[PULL 0/4] target-arm queue

[PULL 0/4] target-arm queue

[Peter Maydell]

The following changes since commit efcd0ec14b0fe9ee0ee70277763b2d538d19238d:

  Merge tag 'misc-fixes-20230330' of https://github.com/philmd/qemu into staging (2023-03-30 14:22:29 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230403

for you to fetch changes up to a0eaa126af3c5a43937a22c58cfb9bb36e4a5001:

  hw/ssi: Fix Linux driver init issue with xilinx_spi (2023-04-03 16:12:30 +0100)

----------------------------------------------------------------
 * target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()
 * hw/arm: do not free machine->fdt in arm_load_dtb()
 * target/arm: Fix generated code for cpreg reads when HSTR is active
 * hw/ssi: Fix Linux driver init issue with xilinx_spi

----------------------------------------------------------------
Chris Rauer (1):
      hw/ssi: Fix Linux driver init issue with xilinx_spi

Markus Armbruster (1):
      hw/arm: do not free machine->fdt in arm_load_dtb()

Peter Maydell (1):
      target/arm: Fix generated code for cpreg reads when HSTR is active

Philippe Mathieu-Daudé (1):
      target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()

 target/arm/internals.h        | 15 ++++++++++-----
 hw/arm/boot.c                 |  5 ++++-
 hw/ssi/xilinx_spi.c           |  1 +
 target/arm/gdbstub64.c        |  7 +++++--
 target/arm/tcg/pauth_helper.c | 18 +-----------------
 target/arm/tcg/translate.c    |  6 ++++++
 6 files changed, 27 insertions(+), 25 deletions(-)

[PULL 1/4] target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()

[Peter Maydell]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

aarch64_gdb_get_pauth_reg() -- although disabled since commit
5787d17a42 ("target/arm: Don't advertise aarch64-pauth.xml to
gdb") is still compiled in. It calls pauth_ptr_mask() which is
located in target/arm/tcg/pauth_helper.c, a TCG specific helper.

To avoid a linking error when TCG is not enabled:

  Undefined symbols for architecture arm64:
    "_pauth_ptr_mask", referenced from:
        _aarch64_gdb_get_pauth_reg in target_arm_gdbstub64.c.o
  ld: symbol(s) not found for architecture arm64
  clang: error: linker command failed with exit code 1 (use -v to see invocation)

- Inline pauth_ptr_mask() in aarch64_gdb_get_pauth_reg()
  (this is the single user),
- Rename pauth_ptr_mask_internal() as pauth_ptr_mask() and
  inline it in "internals.h",

Fixes: e995d5cce4 ("target/arm: Implement gdbstub pauth extension")
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230328212516.29592-1-philmd@linaro.org
[PMM: reinstated doc comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h        | 15 ++++++++++-----
 target/arm/gdbstub64.c        |  7 +++++--
 target/arm/tcg/pauth_helper.c | 18 +-----------------
 3 files changed, 16 insertions(+), 24 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 673519a24a0..c2c70d5918d 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1391,13 +1391,18 @@ bool arm_generate_debug_exceptions(CPUARMState *env);
 
 /**
  * pauth_ptr_mask:
- * @env: cpu context
- * @ptr: selects between TTBR0 and TTBR1
- * @data: selects between TBI and TBID
+ * @param: parameters defining the MMU setup
  *
- * Return a mask of the bits of @ptr that contain the authentication code.
+ * Return a mask of the address bits that contain the authentication code,
+ * given the MMU config defined by @param.
  */
-uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
+static inline uint64_t pauth_ptr_mask(ARMVAParameters param)
+{
+    int bot_pac_bit = 64 - param.tsz;
+    int top_pac_bit = 64 - 8 * param.tbi;
+
+    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
+}
 
 /* Add the cpreg definitions for debug related system registers */
 void define_debug_regs(ARMCPU *cpu);
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index ec1e07f1399..c1f7e8c934b 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -230,8 +230,11 @@ int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
         {
             bool is_data = !(reg & 1);
             bool is_high = reg & 2;
-            uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
-            return gdb_get_reg64(buf, mask);
+            ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
+            ARMVAParameters param;
+
+            param = aa64_va_parameters(env, -is_high, mmu_idx, is_data);
+            return gdb_get_reg64(buf, pauth_ptr_mask(param));
         }
     default:
         return 0;
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index 20f347332dc..de067fa7168 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -339,17 +339,9 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
     return pac | ext | ptr;
 }
 
-static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
-{
-    int bot_pac_bit = 64 - param.tsz;
-    int top_pac_bit = 64 - 8 * param.tbi;
-
-    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
-}
-
 static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
 {
-    uint64_t mask = pauth_ptr_mask_internal(param);
+    uint64_t mask = pauth_ptr_mask(param);
 
     /* Note that bit 55 is used whether or not the regime has 2 ranges. */
     if (extract64(ptr, 55, 1)) {
@@ -359,14 +351,6 @@ static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
     }
 }
 
-uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
-{
-    ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
-    ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
-
-    return pauth_ptr_mask_internal(param);
-}
-
 static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
                            ARMPACKey *key, bool data, int keynumber)
 {
-- 
2.34.1

[PULL 2/4] hw/arm: do not free machine->fdt in arm_load_dtb()

[Peter Maydell]

From: Markus Armbruster <armbru@redhat.com>

At this moment, arm_load_dtb() can free machine->fdt when
binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be
retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is
the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to
machine->fdt. And, in that case, the existing g_free(fdt) at the end of
arm_load_dtb() will make machine->fdt point to an invalid memory region.

Since monitor command 'dumpdtb' was introduced a couple of releases
ago, running it with any ARM machine that uses arm_load_dtb() will
crash QEMU.

Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead
of freeing 'fdt', assign it back to ms->fdt.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb")
Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-id: 20230328165935.1512846-1-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 50e5141116b..54f6a3e0b3c 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -689,7 +689,10 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
     qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
                                        rom_ptr_for_as(as, addr, size));
 
-    g_free(fdt);
+    if (fdt != ms->fdt) {
+        g_free(ms->fdt);
+        ms->fdt = fdt;
+    }
 
     return size;
 
-- 
2.34.1

[PULL 3/4] target/arm: Fix generated code for cpreg reads when HSTR is active

[Peter Maydell]

In commit 049edada we added some code to handle HSTR_EL2 traps, which
we did as an inline "conditionally branch over a
gen_exception_insn()".  Unfortunately this fails to take account of
the fact that gen_exception_insn() will set s->base.is_jmp to
DISAS_NORETURN.  That means that at the end of the TB we won't
generate the necessary code to handle the "branched over the trap and
continued normal execution" codepath.  The result is that the TCG
main loop thinks that we stopped execution of the TB due to a
situation that only happens when icount is enabled, and hits an
assertion. Explicitly set is_jmp back to DISAS_NEXT so we generate
the correct code for when execution continues past this insn.

Note that this only happens for cpreg reads; writes will call
gen_lookup_tb() which generates a valid end-of-TB.

Fixes: 049edada ("target/arm: Make HSTR_EL2 traps take priority over UNDEF-at-EL1")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1551
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230330101900.2320380-1-peter.maydell@linaro.org
---
 target/arm/tcg/translate.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 2cb9368b1ba..3c8401e9086 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -4623,6 +4623,12 @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
             tcg_gen_brcondi_i32(TCG_COND_EQ, t, 0, over.label);
 
             gen_exception_insn(s, 0, EXCP_UDEF, syndrome);
+            /*
+             * gen_exception_insn() will set is_jmp to DISAS_NORETURN,
+             * but since we're conditionally branching over it, we want
+             * to assume continue-to-next-instruction.
+             */
+            s->base.is_jmp = DISAS_NEXT;
             set_disas_label(s, over);
         }
     }
-- 
2.34.1

[PULL 4/4] hw/ssi: Fix Linux driver init issue with xilinx_spi

[Peter Maydell]

From: Chris Rauer <crauer@google.com>

The problem is that the Linux driver expects the master transaction inhibit
bit(R_SPICR_MTI) to be set during driver initialization so that it can
detect the fifo size but QEMU defaults it to zero out of reset.  The
datasheet indicates this bit is active on reset.

See page 25, SPI Control Register section:
https://www.xilinx.com/content/dam/xilinx/support/documents/ip_documentation/axi_quad_spi/v3_2/pg153-axi-quad-spi.pdf

Signed-off-by: Chris Rauer <crauer@google.com>
Message-id: 20230323182811.2641044-1-crauer@google.com
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index 552927622f4..d4de2e7aabc 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -156,6 +156,7 @@ static void xlx_spi_do_reset(XilinxSPI *s)
     txfifo_reset(s);
 
     s->regs[R_SPISSR] = ~0;
+    s->regs[R_SPICR] = R_SPICR_MTI;
     xlx_spi_update_irq(s);
     xlx_spi_update_cs(s);
 }
-- 
2.34.1

Re: [PULL 0/4] target-arm queue

[Peter Maydell]

On Mon, 3 Apr 2023 at 17:01, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The following changes since commit efcd0ec14b0fe9ee0ee70277763b2d538d19238d:
>
>   Merge tag 'misc-fixes-20230330' of https://github.com/philmd/qemu into staging (2023-03-30 14:22:29 +0100)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230403
>
> for you to fetch changes up to a0eaa126af3c5a43937a22c58cfb9bb36e4a5001:
>
>   hw/ssi: Fix Linux driver init issue with xilinx_spi (2023-04-03 16:12:30 +0100)
>
> ----------------------------------------------------------------
>  * target/arm: Fix non-TCG build failure by inlining pauth_ptr_mask()
>  * hw/arm: do not free machine->fdt in arm_load_dtb()
>  * target/arm: Fix generated code for cpreg reads when HSTR is active
>  * hw/ssi: Fix Linux driver init issue with xilinx_spi
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.0
for any user-visible changes.

-- PMM

Re: [PULL 0/4] target-arm queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 115 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/8.2 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PULL 0/4] target-arm queue

[Peter Maydell]

Hi; here are a handful of small bug fixes for Arm guests for rc0.

thanks
-- PMM

The following changes since commit 69680740eafa1838527c90155a7432d51b8ff203:

  Merge tag 'qdev-array-prop' of https://repo.or.cz/qemu/kevin into staging (2023-11-11 11:23:25 +0800)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20231113

for you to fetch changes up to f6e8d1ef05a126de796ae03dd81e048e3ff48ff1:

  target/arm/tcg: enable PMU feature for Cortex-A8 and A9 (2023-11-13 16:31:41 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: fix GIC maintenance IRQ registration
 * target/arm: HVC at EL3 should go to EL3, not EL2
 * target/arm: Correct MTE tag checking for reverse-copy MOPS
 * target/arm/tcg: enable PMU feature for Cortex-A8 and A9

----------------------------------------------------------------
Jean-Philippe Brucker (1):
      hw/arm/virt: fix GIC maintenance IRQ registration

Nikita Ostrenkov (1):
      target/arm/tcg: enable PMU feature for Cortex-A8 and A9

Peter Maydell (2):
      target/arm: HVC at EL3 should go to EL3, not EL2
      target/arm: Correct MTE tag checking for reverse-copy MOPS

 hw/arm/virt.c                  |  6 ++++--
 target/arm/tcg/cpu32.c         |  2 ++
 target/arm/tcg/mte_helper.c    | 12 ++++++++++--
 target/arm/tcg/translate-a64.c |  4 +++-
 4 files changed, 19 insertions(+), 5 deletions(-)

Re: [PULL 0/4] target-arm queue

[Richard Henderson]

On 11/15/21 9:19 PM, Peter Maydell wrote:
> Hi; some minor changes for 6.2, which I think can be classified
> as bug fixes and are OK for this point in the release cycle.
> (Wouldn't be the end of the world if they slipped to 7.0.)
> 
> -- PMM
> 
> The following changes since commit 42f6c9179be4401974dd3a75ee72defd16b5092d:
> 
>    Merge tag 'pull-ppc-20211112' of https://github.com/legoater/qemu into staging (2021-11-12 12:28:25 +0100)
> 
> are available in the Git repository at:
> 
>    https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211115-1
> 
> for you to fetch changes up to 1adf528ec3bdf62ea3b580b7ad562534a3676ff5:
> 
>    hw/rtc/pl031: Send RTC_CHANGE QMP event (2021-11-15 18:53:00 +0000)
> 
> ----------------------------------------------------------------
> target-arm queue:
>   * Support multiple redistributor regions for TCG GICv3
>   * Send RTC_CHANGE QMP event from pl031
> 
> ----------------------------------------------------------------
> Eric Auger (1):
>        hw/rtc/pl031: Send RTC_CHANGE QMP event
> 
> Peter Maydell (3):
>        hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize
>        hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1
>        hw/intc/arm_gicv3: Support multiple redistributor regions
> 
>   include/hw/intc/arm_gicv3_common.h | 14 ++++++++--
>   hw/intc/arm_gicv3.c                | 12 +-------
>   hw/intc/arm_gicv3_common.c         | 56 ++++++++++++++++++++++++--------------
>   hw/intc/arm_gicv3_kvm.c            | 10 ++-----
>   hw/intc/arm_gicv3_redist.c         | 40 +++++++++++++++------------
>   hw/rtc/pl031.c                     | 10 ++++++-
>   hw/rtc/meson.build                 |  2 +-
>   7 files changed, 83 insertions(+), 61 deletions(-)

Applied, thanks.


r~

[PULL 0/4] target-arm queue

[Peter Maydell]

Hi; some minor changes for 6.2, which I think can be classified
as bug fixes and are OK for this point in the release cycle.
(Wouldn't be the end of the world if they slipped to 7.0.)

-- PMM

The following changes since commit 42f6c9179be4401974dd3a75ee72defd16b5092d:

  Merge tag 'pull-ppc-20211112' of https://github.com/legoater/qemu into staging (2021-11-12 12:28:25 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211115-1

for you to fetch changes up to 1adf528ec3bdf62ea3b580b7ad562534a3676ff5:

  hw/rtc/pl031: Send RTC_CHANGE QMP event (2021-11-15 18:53:00 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support multiple redistributor regions for TCG GICv3
 * Send RTC_CHANGE QMP event from pl031

----------------------------------------------------------------
Eric Auger (1):
      hw/rtc/pl031: Send RTC_CHANGE QMP event

Peter Maydell (3):
      hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize
      hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1
      hw/intc/arm_gicv3: Support multiple redistributor regions

 include/hw/intc/arm_gicv3_common.h | 14 ++++++++--
 hw/intc/arm_gicv3.c                | 12 +-------
 hw/intc/arm_gicv3_common.c         | 56 ++++++++++++++++++++++++--------------
 hw/intc/arm_gicv3_kvm.c            | 10 ++-----
 hw/intc/arm_gicv3_redist.c         | 40 +++++++++++++++------------
 hw/rtc/pl031.c                     | 10 ++++++-
 hw/rtc/meson.build                 |  2 +-
 7 files changed, 83 insertions(+), 61 deletions(-)

Re: [PULL 0/4] target-arm queue

[Peter Maydell]

On Tue, 26 Nov 2019 at 14:12, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> Arm patches for rc3 : just a handful of bug fixes.
>
> thanks
> -- PMM
>
>
> The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
>
>   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
>
> for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
>
>   target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * handle FTYPE flag correctly in v7M exception return
>    for v7M CPUs with an FPU (v8M CPUs were already correct)
>  * versal: Add the CRP as unimplemented
>  * Fix ISR_EL1 tracking when executing at EL2
>  * Honor HCR_EL2.TID3 trapping requirements
>

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.2
for any user-visible changes.

-- PMM

[PULL 0/4] target-arm queue

[Peter Maydell]

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM


The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

  Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

 include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)