* [PULL 1/7] ACPI: Assert that we don't run out of the preallocated memory
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 2/7] hw/misc/aspeed_sdmc: Fix incorrect memory size Peter Maydell
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Dongjiu Geng <gengdongjiu@huawei.com>
data_length is a constant value, so we use assert instead of
condition check.
Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Message-id: 20200622113146.33421-1-gengdongjiu@huawei.com
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/acpi/ghes.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index b363bc331d0..f0ee9f51caa 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -204,16 +204,12 @@ static int acpi_ghes_record_mem_error(uint64_t error_block_address,
/* This is the length if adding a new generic error data entry*/
data_length = ACPI_GHES_DATA_LENGTH + ACPI_GHES_MEM_CPER_LENGTH;
-
/*
- * Check whether it will run out of the preallocated memory if adding a new
- * generic error data entry
+ * It should not run out of the preallocated memory if adding a new generic
+ * error data entry
*/
- if ((data_length + ACPI_GHES_GESB_SIZE) > ACPI_GHES_MAX_RAW_DATA_LENGTH) {
- error_report("Not enough memory to record new CPER!!!");
- g_array_free(block, true);
- return -1;
- }
+ assert((data_length + ACPI_GHES_GESB_SIZE) <=
+ ACPI_GHES_MAX_RAW_DATA_LENGTH);
/* Build the new generic error status block header */
acpi_ghes_generic_error_status(block, ACPI_GEBS_UNCORRECTABLE,
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 2/7] hw/misc/aspeed_sdmc: Fix incorrect memory size
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
2020-07-27 15:19 ` [PULL 1/7] ACPI: Assert that we don't run out of the preallocated memory Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 3/7] target/arm: Always pass cacheattr in S1_ptw_translate Peter Maydell
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Philippe Mathieu-Daudé <f4bug@amsat.org>
The SDRAM Memory Controller has a 32-bit address bus, thus
supports up to 4 GiB of DRAM. There is a signed to unsigned
conversion error with the AST2600 maximum memory size:
(uint64_t)(2048 << 20) = (uint64_t)(-2147483648)
= 0xffffffff40000000
= 16 EiB - 2 GiB
Fix by using the IEC suffixes which are usually safer, and add
an assertion check to verify the memory is valid. This would have
caught this bug:
$ qemu-system-arm -M ast2600-evb
qemu-system-arm: hw/misc/aspeed_sdmc.c:258: aspeed_sdmc_realize: Assertion `asc->max_ram_size < 4 * GiB' failed.
Aborted (core dumped)
Fixes: 1550d72679 ("aspeed/sdmc: Add AST2600 support")
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/misc/aspeed_sdmc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index 0737d8de81d..855848b7d23 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -255,6 +255,7 @@ static void aspeed_sdmc_realize(DeviceState *dev, Error **errp)
AspeedSDMCState *s = ASPEED_SDMC(dev);
AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
+ assert(asc->max_ram_size < 4 * GiB); /* 32-bit address bus */
s->max_ram_size = asc->max_ram_size;
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sdmc_ops, s,
@@ -341,7 +342,7 @@ static void aspeed_2400_sdmc_class_init(ObjectClass *klass, void *data)
AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
dc->desc = "ASPEED 2400 SDRAM Memory Controller";
- asc->max_ram_size = 512 << 20;
+ asc->max_ram_size = 512 * MiB;
asc->compute_conf = aspeed_2400_sdmc_compute_conf;
asc->write = aspeed_2400_sdmc_write;
asc->valid_ram_sizes = aspeed_2400_ram_sizes;
@@ -408,7 +409,7 @@ static void aspeed_2500_sdmc_class_init(ObjectClass *klass, void *data)
AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
dc->desc = "ASPEED 2500 SDRAM Memory Controller";
- asc->max_ram_size = 1024 << 20;
+ asc->max_ram_size = 1 * GiB;
asc->compute_conf = aspeed_2500_sdmc_compute_conf;
asc->write = aspeed_2500_sdmc_write;
asc->valid_ram_sizes = aspeed_2500_ram_sizes;
@@ -485,7 +486,7 @@ static void aspeed_2600_sdmc_class_init(ObjectClass *klass, void *data)
AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
dc->desc = "ASPEED 2600 SDRAM Memory Controller";
- asc->max_ram_size = 2048 << 20;
+ asc->max_ram_size = 2 * GiB;
asc->compute_conf = aspeed_2600_sdmc_compute_conf;
asc->write = aspeed_2600_sdmc_write;
asc->valid_ram_sizes = aspeed_2600_ram_sizes;
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 3/7] target/arm: Always pass cacheattr in S1_ptw_translate
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
2020-07-27 15:19 ` [PULL 1/7] ACPI: Assert that we don't run out of the preallocated memory Peter Maydell
2020-07-27 15:19 ` [PULL 2/7] hw/misc/aspeed_sdmc: Fix incorrect memory size Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 4/7] docs/system/arm/virt: Document 'mte' machine option Peter Maydell
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Richard Henderson <richard.henderson@linaro.org>
When we changed the interface of get_phys_addr_lpae to require
the cacheattr parameter, this spot was missed. The compiler is
unable to detect the use of NULL vs the nonnull attribute here.
Fixes: 7e98e21c098
Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Jan Kiszka <jan.kiskza@siemens.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/helper.c | 19 ++++++-------------
1 file changed, 6 insertions(+), 13 deletions(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c69a2baf1d3..8ef0fb478f4 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10204,21 +10204,11 @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
int s2prot;
int ret;
ARMCacheAttrs cacheattrs = {};
- ARMCacheAttrs *pcacheattrs = NULL;
-
- if (env->cp15.hcr_el2 & HCR_PTW) {
- /*
- * PTW means we must fault if this S1 walk touches S2 Device
- * memory; otherwise we don't care about the attributes and can
- * save the S2 translation the effort of computing them.
- */
- pcacheattrs = &cacheattrs;
- }
ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
false,
&s2pa, &txattrs, &s2prot, &s2size, fi,
- pcacheattrs);
+ &cacheattrs);
if (ret) {
assert(fi->type != ARMFault_None);
fi->s2addr = addr;
@@ -10226,8 +10216,11 @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
fi->s1ptw = true;
return ~0;
}
- if (pcacheattrs && (pcacheattrs->attrs & 0xf0) == 0) {
- /* Access was to Device memory: generate Permission fault */
+ if ((env->cp15.hcr_el2 & HCR_PTW) && (cacheattrs.attrs & 0xf0) == 0) {
+ /*
+ * PTW set and S1 walk touched S2 Device memory:
+ * generate Permission fault.
+ */
fi->type = ARMFault_Permission;
fi->s2addr = addr;
fi->stage2 = true;
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 4/7] docs/system/arm/virt: Document 'mte' machine option
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
` (2 preceding siblings ...)
2020-07-27 15:19 ` [PULL 3/7] target/arm: Always pass cacheattr in S1_ptw_translate Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 5/7] hw/arm/boot: Fix PAUTH for EL3 direct kernel boot Peter Maydell
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
Commit 6a0b7505f1fd6769c which added documentation of the virt board
crossed in the post with commit 6f4e1405b91da0d0 which added a new
'mte' machine option. Update the docs to include the new option.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
docs/system/arm/virt.rst | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index 6621ab7205d..32dc5eb22ee 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -79,6 +79,10 @@ virtualization
Set ``on``/``off`` to enable/disable emulating a guest CPU which implements the
Arm Virtualization Extensions. The default is ``off``.
+mte
+ Set ``on``/``off`` to enable/disable emulating a guest CPU which implements the
+ Arm Memory Tagging Extensions. The default is ``off``.
+
highmem
Set ``on``/``off`` to enable/disable placing devices and RAM in physical
address space above 32 bits. The default is ``on`` for machine types
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 5/7] hw/arm/boot: Fix PAUTH for EL3 direct kernel boot
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
` (3 preceding siblings ...)
2020-07-27 15:19 ` [PULL 4/7] docs/system/arm/virt: Document 'mte' machine option Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 6/7] hw/arm/boot: Fix MTE " Peter Maydell
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Richard Henderson <richard.henderson@linaro.org>
When booting an EL3 cpu with -kernel, we set up EL3 and then
drop down to EL2. We need to enable access to v8.3-PAuth
keys and instructions at EL3 before doing so.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200724163853.504655-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/boot.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index fef4072db16..c44fd3382dd 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -736,6 +736,9 @@ static void do_cpu_reset(void *opaque)
} else {
env->pstate = PSTATE_MODE_EL1h;
}
+ if (cpu_isar_feature(aa64_pauth, cpu)) {
+ env->cp15.scr_el3 |= SCR_API | SCR_APK;
+ }
/* AArch64 kernels never boot in secure mode */
assert(!info->secure_boot);
/* This hook is only supported for AArch32 currently:
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 6/7] hw/arm/boot: Fix MTE for EL3 direct kernel boot
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
` (4 preceding siblings ...)
2020-07-27 15:19 ` [PULL 5/7] hw/arm/boot: Fix PAUTH for EL3 direct kernel boot Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-27 15:19 ` [PULL 7/7] target/arm: Improve IMPDEF algorithm for IRG Peter Maydell
2020-07-28 18:43 ` [PULL 0/7] target-arm queue Peter Maydell
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Richard Henderson <richard.henderson@linaro.org>
When booting an EL3 cpu with -kernel, we set up EL3 and then
drop down to EL2. We need to enable access to v8.5-MemTag
tag allocation at EL3 before doing so.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200724163853.504655-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
hw/arm/boot.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index c44fd3382dd..3e9816af803 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -739,6 +739,9 @@ static void do_cpu_reset(void *opaque)
if (cpu_isar_feature(aa64_pauth, cpu)) {
env->cp15.scr_el3 |= SCR_API | SCR_APK;
}
+ if (cpu_isar_feature(aa64_mte, cpu)) {
+ env->cp15.scr_el3 |= SCR_ATA;
+ }
/* AArch64 kernels never boot in secure mode */
assert(!info->secure_boot);
/* This hook is only supported for AArch32 currently:
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PULL 7/7] target/arm: Improve IMPDEF algorithm for IRG
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
` (5 preceding siblings ...)
2020-07-27 15:19 ` [PULL 6/7] hw/arm/boot: Fix MTE " Peter Maydell
@ 2020-07-27 15:19 ` Peter Maydell
2020-07-28 18:43 ` [PULL 0/7] target-arm queue Peter Maydell
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-27 15:19 UTC (permalink / raw)
To: qemu-devel
From: Richard Henderson <richard.henderson@linaro.org>
When GCR_EL1.RRND==1, the choosing of the random value is IMPDEF,
and the kernel is not expected to have set RGSR_EL1. Force a
non-zero value into SEED, so that we do not continually return
the same tag.
Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200724163853.504655-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/mte_helper.c | 37 ++++++++++++++++++++++++++++++-------
1 file changed, 30 insertions(+), 7 deletions(-)
diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index 5ea57d487a4..104752041f7 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -24,6 +24,8 @@
#include "exec/ram_addr.h"
#include "exec/cpu_ldst.h"
#include "exec/helper-proto.h"
+#include "qapi/error.h"
+#include "qemu/guest-random.h"
static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)
@@ -211,16 +213,37 @@ static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
uint64_t HELPER(irg)(CPUARMState *env, uint64_t rn, uint64_t rm)
{
- int rtag;
-
- /*
- * Our IMPDEF choice for GCR_EL1.RRND==1 is to behave as if
- * GCR_EL1.RRND==0, always producing deterministic results.
- */
uint16_t exclude = extract32(rm | env->cp15.gcr_el1, 0, 16);
+ int rrnd = extract32(env->cp15.gcr_el1, 16, 1);
int start = extract32(env->cp15.rgsr_el1, 0, 4);
int seed = extract32(env->cp15.rgsr_el1, 8, 16);
- int offset, i;
+ int offset, i, rtag;
+
+ /*
+ * Our IMPDEF choice for GCR_EL1.RRND==1 is to continue to use the
+ * deterministic algorithm. Except that with RRND==1 the kernel is
+ * not required to have set RGSR_EL1.SEED != 0, which is required for
+ * the deterministic algorithm to function. So we force a non-zero
+ * SEED for that case.
+ */
+ if (unlikely(seed == 0) && rrnd) {
+ do {
+ Error *err = NULL;
+ uint16_t two;
+
+ if (qemu_guest_getrandom(&two, sizeof(two), &err) < 0) {
+ /*
+ * Failed, for unknown reasons in the crypto subsystem.
+ * Best we can do is log the reason and use a constant seed.
+ */
+ qemu_log_mask(LOG_UNIMP, "IRG: Crypto failure: %s\n",
+ error_get_pretty(err));
+ error_free(err);
+ two = 1;
+ }
+ seed = two;
+ } while (seed == 0);
+ }
/* RandomTag */
for (i = offset = 0; i < 4; ++i) {
--
2.20.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PULL 0/7] target-arm queue
2020-07-27 15:19 [PULL 0/7] target-arm queue Peter Maydell
` (6 preceding siblings ...)
2020-07-27 15:19 ` [PULL 7/7] target/arm: Improve IMPDEF algorithm for IRG Peter Maydell
@ 2020-07-28 18:43 ` Peter Maydell
7 siblings, 0 replies; 9+ messages in thread
From: Peter Maydell @ 2020-07-28 18:43 UTC (permalink / raw)
To: QEMU Developers
On Mon, 27 Jul 2020 at 16:19, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> Just some bugfixes this time around.
>
> -- PMM
>
> The following changes since commit 4215d3413272ad6d1c6c9d0234450b602e46a74c:
>
> Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-5.1-20200727' into staging (2020-07-27 09:33:04 +0100)
>
> are available in the Git repository at:
>
> https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200727
>
> for you to fetch changes up to d4f6dda182e19afa75706936805e18397cb95f07:
>
> target/arm: Improve IMPDEF algorithm for IRG (2020-07-27 16:12:11 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
> * ACPI: Assert that we don't run out of the preallocated memory
> * hw/misc/aspeed_sdmc: Fix incorrect memory size
> * target/arm: Always pass cacheattr in S1_ptw_translate
> * docs/system/arm/virt: Document 'mte' machine option
> * hw/arm/boot: Fix PAUTH, MTE for EL3 direct kernel boot
> * target/arm: Improve IMPDEF algorithm for IRG
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/5.1
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 9+ messages in thread