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Feiyang Chen <chris.chenfeiyang@gmail.com>

Message-Id: <20240628033357.50027-1-chris.chenfeiyang@gmail.com>

Signed-off-by: Song Gao <gaosong@loongson.cn>

target/loongarch/tcg/insn_trans/trans_shift.c.inc | 15 +++------------

1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_shift.c.inc b/target/loongarch/tcg/insn_trans/trans_shift.c.inc

--- a/target/loongarch/tcg/insn_trans/trans_shift.c.inc

+++ b/target/loongarch/tcg/insn_trans/trans_shift.c.inc

@@ -XXX,XX +XXX,XX @@ static void gen_rotr_d(TCGv dest, TCGv src1, TCGv src2)

tcg_gen_rotr_tl(dest, src1, t0);

-static bool trans_srai_w(DisasContext *ctx, arg_srai_w *a)

+static void gen_sari_w(TCGv dest, TCGv src1, target_long imm)

- TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);

- TCGv src1 = gpr_src(ctx, a->rj, EXT_ZERO);

-

- if (!avail_64(ctx)) {

- return false;

- }

-

- tcg_gen_sextract_tl(dest, src1, a->imm, 32 - a->imm);

- gen_set_gpr(a->rd, dest, EXT_NONE);

-

- return true;

+ tcg_gen_sextract_tl(dest, src1, imm, 32 - imm);

TRANS(sll_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_sll_w)

@@ -XXX,XX +XXX,XX @@ TRANS(slli_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_shli_tl)

TRANS(slli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)

TRANS(srli_w, ALL, gen_rri_c, EXT_ZERO, EXT_SIGN, tcg_gen_shri_tl)

TRANS(srli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)

+TRANS(srai_w, ALL, gen_rri_c, EXT_NONE, EXT_NONE, gen_sari_w)

TRANS(srai_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)

TRANS(rotri_w, 64, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)

TRANS(rotri_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)

2.34.1

We set the value of register CSR_PRCFG3, but left out CSR_PRCFG1

and CSR_PRCFG2. Set CSR_PRCFG1 and CSR_PRCFG2 according to the

default values of the physical machine.

Signed-off-by: Song Gao <gaosong@loongson.cn>

Reviewed-by: Bibo Mao <maobibo@loongson.cn>

Message-Id: <20240705021839.1004374-1-gaosong@loongson.cn>

target/loongarch/cpu.c | 17 ++++++++++++-----

1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c

--- a/target/loongarch/cpu.c

+++ b/target/loongarch/cpu.c

@@ -XXX,XX +XXX,XX @@ static void loongarch_la464_initfn(Object *obj)

env->cpucfg[20] = data;

env->CSR_ASID = FIELD_DP64(0, CSR_ASID, ASIDBITS, 0xa);

+

+ env->CSR_PRCFG1 = FIELD_DP64(env->CSR_PRCFG1, CSR_PRCFG1, SAVE_NUM, 8);

+ env->CSR_PRCFG1 = FIELD_DP64(env->CSR_PRCFG1, CSR_PRCFG1, TIMER_BITS, 0x2f);

+ env->CSR_PRCFG1 = FIELD_DP64(env->CSR_PRCFG1, CSR_PRCFG1, VSMAX, 7);

+

+ env->CSR_PRCFG2 = 0x3ffff000;

+

+ env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, TLB_TYPE, 2);

+ env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, MTLB_ENTRY, 63);

+ env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_WAYS, 7);

+ env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_SETS, 8);

+

loongarch_cpu_post_init(obj);

@@ -XXX,XX +XXX,XX @@ static void loongarch_cpu_reset_hold(Object *obj, ResetType type)

env->CSR_MERRCTL = FIELD_DP64(env->CSR_MERRCTL, CSR_MERRCTL, ISMERR, 0);

env->CSR_TID = cs->cpu_index;

- env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, TLB_TYPE, 2);

- env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, MTLB_ENTRY, 63);

- env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_WAYS, 7);

- env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_SETS, 8);

for (n = 0; n < 4; n++) {

env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV0, 0);

env->CSR_DMW[n] = FIELD_DP64(env->CSR_DMW[n], CSR_DMW, PLV1, 0);