[Qemu-devel] [PULL 00/10] target-arm queue

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

target-arm queue for rc1 -- these are all bug fixes.

thanks
-- PMM

The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:

  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715

for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:

  target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * report ARMv8-A FP support for AArch32 -cpu max
 * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
 * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
 * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
 * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
 * hw/arm/virt: Fix non-secure flash mode
 * pl031: Correctly migrate state when using -rtc clock=host
 * fix regression that meant arm926 and arm1026 lost VFP
   double-precision support
 * v8M: NS BusFault on vector table fetch escalates to NS HardFault

----------------------------------------------------------------
Alex Bennée (1):
      target/arm: report ARMv8-A FP support for AArch32 -cpu max

David Engraf (1):
      hw/arm/virt: Fix non-secure flash mode

Peter Maydell (3):
      pl031: Correctly migrate state when using -rtc clock=host
      target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
      target/arm: NS BusFault on vector table fetch escalates to NS HardFault

Philippe Mathieu-Daudé (5):
      hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
      hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
      hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
      hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
      hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

 include/hw/timer/pl031.h |  2 ++
 hw/arm/virt.c            |  2 +-
 hw/core/machine.c        |  1 +
 hw/display/xlnx_dp.c     | 15 +++++---
 hw/ssi/mss-spi.c         |  8 ++++-
 hw/ssi/xilinx_spips.c    | 43 +++++++++++++++-------
 hw/timer/pl031.c         | 92 +++++++++++++++++++++++++++++++++++++++++++++---
 target/arm/cpu.c         | 16 +++++++++
 target/arm/m_helper.c    | 21 ++++++++---
 9 files changed, 174 insertions(+), 26 deletions(-)

[Qemu-devel] [PULL 01/10] target/arm: report ARMv8-A FP support for AArch32 -cpu max

[Peter Maydell]

From: Alex Bennée <alex.bennee@linaro.org>

When we converted to using feature bits in 602f6e42cfbf we missed out
the fact (dp && arm_dc_feature(s, ARM_FEATURE_V8)) was supported for
-cpu max configurations. This caused a regression in the GCC test
suite. Fix this by setting the appropriate bits in mvfr1.FPHP to
report ARMv8-A with FP support (but not ARMv8.2-FP16).

Fixes: https://bugs.launchpad.net/qemu/+bug/1836078
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190711103737.10017-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e75a64a25a4..ad164a773b2 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2452,6 +2452,10 @@ static void arm_max_initfn(Object *obj)
             t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
             cpu->isar.id_isar6 = t;
 
+            t = cpu->isar.mvfr1;
+            t = FIELD_DP32(t, MVFR1, FPHP, 2);     /* v8.0 FP support */
+            cpu->isar.mvfr1 = t;
+
             t = cpu->isar.mvfr2;
             t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
             t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-- 
2.20.1

[Qemu-devel] [PULL 02/10] hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@redhat.com>

In the next commit we will implement the write_with_attrs()
handler. To avoid using different APIs, convert the read()
handler first.

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 8115bb6d468..b7c7275dbe4 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -1202,27 +1202,26 @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
     }
 }
 
-static uint64_t
-lqspi_read(void *opaque, hwaddr addr, unsigned int size)
+static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
+                              unsigned size, MemTxAttrs attrs)
 {
-    XilinxQSPIPS *q = opaque;
-    uint32_t ret;
+    XilinxQSPIPS *q = XILINX_QSPIPS(opaque);
 
     if (addr >= q->lqspi_cached_addr &&
             addr <= q->lqspi_cached_addr + LQSPI_CACHE_SIZE - 4) {
         uint8_t *retp = &q->lqspi_buf[addr - q->lqspi_cached_addr];
-        ret = cpu_to_le32(*(uint32_t *)retp);
-        DB_PRINT_L(1, "addr: %08x, data: %08x\n", (unsigned)addr,
-                   (unsigned)ret);
-        return ret;
-    } else {
-        lqspi_load_cache(opaque, addr);
-        return lqspi_read(opaque, addr, size);
+        *value = cpu_to_le32(*(uint32_t *)retp);
+        DB_PRINT_L(1, "addr: %08" HWADDR_PRIx ", data: %08" PRIx64 "\n",
+                   addr, *value);
+        return MEMTX_OK;
     }
+
+    lqspi_load_cache(opaque, addr);
+    return lqspi_read(opaque, addr, value, size, attrs);
 }
 
 static const MemoryRegionOps lqspi_ops = {
-    .read = lqspi_read,
+    .read_with_attrs = lqspi_read,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-- 
2.20.1

[Qemu-devel] [PULL 03/10] hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Lei Sun found while auditing the code that a CPU write would
trigger a NULL pointer dereference.

>From UG1085 datasheet [*] AXI writes in this region are ignored
and generates an AXI Slave Error (SLVERR).

Fix by implementing the write_with_attrs() handler.
Return MEMTX_ERROR when the region is accessed (this error maps
to an AXI slave error).

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf

Reported-by: Lei Sun <slei.casper@gmail.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index b7c7275dbe4..3c4e8365ee1 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -1220,8 +1220,24 @@ static MemTxResult lqspi_read(void *opaque, hwaddr addr, uint64_t *value,
     return lqspi_read(opaque, addr, value, size, attrs);
 }
 
+static MemTxResult lqspi_write(void *opaque, hwaddr offset, uint64_t value,
+                               unsigned size, MemTxAttrs attrs)
+{
+    /*
+     * From UG1085, Chapter 24 (Quad-SPI controllers):
+     * - Writes are ignored
+     * - AXI writes generate an external AXI slave error (SLVERR)
+     */
+    qemu_log_mask(LOG_GUEST_ERROR, "%s Unexpected %u-bit access to 0x%" PRIx64
+                                   " (value: 0x%" PRIx64 "\n",
+                  __func__, size << 3, offset, value);
+
+    return MEMTX_ERROR;
+}
+
 static const MemoryRegionOps lqspi_ops = {
     .read_with_attrs = lqspi_read,
+    .write_with_attrs = lqspi_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
         .min_access_size = 1,
-- 
2.20.1

[Qemu-devel] [PULL 04/10] hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Both lqspi_read() and lqspi_load_cache() expect a 32-bit
aligned address.

>From UG1085 datasheet [*] chapter on 'Quad-SPI Controller':

  Transfer Size Limitations

    Because of the 32-bit wide TX, RX, and generic FIFO, all
    APB/AXI transfers must be an integer multiple of 4-bytes.
    Shorter transfers are not possible.

Set MemoryRegionOps.impl values to force 32-bit accesses,
this way we are sure we do not access the lqspi_buf[] array
out of bound.

[*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 3c4e8365ee1..b29e0a4a89e 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -1239,6 +1239,10 @@ static const MemoryRegionOps lqspi_ops = {
     .read_with_attrs = lqspi_read,
     .write_with_attrs = lqspi_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
     .valid = {
         .min_access_size = 1,
         .max_access_size = 4
-- 
2.20.1

[Qemu-devel] [PULL 05/10] hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Reading the RX_DATA register when the RX_FIFO is empty triggers
an abort. This can be easily reproduced:

  $ qemu-system-arm -M emcraft-sf2 -monitor stdio -S
  QEMU 4.0.50 monitor - type 'help' for more information
  (qemu) x 0x40001010
  Aborted (core dumped)

  (gdb) bt
  #1  0x00007f035874f895 in abort () at /lib64/libc.so.6
  #2  0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66
  #3  0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137
  #4  0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168
  #5  0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
  #6  0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569
  #7  0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420
  #8  0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447
  #9  0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385
  #10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423
  #11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436
  #12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466
  #13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976
  #14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730
  #15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785
  #16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082

From the datasheet "Actel SmartFusion Microcontroller Subsystem
User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this
register has a reset value of 0.

Check the FIFO is not empty before accessing it, else log an
error message.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190709113715.7761-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/mss-spi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/mss-spi.c b/hw/ssi/mss-spi.c
index 918b1f3e821..4c9da5d2b28 100644
--- a/hw/ssi/mss-spi.c
+++ b/hw/ssi/mss-spi.c
@@ -165,7 +165,13 @@ spi_read(void *opaque, hwaddr addr, unsigned int size)
     case R_SPI_RX:
         s->regs[R_SPI_STATUS] &= ~S_RXFIFOFUL;
         s->regs[R_SPI_STATUS] &= ~S_RXCHOVRF;
-        ret = fifo32_pop(&s->rx_fifo);
+        if (fifo32_is_empty(&s->rx_fifo)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Reading empty RX_FIFO\n",
+                          __func__);
+        } else {
+            ret = fifo32_pop(&s->rx_fifo);
+        }
         if (fifo32_is_empty(&s->rx_fifo)) {
             s->regs[R_SPI_STATUS] |= S_RXFIFOEMP;
         }
-- 
2.20.1

[Qemu-devel] [PULL 06/10] hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@redhat.com>

In the previous commit we fixed a crash when the guest read a
register that pop from an empty FIFO.
By auditing the repository, we found another similar use with
an easy way to reproduce:

  $ qemu-system-aarch64 -M xlnx-zcu102 -monitor stdio -S
  QEMU 4.0.50 monitor - type 'help' for more information
  (qemu) xp/b 0xfd4a0134
  Aborted (core dumped)

  (gdb) bt
  #0  0x00007f6936dea57f in raise () at /lib64/libc.so.6
  #1  0x00007f6936dd4895 in abort () at /lib64/libc.so.6
  #2  0x0000561ad32975ec in xlnx_dp_aux_pop_rx_fifo (s=0x7f692babee70) at hw/display/xlnx_dp.c:431
  #3  0x0000561ad3297dc0 in xlnx_dp_read (opaque=0x7f692babee70, offset=77, size=4) at hw/display/xlnx_dp.c:667
  #4  0x0000561ad321b896 in memory_region_read_accessor (mr=0x7f692babf620, addr=308, value=0x7ffe05c1db88, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439
  #5  0x0000561ad321bd70 in access_with_adjusted_size (addr=308, value=0x7ffe05c1db88, size=1, access_size_min=4, access_size_max=4, access_fn=0x561ad321b858 <memory_region_read_accessor>, mr=0x7f692babf620, attrs=...) at memory.c:569
  #6  0x0000561ad321e9d5 in memory_region_dispatch_read1 (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1420
  #7  0x0000561ad321ea9d in memory_region_dispatch_read (mr=0x7f692babf620, addr=308, pval=0x7ffe05c1db88, size=1, attrs=...) at memory.c:1447
  #8  0x0000561ad31bd742 in flatview_read_continue (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1, addr1=308, l=1, mr=0x7f692babf620) at exec.c:3385
  #9  0x0000561ad31bd895 in flatview_read (fv=0x561ad69c04f0, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3423
  #10 0x0000561ad31bd90b in address_space_read_full (as=0x561ad5bb3020, addr=4249485620, attrs=..., buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", len=1) at exec.c:3436
  #11 0x0000561ad33b1c42 in address_space_read (len=1, buf=0x7ffe05c1dcf0 "\020\335\301\005\376\177", attrs=..., addr=4249485620, as=0x561ad5bb3020) at include/exec/memory.h:2131
  #12 0x0000561ad33b1c42 in memory_dump (mon=0x561ad59c4530, count=1, format=120, wsize=1, addr=4249485620, is_physical=1) at monitor/misc.c:723
  #13 0x0000561ad33b1fc1 in hmp_physical_memory_dump (mon=0x561ad59c4530, qdict=0x561ad6c6fd00) at monitor/misc.c:795
  #14 0x0000561ad37b4a9f in handle_hmp_command (mon=0x561ad59c4530, cmdline=0x561ad59d0f22 "/b 0x00000000fd4a0134") at monitor/hmp.c:1082

Fix by checking the FIFO is not empty before popping from it.

The datasheet is not clear about the reset value of this register,
we choose to return '0'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190709113715.7761-4-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/xlnx_dp.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index cfd4c700b7f..cc5b650df0c 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -427,11 +427,18 @@ static uint8_t xlnx_dp_aux_pop_rx_fifo(XlnxDPState *s)
     uint8_t ret;
 
     if (fifo8_is_empty(&s->rx_fifo)) {
-        DPRINTF("rx_fifo underflow..\n");
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Reading empty RX_FIFO\n",
+                      __func__);
+        /*
+         * The datasheet is not clear about the reset value, it seems
+         * to be unspecified. We choose to return '0'.
+         */
+        ret = 0;
+    } else {
+        ret = fifo8_pop(&s->rx_fifo);
+        DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
     }
-    ret = fifo8_pop(&s->rx_fifo);
-    DPRINTF("pop 0x%" PRIX8 " from rx_fifo.\n", ret);
     return ret;
 }
 
-- 
2.20.1

[Qemu-devel] [PULL 07/10] hw/arm/virt: Fix non-secure flash mode

[Peter Maydell]

From: David Engraf <david.engraf@sysgo.com>

Using the whole 128 MiB flash in non-secure mode is not working because
virt_flash_fdt() expects the same address for secure_sysmem and sysmem.
This is not correctly handled by caller because it forwards NULL for
secure_sysmem in non-secure flash mode.

Fixed by using sysmem when secure_sysmem is NULL.

Signed-off-by: David Engraf <david.engraf@sysgo.com>
Message-id: 20190712075002.14326-1-david.engraf@sysgo.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 0b5138cb22c..d9496c93634 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1674,7 +1674,7 @@ static void machvirt_init(MachineState *machine)
                                     &machine->device_memory->mr);
     }
 
-    virt_flash_fdt(vms, sysmem, secure_sysmem);
+    virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
     create_gic(vms, pic);
 
-- 
2.20.1

[Qemu-devel] [PULL 08/10] pl031: Correctly migrate state when using -rtc clock=host

[Peter Maydell]

The PL031 RTC tracks the difference between the guest RTC
and the host RTC using a tick_offset field. For migration,
however, we currently always migrate the offset between
the guest and the vm_clock, even if the RTC clock is not
the same as the vm_clock; this was an attempt to retain
migration backwards compatibility.

Unfortunately this results in the RTC behaving oddly across
a VM state save and restore -- since the VM clock stands still
across save-then-restore, regardless of how much real world
time has elapsed, the guest RTC ends up out of sync with the
host RTC in the restored VM.

Fix this by migrating the raw tick_offset. To retain migration
compatibility as far as possible, we have a new property
migrate-tick-offset; by default this is 'true' and we will
migrate the true tick offset in a new subsection; if the
incoming data has no subsection we fall back to the old
vm_clock-based offset information, so old->new migration
compatibility is preserved. For complete new->old migration
compatibility, the property is set to 'false' for 4.0 and
earlier machine types (this will only affect 'virt-4.0'
and below, as none of the other pl031-using machines are
versioned).

Reported-by: Russell King <rmk@armlinux.org.uk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 20190709143912.28905-1-peter.maydell@linaro.org
---
 include/hw/timer/pl031.h |  2 +
 hw/core/machine.c        |  1 +
 hw/timer/pl031.c         | 92 ++++++++++++++++++++++++++++++++++++++--
 3 files changed, 91 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/pl031.h b/include/hw/timer/pl031.h
index 8857c24ca5d..8c3f555ee28 100644
--- a/include/hw/timer/pl031.h
+++ b/include/hw/timer/pl031.h
@@ -33,6 +33,8 @@ typedef struct PL031State {
      */
     uint32_t tick_offset_vmstate;
     uint32_t tick_offset;
+    bool tick_offset_migrated;
+    bool migrate_tick_offset;
 
     uint32_t mr;
     uint32_t lr;
diff --git a/hw/core/machine.c b/hw/core/machine.c
index c4ead160104..c58a8e594ef 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -35,6 +35,7 @@ GlobalProperty hw_compat_4_0[] = {
     { "virtio-gpu-pci", "edid", "false" },
     { "virtio-device", "use-started", "false" },
     { "virtio-balloon-device", "qemu-4-0-config-size", "true" },
+    { "pl031", "migrate-tick-offset", "false" },
 };
 const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
 
diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c
index 3378084f4a8..1a7e2ee06b3 100644
--- a/hw/timer/pl031.c
+++ b/hw/timer/pl031.c
@@ -199,29 +199,94 @@ static int pl031_pre_save(void *opaque)
 {
     PL031State *s = opaque;
 
-    /* tick_offset is base_time - rtc_clock base time.  Instead, we want to
-     * store the base time relative to the QEMU_CLOCK_VIRTUAL for backwards-compatibility.  */
+    /*
+     * The PL031 device model code uses the tick_offset field, which is
+     * the offset between what the guest RTC should read and what the
+     * QEMU rtc_clock reads:
+     *  guest_rtc = rtc_clock + tick_offset
+     * and so
+     *  tick_offset = guest_rtc - rtc_clock
+     *
+     * We want to migrate this offset, which sounds straightforward.
+     * Unfortunately older versions of QEMU migrated a conversion of this
+     * offset into an offset from the vm_clock. (This was in turn an
+     * attempt to be compatible with even older QEMU versions, but it
+     * has incorrect behaviour if the rtc_clock is not the same as the
+     * vm_clock.) So we put the actual tick_offset into a migration
+     * subsection, and the backwards-compatible time-relative-to-vm_clock
+     * in the main migration state.
+     *
+     * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
+     */
     int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
 
     return 0;
 }
 
+static int pl031_pre_load(void *opaque)
+{
+    PL031State *s = opaque;
+
+    s->tick_offset_migrated = false;
+    return 0;
+}
+
 static int pl031_post_load(void *opaque, int version_id)
 {
     PL031State *s = opaque;
 
-    int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    s->tick_offset = s->tick_offset_vmstate - delta / NANOSECONDS_PER_SECOND;
+    /*
+     * If we got the tick_offset subsection, then we can just use
+     * the value in that. Otherwise the source is an older QEMU and
+     * has given us the offset from the vm_clock; convert it back to
+     * an offset from the rtc_clock. This will cause time to incorrectly
+     * go backwards compared to the host RTC, but this is unavoidable.
+     */
+
+    if (!s->tick_offset_migrated) {
+        int64_t delta = qemu_clock_get_ns(rtc_clock) -
+            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        s->tick_offset = s->tick_offset_vmstate -
+            delta / NANOSECONDS_PER_SECOND;
+    }
     pl031_set_alarm(s);
     return 0;
 }
 
+static int pl031_tick_offset_post_load(void *opaque, int version_id)
+{
+    PL031State *s = opaque;
+
+    s->tick_offset_migrated = true;
+    return 0;
+}
+
+static bool pl031_tick_offset_needed(void *opaque)
+{
+    PL031State *s = opaque;
+
+    return s->migrate_tick_offset;
+}
+
+static const VMStateDescription vmstate_pl031_tick_offset = {
+    .name = "pl031/tick-offset",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pl031_tick_offset_needed,
+    .post_load = pl031_tick_offset_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(tick_offset, PL031State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_pl031 = {
     .name = "pl031",
     .version_id = 1,
     .minimum_version_id = 1,
     .pre_save = pl031_pre_save,
+    .pre_load = pl031_pre_load,
     .post_load = pl031_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(tick_offset_vmstate, PL031State),
@@ -231,14 +296,33 @@ static const VMStateDescription vmstate_pl031 = {
         VMSTATE_UINT32(im, PL031State),
         VMSTATE_UINT32(is, PL031State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_pl031_tick_offset,
+        NULL
     }
 };
 
+static Property pl031_properties[] = {
+    /*
+     * True to correctly migrate the tick offset of the RTC. False to
+     * obtain backward migration compatibility with older QEMU versions,
+     * at the expense of the guest RTC going backwards compared with the
+     * host RTC when the VM is saved/restored if using -rtc host.
+     * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
+     * 'false' also permits newer QEMU to migrate to older QEMU.)
+     */
+    DEFINE_PROP_BOOL("migrate-tick-offset",
+                     PL031State, migrate_tick_offset, true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void pl031_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->vmsd = &vmstate_pl031;
+    dc->props = pl031_properties;
 }
 
 static const TypeInfo pl031_info = {
-- 
2.20.1

[Qemu-devel] [PULL 09/10] target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026

[Peter Maydell]

The ARMv5 architecture didn't specify detailed per-feature ID
registers. Now that we're using the MVFR0 register fields to
gate the existence of VFP instructions, we need to set up
the correct values in the cpu->isar structure so that we still
provide an FPU to the guest.

This fixes a regression in the arm926 and arm1026 CPUs, which
are the only ones that both have VFP and are ARMv5 or earlier.
This regression was introduced by the VFP refactoring, and more
specifically by commits 1120827fa182f0e76 and 266bd25c485597c,
which accidentally disabled VFP short-vector support and
double-precision support on these CPUs.

Fixes: 1120827fa182f0e
Fixes: 266bd25c485597c
Fixes: https://bugs.launchpad.net/qemu/+bug/1836192
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Christophe Lyon <christophe.lyon@linaro.org>
Message-id: 20190711131241.22231-1-peter.maydell@linaro.org
---
 target/arm/cpu.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index ad164a773b2..1959467fdc8 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1666,6 +1666,12 @@ static void arm926_initfn(Object *obj)
      * set the field to indicate Jazelle support within QEMU.
      */
     cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    /*
+     * Similarly, we need to set MVFR0 fields to enable double precision
+     * and short vector support even though ARMv5 doesn't have this register.
+     */
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
 }
 
 static void arm946_initfn(Object *obj)
@@ -1702,6 +1708,12 @@ static void arm1026_initfn(Object *obj)
      * set the field to indicate Jazelle support within QEMU.
      */
     cpu->isar.id_isar1 = FIELD_DP32(cpu->isar.id_isar1, ID_ISAR1, JAZELLE, 1);
+    /*
+     * Similarly, we need to set MVFR0 fields to enable double precision
+     * and short vector support even though ARMv5 doesn't have this register.
+     */
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPDP, 1);
 
     {
         /* The 1026 had an IFAR at c6,c0,0,1 rather than the ARMv6 c6,c0,0,2 */
-- 
2.20.1

[Qemu-devel] [PULL 10/10] target/arm: NS BusFault on vector table fetch escalates to NS HardFault

[Peter Maydell]

In the M-profile architecture, when we do a vector table fetch and it
fails, we need to report a HardFault.  Whether this is a Secure HF or
a NonSecure HF depends on several things.  If AIRCR.BFHFNMINS is 0
then HF is always Secure, because there is no NonSecure HardFault.
Otherwise, the answer depends on whether the 'underlying exception'
(MemManage, BusFault, SecureFault) targets Secure or NonSecure.  (In
the pseudocode, this is handled in the Vector() function: the final
exc.isSecure is calculated by looking at the exc.isSecure from the
exception returned from the memory access, not the isSecure input
argument.)

We weren't doing this correctly, because we were looking at
the target security domain of the exception we were trying to
load the vector table entry for. This produces errors of two kinds:
 * a load from the NS vector table which hits the "NS access
   to S memory" SecureFault should end up as a Secure HardFault,
   but we were raising an NS HardFault
 * a load from the S vector table which causes a BusFault
   should raise an NS HardFault if BFHFNMINS == 1 (because
   in that case all BusFaults are NonSecure), but we were raising
   a Secure HardFault

Correct the logic.

We also fix a comment error where we claimed that we might
be escalating MemManage to HardFault, and forgot about SecureFault.
(Vector loads can never hit MPU access faults, because they're
always aligned and always use the default address map.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190705094823.28905-1-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index 1867435db7d..84609f446e6 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -624,7 +624,11 @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
         if (sattrs.ns) {
             attrs.secure = false;
         } else if (!targets_secure) {
-            /* NS access to S memory */
+            /*
+             * NS access to S memory: the underlying exception which we escalate
+             * to HardFault is SecureFault, which always targets Secure.
+             */
+            exc_secure = true;
             goto load_fail;
         }
     }
@@ -632,6 +636,11 @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
     vector_entry = address_space_ldl(arm_addressspace(cs, attrs), addr,
                                      attrs, &result);
     if (result != MEMTX_OK) {
+        /*
+         * Underlying exception is BusFault: its target security state
+         * depends on BFHFNMINS.
+         */
+        exc_secure = !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
         goto load_fail;
     }
     *pvec = vector_entry;
@@ -641,13 +650,17 @@ load_fail:
     /*
      * All vector table fetch fails are reported as HardFault, with
      * HFSR.VECTTBL and .FORCED set. (FORCED is set because
-     * technically the underlying exception is a MemManage or BusFault
+     * technically the underlying exception is a SecureFault or BusFault
      * that is escalated to HardFault.) This is a terminal exception,
      * so we will either take the HardFault immediately or else enter
      * lockup (the latter case is handled in armv7m_nvic_set_pending_derived()).
+     * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
+     * secure); otherwise it targets the same security state as the
+     * underlying exception.
      */
-    exc_secure = targets_secure ||
-        !(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK);
+    if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+        exc_secure = true;
+    }
     env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
     armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
     return false;
-- 
2.20.1

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On Mon, 15 Jul 2019 at 14:42, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> target-arm queue for rc1 -- these are all bug fixes.
>
> thanks
> -- PMM
>
> The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
>
>   Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
>
> for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
>
>   target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * report ARMv8-A FP support for AArch32 -cpu max
>  * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
>  * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
>  * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
>  * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
>  * hw/arm/virt: Fix non-secure flash mode
>  * pl031: Correctly migrate state when using -rtc clock=host
>  * fix regression that meant arm926 and arm1026 lost VFP
>    double-precision support
>  * v8M: NS BusFault on vector table fetch escalates to NS HardFault
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.1
for any user-visible changes.

-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Patchew URL: https://patchew.org/QEMU/20190715134211.23063-1-peter.maydell@linaro.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20190715134211.23063-1-peter.maydell@linaro.org
Type: series
Subject: [Qemu-devel] [PULL 00/10] target-arm queue

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
 * [new tag]               patchew/20190715134211.23063-1-peter.maydell@linaro.org -> patchew/20190715134211.23063-1-peter.maydell@linaro.org
Switched to a new branch 'test'
374fdb936e target/arm: NS BusFault on vector table fetch escalates to NS HardFault
a30b1dad81 target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
6d7051773f pl031: Correctly migrate state when using -rtc clock=host
93d58455ba hw/arm/virt: Fix non-secure flash mode
08594d9831 hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
d4bfee6403 hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
521dcfc621 hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
28dc994a87 hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
33d10d39bd hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
4ad540cb00 target/arm: report ARMv8-A FP support for AArch32 -cpu max

=== OUTPUT BEGIN ===
1/10 Checking commit 4ad540cb003f (target/arm: report ARMv8-A FP support for AArch32 -cpu max)
2/10 Checking commit 33d10d39bd1e (hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs)
3/10 Checking commit 28dc994a8771 (hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory)
4/10 Checking commit 521dcfc62131 (hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[])
5/10 Checking commit d4bfee6403a6 (hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO)
6/10 Checking commit 08594d9831b4 (hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO)
7/10 Checking commit 93d58455baf6 (hw/arm/virt: Fix non-secure flash mode)
8/10 Checking commit 6d7051773f27 (pl031: Correctly migrate state when using -rtc clock=host)
ERROR: spaces required around that '*' (ctx:VxV)
#158: FILE: hw/timer/pl031.c:300:
+    .subsections = (const VMStateDescription*[]) {
                                             ^

total: 1 errors, 0 warnings, 146 lines checked

Patch 8/10 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

9/10 Checking commit a30b1dad815c (target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026)
10/10 Checking commit 374fdb936ee9 (target/arm: NS BusFault on vector table fetch escalates to NS HardFault)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20190715134211.23063-1-peter.maydell@linaro.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Patchew URL: https://patchew.org/QEMU/20190715134211.23063-1-peter.maydell@linaro.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Subject: [Qemu-devel] [PULL 00/10] target-arm queue
Message-id: 20190715134211.23063-1-peter.maydell@linaro.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
 * [new tag]         patchew/20190715134211.23063-1-peter.maydell@linaro.org -> patchew/20190715134211.23063-1-peter.maydell@linaro.org
Switched to a new branch 'test'
374fdb9 target/arm: NS BusFault on vector table fetch escalates to NS HardFault
a30b1da target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
6d70517 pl031: Correctly migrate state when using -rtc clock=host
93d5845 hw/arm/virt: Fix non-secure flash mode
08594d9 hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
d4bfee6 hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
521dcfc hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
28dc994 hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
33d10d3 hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
4ad540c target/arm: report ARMv8-A FP support for AArch32 -cpu max

=== OUTPUT BEGIN ===
1/10 Checking commit 4ad540cb003f (target/arm: report ARMv8-A FP support for AArch32 -cpu max)
2/10 Checking commit 33d10d39bd1e (hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs)
3/10 Checking commit 28dc994a8771 (hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory)
4/10 Checking commit 521dcfc62131 (hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[])
5/10 Checking commit d4bfee6403a6 (hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO)
6/10 Checking commit 08594d9831b4 (hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO)
7/10 Checking commit 93d58455baf6 (hw/arm/virt: Fix non-secure flash mode)
8/10 Checking commit 6d7051773f27 (pl031: Correctly migrate state when using -rtc clock=host)
ERROR: spaces required around that '*' (ctx:VxV)
#158: FILE: hw/timer/pl031.c:300:
+    .subsections = (const VMStateDescription*[]) {
                                             ^

total: 1 errors, 0 warnings, 146 lines checked

Patch 8/10 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

9/10 Checking commit a30b1dad815c (target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026)
10/10 Checking commit 374fdb936ee9 (target/arm: NS BusFault on vector table fetch escalates to NS HardFault)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20190715134211.23063-1-peter.maydell@linaro.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 19 November 2018 at 15:57, Peter Maydell <peter.maydell@linaro.org> wrote:
> Some Arm bugfixes for rc2...
>
> thanks
> -- PMM
>
> The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:
>
>   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119
>
> for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:
>
>   MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * various MAINTAINERS file updates
>  * hw/block/onenand: use qemu_log_mask() for reporting
>  * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
>    on the n800 and n810 machine models
>  * target/arm: fix smc incorrectly trapping to EL3 when secure is off
>  * hw/arm/stm32f205: Fix the UART and Timer region size
>  * target/arm: read ID registers for KVM guests so they can be
>    used to gate "is feature X present" checks
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Some Arm bugfixes for rc2...

thanks
-- PMM

The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:

  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119

for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:

  MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)

----------------------------------------------------------------
target-arm queue:
 * various MAINTAINERS file updates
 * hw/block/onenand: use qemu_log_mask() for reporting
 * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
   on the n800 and n810 machine models
 * target/arm: fix smc incorrectly trapping to EL3 when secure is off
 * hw/arm/stm32f205: Fix the UART and Timer region size
 * target/arm: read ID registers for KVM guests so they can be
   used to gate "is feature X present" checks

----------------------------------------------------------------
Luc Michel (1):
      target/arm: fix smc incorrectly trapping to EL3 when secure is off

Peter Maydell (3):
      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
      hw/block/onenand: use qemu_log_mask() for reporting
      MAINTAINERS: list myself as maintainer for various Arm boards

Richard Henderson (4):
      target/arm: Install ARMISARegisters from kvm host
      target/arm: Fill in ARMISARegisters for kvm64
      target/arm: Introduce read_sys_reg32 for kvm32
      target/arm: Fill in ARMISARegisters for kvm32

Seth Kintigh (1):
      hw/arm/stm32f205: Fix the UART and Timer region size

Thomas Huth (1):
      MAINTAINERS: Add entries for missing ARM boards

 target/arm/kvm_arm.h       |   1 +
 hw/block/onenand.c         |  24 +++++-----
 hw/char/stm32f2xx_usart.c  |   2 +-
 hw/timer/stm32f2xx_timer.c |   2 +-
 target/arm/kvm.c           |   1 +
 target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
 target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
 target/arm/op_helper.c     |  54 +++++++++++++++++++----
 MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
 9 files changed, 293 insertions(+), 64 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 23 March 2018 at 18:49, Peter Maydell <peter.maydell@linaro.org> wrote:
> Ten arm-related bug fixes for 2.12...
>
> thanks
> -- PMM
>
> The following changes since commit 4c2c1015905fa1d616750dfe024b4c0b35875950:
>
>   Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20180323' into staging (2018-03-23 10:20:54 +0000)
>
> are available in the Git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180323
>
> for you to fetch changes up to 548f514cf89dd9ab39c0cb4c063097bccf141fdd:
>
>   target/arm: Always set FAR to a known unknown value for debug exceptions (2018-03-23 18:26:46 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * arm/translate-a64: don't lose interrupts after unmasking via write to DAIF
>  * sdhci: fix incorrect use of Error *
>  * hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
>  * hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
>  * i.MX: Support serial RS-232 break properly
>  * mach-virt: Set VM's SMBIOS system version to mc->name
>  * target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
>  * target/arm: Factor out code to calculate FSR for debug exceptions
>  * target/arm: Set FSR for BKPT, BRK when raising exception
>  * target/arm: Always set FAR to a known unknown value for debug exceptions
>

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20180323184958.14252-1-peter.maydell@linaro.org
Subject: [Qemu-devel] [PULL 00/10] target-arm queue

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
e4250a6575 target/arm: Always set FAR to a known unknown value for debug exceptions
5f8ad1e5dc target/arm: Set FSR for BKPT, BRK when raising exception
1f8698e782 target/arm: Factor out code to calculate FSR for debug exceptions
01c3c783a2 target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
6fdd8ed47e mach-virt: Set VM's SMBIOS system version to mc->name
4c27421e3d i.MX: Support serial RS-232 break properly
541bf9ad10 hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
4ba4d6edd9 hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
c5d1bc28c0 sdhci: fix incorrect use of Error *
c8c419d13c arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT

=== OUTPUT BEGIN ===
Checking PATCH 1/10: arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT...
Checking PATCH 2/10: sdhci: fix incorrect use of Error *...
Checking PATCH 3/10: hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses...
Checking PATCH 4/10: hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15...
Checking PATCH 5/10: i.MX: Support serial RS-232 break properly...
ERROR: spaces required around that '<<' (ctx:VxV)
#56: FILE: include/hw/char/imx_serial.h:29:
+#define URXD_FRMERR     (1<<12)   /* Character has frame error */
                           ^

total: 1 errors, 0 warnings, 24 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 6/10: mach-virt: Set VM's SMBIOS system version to mc->name...
Checking PATCH 7/10: target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK...
Checking PATCH 8/10: target/arm: Factor out code to calculate FSR for debug exceptions...
Checking PATCH 9/10: target/arm: Set FSR for BKPT, BRK when raising exception...
Checking PATCH 10/10: target/arm: Always set FAR to a known unknown value for debug exceptions...
=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Ten arm-related bug fixes for 2.12...

thanks
-- PMM

The following changes since commit 4c2c1015905fa1d616750dfe024b4c0b35875950:

  Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20180323' into staging (2018-03-23 10:20:54 +0000)

are available in the Git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180323

for you to fetch changes up to 548f514cf89dd9ab39c0cb4c063097bccf141fdd:

  target/arm: Always set FAR to a known unknown value for debug exceptions (2018-03-23 18:26:46 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm/translate-a64: don't lose interrupts after unmasking via write to DAIF
 * sdhci: fix incorrect use of Error *
 * hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
 * hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
 * i.MX: Support serial RS-232 break properly
 * mach-virt: Set VM's SMBIOS system version to mc->name
 * target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
 * target/arm: Factor out code to calculate FSR for debug exceptions
 * target/arm: Set FSR for BKPT, BRK when raising exception
 * target/arm: Always set FAR to a known unknown value for debug exceptions

----------------------------------------------------------------
Paolo Bonzini (1):
      sdhci: fix incorrect use of Error *

Peter Maydell (6):
      hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
      hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
      target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
      target/arm: Factor out code to calculate FSR for debug exceptions
      target/arm: Set FSR for BKPT, BRK when raising exception
      target/arm: Always set FAR to a known unknown value for debug exceptions

Trent Piepho (1):
      i.MX: Support serial RS-232 break properly

Victor Kamensky (1):
      arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT

Wei Huang (1):
      mach-virt: Set VM's SMBIOS system version to mc->name

 include/hw/arm/virt.h        |  1 +
 include/hw/char/imx_serial.h |  1 +
 target/arm/helper.h          |  1 +
 target/arm/internals.h       | 25 +++++++++++++++++++++++++
 hw/arm/bcm2836.c             |  2 +-
 hw/arm/raspi.c               |  2 +-
 hw/arm/virt.c                |  8 +++++++-
 hw/char/imx_serial.c         |  5 ++++-
 hw/intc/arm_gicv3_cpuif.c    |  6 +++---
 hw/sd/sdhci.c                |  4 ++--
 target/arm/helper.c          |  1 -
 target/arm/op_helper.c       | 33 ++++++++++++++++++++++-----------
 target/arm/translate-a64.c   | 21 ++++++++++++++++-----
 target/arm/translate.c       | 19 ++++++++++++++-----
 14 files changed, 98 insertions(+), 31 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 11 March 2015 at 14:18, Peter Maydell <peter.maydell@linaro.org> wrote:
> target-arm queue: mostly bug fixes, but also the Netduino 2
> machine model. I'm letting that in (even though it's nearly
> hardfreeze) since a new board model isn't going to impact
> other existing uses, and the patches were posted well before
> softfreeze deadline.

Applied, thanks.

PS: if you see "unknown device" failures in make check, this
is a bug in our makefile/dependency generation stuff (currently
being worked on). The workaround is to
 rm $BUILD_TREE/*/config-devices.mak

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

target-arm queue: mostly bug fixes, but also the Netduino 2
machine model. I'm letting that in (even though it's nearly
hardfreeze) since a new board model isn't going to impact
other existing uses, and the patches were posted well before
softfreeze deadline.

-- PMM


The following changes since commit 48412371415a260d00fc7fdcdb400da55f268828:

  Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging (2015-03-11 11:12:35 +0000)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150311

for you to fetch changes up to 4f9950520a115acf9c0a209f0befa45758ad0215:

  bitops.h: sextract64() return type should be int64_t, not uint64_t (2015-03-11 13:21:06 +0000)

----------------------------------------------------------------
target-arm queue:
 * fix a bug in bitops.h
 * implement SD card support on integratorcp
 * add a missing 'compatible' property for Cortex-A57
 * add Netduino 2 machine model
 * fix command line parsing bug for CPU options with multiple CPUs

----------------------------------------------------------------
Alistair Francis (5):
      stm32f2xx_timer: Add the stm32f2xx Timer
      stm32f2xx_USART: Add the stm32f2xx USART Controller
      stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG
      stm32f205: Add the stm32f205 SoC
      netduino2: Add the Netduino 2 Machine

Ard Biesheuvel (1):
      hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

Jan Kiszka (2):
      integrator/cp: Model CP control registers as sysbus device
      integrator/cp: Implement CARDIN and WPROT signals

Peter Maydell (1):
      bitops.h: sextract64() return type should be int64_t, not uint64_t

Ryota Ozaki (1):
      target-arm: Add missing compatible property to A57

 default-configs/arm-softmmu.mak    |   4 +
 hw/arm/Makefile.objs               |   2 +
 hw/arm/integratorcp.c              |  95 +++++++++--
 hw/arm/netduino2.c                 |  57 +++++++
 hw/arm/stm32f205_soc.c             | 160 ++++++++++++++++++
 hw/arm/virt.c                      |   4 +-
 hw/char/Makefile.objs              |   1 +
 hw/char/stm32f2xx_usart.c          | 229 ++++++++++++++++++++++++++
 hw/misc/Makefile.objs              |   1 +
 hw/misc/stm32f2xx_syscfg.c         | 160 ++++++++++++++++++
 hw/timer/Makefile.objs             |   2 +
 hw/timer/stm32f2xx_timer.c         | 328 +++++++++++++++++++++++++++++++++++++
 include/hw/arm/stm32f205_soc.h     |  57 +++++++
 include/hw/char/stm32f2xx_usart.h  |  73 +++++++++
 include/hw/misc/stm32f2xx_syscfg.h |  61 +++++++
 include/hw/timer/stm32f2xx_timer.h | 101 ++++++++++++
 include/qemu/bitops.h              |   2 +-
 target-arm/cpu64.c                 |   1 +
 18 files changed, 1323 insertions(+), 15 deletions(-)
 create mode 100644 hw/arm/netduino2.c
 create mode 100644 hw/arm/stm32f205_soc.c
 create mode 100644 hw/char/stm32f2xx_usart.c
 create mode 100644 hw/misc/stm32f2xx_syscfg.c
 create mode 100644 hw/timer/stm32f2xx_timer.c
 create mode 100644 include/hw/arm/stm32f205_soc.h
 create mode 100644 include/hw/char/stm32f2xx_usart.h
 create mode 100644 include/hw/misc/stm32f2xx_syscfg.h
 create mode 100644 include/hw/timer/stm32f2xx_timer.h

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 20:45, Richard W.M. Jones <rjones@redhat.com> wrote:
> On Sun, May 04, 2014 at 08:36:20PM +0100, Peter Maydell wrote:
>> OK, so you have a kernel (possibly just kernel config) problem
>> here -- this means QEMU got EPERM trying to open /dev/kvm.
>
> Yes for some reason it was 0600.  I set it to 0666.
>
>> This isn't going to work for aarch64 at the moment because:
>>  * KVM aarch64 currently requires '-cpu host'
>
> OK -- I will play with libguestfs to make sure it passes this flag,
> and try again.

It should in theory be possible to get -cpu cortex-a57 to
work (though I haven't tried it so it's likely missing something
trivial); however that will only work if your host CPU is
actually a Cortex-A57. For any other host you'll need
-cpu host.

> Currently waiting for the host (which has panicked
> again) to be rebooted manually.

If your host has panicked that's a kernel bug :-) (or possibly
a hardware bug if you're unlucky). If it does so reproducibly
when you prod it with QEMU then you should probably retest
with a recent kernel and report it to the kvm-arm mailing list.

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Sun, May 04, 2014 at 08:36:20PM +0100, Peter Maydell wrote:
> OK, so you have a kernel (possibly just kernel config) problem
> here -- this means QEMU got EPERM trying to open /dev/kvm.

Yes for some reason it was 0600.  I set it to 0666.

> This isn't going to work for aarch64 at the moment because:
>  * KVM aarch64 currently requires '-cpu host'

OK -- I will play with libguestfs to make sure it passes this flag,
and try again.  Currently waiting for the host (which has panicked
again) to be rebooted manually.

Thanks again,

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 19:58, Richard W.M. Jones <rjones@redhat.com> wrote:
> On Sun, May 04, 2014 at 07:48:38PM +0100, Peter Maydell wrote:
>> On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
>> > I have real aarch64 hardware, and I'm trying to find a version of
>> > qemu-system-aarch64 which will boot a KVM guest in some form.
>> >
>> > Upstream qemu fails with a bizarre thread-local storage problem (yes,
>> > I've patched glibc to fix the makecontext problem).
>> >
>> > Is there a qemu tree I should be looking at?
>>
>> Upstream is it. I haven't been testing it for a while though; it's possible
>> it bitrotted while I wasn't looking.
>
> OK, it might be a kernel problem then.
>
> This was the issue I was having before:
>
> /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 \
>     -global virtio-blk-device.scsi=off \
>     -nodefconfig \
>     -enable-fips \
>     -nodefaults \
>     -display none \
>     -M virt \
>     -machine accel=kvm:tcg \
>     -m 500 \
>     -no-reboot \
>     -rtc driftfix=slew \
>     -global kvm-pit.lost_tick_policy=discard \
>     -kernel /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/kernel \
>     -initrd /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/initrd \
>     -device virtio-scsi-device,id=scsi \
>     -drive file=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/scratch.1,cache=unsafe,format=raw,id=hd0,if=none \
>     -device scsi-hd,drive=hd0 \
>     -drive file=/home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none \
>     -device scsi-hd,drive=appliance \
>     -device virtio-serial-device \
>     -serial stdio \
>     -chardev socket,path=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/guestfsd.sock,id=channel0 \
>     -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
>     -append 'panic=1 console=ttyS0 udevtimeout=600 no_timer_check acpi=off printk.time=1 cgroup_disable=memory root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=screen'
> Could not access KVM kernel module: Permission denied
> failed to initialize KVM: Permission denied
> Back to tcg accelerator.

OK, so you have a kernel (possibly just kernel config) problem
here -- this means QEMU got EPERM trying to open /dev/kvm.
This isn't going to work for aarch64 at the moment because:
 * KVM aarch64 currently requires '-cpu host'
 * '-cpu host' is a KVM only thing that won't work with TCG
If you don't enable KVM we don't put 'host' in the CPU list
so usually the TCG code can't see it -- however "use KVM
but have the init fail" is a path I hadn't considered for getting
into TCG with -cpu host.

Does this happen if you start with accel=tcg so we're using
TCG all the way through?

You can also ignore all this in favour of just figuring out why
your kernel didn't let us open /dev/kvm...

PS: I didn't see a "-cpu something" in your command line;
I forget what the default is but it's probably not what you want.

> libguestfs: error: appliance closed the connection unexpectedly, see earlier error messages
> libguestfs: child_cleanup: 0x3b5a1770: child process died
> libguestfs: sending SIGTERM to process 12438
> libguestfs: error: /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 killed by signal 11 (Segmentation fault), see debug messages above
>
> The stack trace in qemu when the segfault occurs is:
>
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x000002aae2f17394 in cpu_arm_exec (env=0x3ff8401eed0,
>     env@entry=0x2ab1c978440) at /home/rjones/d/qemu/cpu-exec.c:241
> 241         current_cpu = cpu;
>
> (gdb) print tls__current_cpu
> Cannot find thread-local storage for LWP 12922, executable file /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64:
> TLS not supported on this target
>
> ... and ^^^ that's the part that makes no sense to me.  TLS must
> surely be supported, so there must be something odd about the
> compile-time environment.

I think that message is gdb saying that it doesn't support TLS,
not that the target architecture doesn't support TLS. How ancient
is your gdb? Google suggests that TLS support went into the
aarch64 target somewhat after the initial architecture support
(though still a year or so ago, so I would have expected it to get in...)

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

I think this problem comes from my environment adding -fPIE.

In any case, without that flag it doesn't crash in qemu (it
kernel panics instead ..)


Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Sun, May 04, 2014 at 07:48:38PM +0100, Peter Maydell wrote:
> On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
> > I have real aarch64 hardware, and I'm trying to find a version of
> > qemu-system-aarch64 which will boot a KVM guest in some form.
> >
> > Upstream qemu fails with a bizarre thread-local storage problem (yes,
> > I've patched glibc to fix the makecontext problem).
> >
> > Is there a qemu tree I should be looking at?
> 
> Upstream is it. I haven't been testing it for a while though; it's possible
> it bitrotted while I wasn't looking.

OK, it might be a kernel problem then.

This was the issue I was having before:

/home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 \
    -global virtio-blk-device.scsi=off \
    -nodefconfig \
    -enable-fips \
    -nodefaults \
    -display none \
    -M virt \
    -machine accel=kvm:tcg \
    -m 500 \
    -no-reboot \
    -rtc driftfix=slew \
    -global kvm-pit.lost_tick_policy=discard \
    -kernel /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/kernel \
    -initrd /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/initrd \
    -device virtio-scsi-device,id=scsi \
    -drive file=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/scratch.1,cache=unsafe,format=raw,id=hd0,if=none \
    -device scsi-hd,drive=hd0 \
    -drive file=/home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none \
    -device scsi-hd,drive=appliance \
    -device virtio-serial-device \
    -serial stdio \
    -chardev socket,path=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/guestfsd.sock,id=channel0 \
    -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
    -append 'panic=1 console=ttyS0 udevtimeout=600 no_timer_check acpi=off printk.time=1 cgroup_disable=memory root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=screen'
Could not access KVM kernel module: Permission denied
failed to initialize KVM: Permission denied
Back to tcg accelerator.
libguestfs: error: appliance closed the connection unexpectedly, see earlier error messages
libguestfs: child_cleanup: 0x3b5a1770: child process died
libguestfs: sending SIGTERM to process 12438
libguestfs: error: /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 killed by signal 11 (Segmentation fault), see debug messages above

The stack trace in qemu when the segfault occurs is:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000002aae2f17394 in cpu_arm_exec (env=0x3ff8401eed0, 
    env@entry=0x2ab1c978440) at /home/rjones/d/qemu/cpu-exec.c:241
241         current_cpu = cpu;

(gdb) print tls__current_cpu 
Cannot find thread-local storage for LWP 12922, executable file /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64:
TLS not supported on this target

... and ^^^ that's the part that makes no sense to me.  TLS must
surely be supported, so there must be something odd about the
compile-time environment.

Linux ***.redhat.com 3.13.0-0.rc7.31.***.aarch64.debug #1 SMP Fri May 2 16:55:22 EDT 2014 aarch64 aarch64 aarch64 GNU/Linux

glibc-2.19.90-11.fc21.aarch64
gcc-4.9.0-1.fc21.aarch64

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
> I have real aarch64 hardware, and I'm trying to find a version of
> qemu-system-aarch64 which will boot a KVM guest in some form.
>
> Upstream qemu fails with a bizarre thread-local storage problem (yes,
> I've patched glibc to fix the makecontext problem).
>
> Is there a qemu tree I should be looking at?

Upstream is it. I haven't been testing it for a while though; it's possible
it bitrotted while I wasn't looking.

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Thu, May 01, 2014 at 03:54:57PM +0100, Peter Maydell wrote:
> Nothing earthshattering here, but it does have the patch which
> actually lets us boot an emulated AArch64 CPU on a board...

Hi Peter,

I have real aarch64 hardware, and I'm trying to find a version of
qemu-system-aarch64 which will boot a KVM guest in some form.

Upstream qemu fails with a bizarre thread-local storage problem (yes,
I've patched glibc to fix the makecontext problem).

Is there a qemu tree I should be looking at?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 1 May 2014 15:54, Peter Maydell <peter.maydell@linaro.org> wrote:
> Nothing earthshattering here, but it does have the patch which
> actually lets us boot an emulated AArch64 CPU on a board...
>
> thanks
> -- PMM
>
> The following changes since commit 051b9980b99dbfba22ea5f79bd3708d513ae121d:
>
>   Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-6' into staging (2014-05-01 14:17:33 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140501
>
> for you to fetch changes up to f42c5c8ec8aa0e15583487ffee62964830751623:
>
>   hw/arm/virt: Add support for Cortex-A57 (2014-05-01 15:25:52 +0100)

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Nothing earthshattering here, but it does have the patch which
actually lets us boot an emulated AArch64 CPU on a board...

thanks
-- PMM

The following changes since commit 051b9980b99dbfba22ea5f79bd3708d513ae121d:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-6' into staging (2014-05-01 14:17:33 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140501

for you to fetch changes up to f42c5c8ec8aa0e15583487ffee62964830751623:

  hw/arm/virt: Add support for Cortex-A57 (2014-05-01 15:25:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * implement XScale cache lockdown cp15 ops
 * fix v7M CPUID base register
 * implement WFE and YIELD as yields for A64
 * fix A64 "BLR LR"
 * support Cortex-A57 in virt machine model
 * a few other minor AArch64 bugfixes

----------------------------------------------------------------
Edgar E. Iglesias (4):
      target-arm: Make vbar_write 64bit friendly on 32bit hosts
      target-arm: A64: Handle blr lr
      target-arm: A64: Fix a typo when declaring TLBI ops
      target-arm: Correct a comment refering to EL0

Peter Maydell (4):
      target-arm: Implement XScale cache lockdown operations as NOPs
      hw/arm/virt: Create the GIC ourselves rather than (ab)using a15mpcore_priv
      hw/arm/virt: Put GIC register banks on 64K boundaries
      hw/arm/virt: Add support for Cortex-A57

Rabin Vincent (1):
      armv7m_nvic: fix CPUID Base Register

Rob Herring (1):
      target-arm: implement WFE/YIELD as a yield for AArch64

 hw/arm/virt.c              | 93 ++++++++++++++++++++++++++++++----------------
 hw/intc/armv7m_nvic.c      |  2 +-
 target-arm/helper.c        | 41 +++++++++++++-------
 target-arm/op_helper.c     |  2 +-
 target-arm/translate-a64.c |  9 ++++-
 5 files changed, 99 insertions(+), 48 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[andrzej zaborowski]

On 13 December 2011 19:30, Peter Maydell <peter.maydell@linaro.org> wrote:
> Current target-arm pending patches; mostly these are Andreas'
> inference series, plus one from Jean-Christophe that's been
> waiting since before the 1.0 release.
>
> Please pull.

Thanks, pulled (and pushed)

Cheers

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Current target-arm pending patches; mostly these are Andreas'
inference series, plus one from Jean-Christophe that's been
waiting since before the 1.0 release.

Please pull.

-- PMM

The following changes since commit da5361cc685c004d8bb4e7c5e7b3a52c7aca2c56:

  ccid: make threads joinable (2011-12-12 17:06:22 -0600)

are available in the git repository at:
  git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.for-upstream

Andreas Färber (9):
      target-arm: Infer ARMv4T feature from ARMv5
      target-arm: Infer ARMv5 feature from ARMv6
      target-arm: Infer ARMv6 feature from v6K
      target-arm: Infer ARMv6(K) feature from ARMv7
      target-arm: Infer AUXCR feature from ARMv6
      target-arm: Infer Thumb2 feature from ARMv7
      target-arm: Infer Thumb division feature from M profile
      target-arm: Infer VFP feature from VFPv3
      target-arm: Infer VFPv3 feature from VFPv4

Jean-Christophe DUBOIS (1):
      arm: Fix CP15 FSR (C5) domain setting

 target-arm/helper.c |   95 ++++++++++++++++++++++----------------------------
 1 files changed, 42 insertions(+), 53 deletions(-)