Series comparison

 [Qemu-devel] [PULL 0/7] target-arm queue
-ARM queue for 2.10: all M profile bugfixes...
+A small set of arm bugfixes for rc0.
-thanks
--- PMM
-The following changes since commit 25dd0e77898c3e10796d4cbeb35e8af5ba6ce975:
-  Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging (2017-07-31 11:27:43 +0100)
+The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:
   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)
 are available in the git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170731
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107
-for you to fetch changes up to 89cbc3778a3d61761e2231e740269218c9a8a41d:
+for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:
-  hw/mps2_scc: fix incorrect properties (2017-07-31 13:11:56 +0100)
+  hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * fix broken properties on MPS2 SCC device
+ * arm_gicv3_its: Don't abort on table save failure
- * fix MPU trace handling of write vs exec
+ * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
- * fix MPU M profile bugs:
+ * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
-   - not handling system space or PPB region correctly
+ * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
-   - not resetting state
+ * arm: implement cache/shareability attribute bits for PAR registers
    - not migrating MPU_RNR
 ----------------------------------------------------------------
-Peter Maydell (6):
+Andrew Baumann (1):
-      target/arm: Correct MPU trace handling of write vs execute
+      arm: implement cache/shareability attribute bits for PAR registers
       target/arm: Don't do MPU lookups for addresses in M profile PPB region
       target/arm: Don't allow guest to make System space executable for M profile
       target/arm: Rename cp15.c6_rgnr to pmsav7.rnr
       target/arm: Move PMSAv7 reset into arm_cpu_reset() so M profile MPUs get reset
       target/arm: Migrate MPU_RNR register state for M profile cores
-Philippe Mathieu-Daudé (1):
+Eric Auger (1):
-      hw/mps2_scc: fix incorrect properties
+      hw/intc/arm_gicv3_its: Don't abort on table save failure
- target/arm/cpu.h      |  3 +--
+Peter Maydell (1):
- hw/intc/armv7m_nvic.c | 14 +++++-----
+      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
  hw/misc/mps2-scc.c    |  4 +--
  target/arm/cpu.c      | 14 ++++++++++
  target/arm/helper.c   | 71 ++++++++++++++++++++++++++++++++++-----------------
  target/arm/machine.c  | 30 +++++++++++++++++++++-
 files changed, 101 insertions(+), 35 deletions(-)
+Shanker Donthineni (1):
+      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+Thomas Huth (3):
+      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
+      hw/arm: Mark the "fsl,imx25" device with user_creatable = false
+      hw/arm: Mark the "fsl,imx31" device with user_creatable = false
+ hw/arm/fsl-imx25.c          |   6 +-
+ hw/arm/fsl-imx31.c          |   6 +-
+ hw/arm/fsl-imx6.c           |   3 +-
+ hw/intc/arm_gicv3_its_kvm.c |  12 +--
+ target/arm/helper.c         | 178 ++++++++++++++++++++++++++++++++++++++++----
+ target/arm/translate.c      |  39 ++++++++--
+files changed, 214 insertions(+), 30 deletions(-)

-[Qemu-devel] [PULL 3/7] target/arm: Don't allow guest to make System space executable for M profile
+[Qemu-devel] [PULL 1/7] arm: implement cache/shareability attribute bits for PAR registers
-For an M profile v7PMSA, the system space (0xe0000000 - 0xffffffff) can
+From: Andrew Baumann <Andrew.Baumann@microsoft.com>
-never be executable, even if the guest tries to set the MPU registers
-up that way. Enforce this restriction.
+On a successful address translation instruction, PAR is supposed to
+contain cacheability and shareability attributes determined by the
 translation. We previously returned 0 for these bits (in line with the
 general strategy of ignoring caches and memory attributes), but some
 guest OSes may depend on them.
 This patch collects the attribute bits in the page-table walk, and
 updates PAR with the correct attributes for all LPAE translations.
 Short descriptor formats still return 0 for these bits, as in the
 prior implementation.
 Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1501153150-19984-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 16 +++++++++++++++-
+ target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
-file changed, 15 insertions(+), 1 deletion(-)
+file changed, 164 insertions(+), 14 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
+@@ -XXX,XX +XXX,XX @@
-         extract32(address, 20, 12) == 0xe00;
+ #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
  #ifndef CONFIG_USER_ONLY
 +/* Cacheability and shareability attributes for a memory access */
 +typedef struct ARMCacheAttrs {
 +    unsigned int attrs:8; /* as in the MAIR register encoding */
 +    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
 +} ARMCacheAttrs;
 +
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi);
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
 -                               ARMMMUFaultInfo *fi);
 +                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  /* Security attributes for an address, as returned by v8m_security_lookup. */
  typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
      uint64_t par64;
      MemTxAttrs attrs = {};
      ARMMMUFaultInfo fi = {};
 +    ARMCacheAttrs cacheattrs = {};
 -    ret = get_phys_addr(env, value, access_type, mmu_idx,
 -                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
 +    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
 +                        &prot, &page_size, &fsr, &fi, &cacheattrs);
      if (extended_addresses_enabled(env)) {
          /* fsr is a DFSR/IFSR value for the long descriptor
           * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
              if (!attrs.secure) {
                  par64 |= (1 << 9); /* NS */
              }
 -            /* We don't set the ATTR or SH fields in the PAR. */
 +            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
 +            par64 |= cacheattrs.shareability << 7; /* SH */
          } else {
              par64 |= 1; /* F */
              par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
          return false;
      }
      if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
 -                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
 +                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
          /* the MPU lookup failed */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          int ret;
          ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
 -                                 &txattrs, &s2prot, &s2size, fsr, fi);
 +                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
          if (ret) {
              fi->s2addr = addr;
              fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
      return true;
  }
-+static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
++/* Translate from the 4-bit stage 2 representation of
 + * memory attributes (without cache-allocation hints) to
 + * the 8-bit representation of the stage 1 MAIR registers
 + * (which includes allocation hints).
 + *
 + * ref: shared/translation/attrs/S2AttrDecode()
 + *      .../S2ConvertAttrsHints()
 + */
 +static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
 +{
-+    /* True if address is in the M profile system region
++    uint8_t hiattr = extract32(s2attrs, 2, 2);
-+     * 0xe0000000 - 0xffffffff
++    uint8_t loattr = extract32(s2attrs, 0, 2);
-+     */
++    uint8_t hihint = 0, lohint = 0;
-+    return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
++
 +    if (hiattr != 0) { /* normal memory */
 +        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
 +            hiattr = loattr = 1; /* non-cacheable */
 +        } else {
 +            if (hiattr != 1) { /* Write-through or write-back */
 +                hihint = 3; /* RW allocate */
 +            }
 +            if (loattr != 1) { /* Write-through or write-back */
 +                lohint = 3; /* RW allocate */
 +            }
 +        }
 +    }
 +
 +    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
 +}
 +
- static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
-                                  int access_type, ARMMMUIdx mmu_idx,
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
+                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+                                target_ulong *page_size_ptr, uint32_t *fsr,
-             get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
+-                               ARMMMUFaultInfo *fi)
-         } else { /* a MPU hit! */
++                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
-             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
+ {
-+            uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
+     ARMCPU *cpu = arm_env_get_cpu(env);
-+
+     CPUState *cs = CPU(cpu);
-+            if (m_is_system_region(env, address)) {
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
-+                /* System space is always execute never */
+          */
-+                xn = 1;
+         txattrs->secure = false;
      }
 +
 +    if (cacheattrs != NULL) {
 +        if (mmu_idx == ARMMMUIdx_S2NS) {
 +            cacheattrs->attrs = convert_stage2_attrs(env,
 +                                                     extract32(attrs, 0, 4));
 +        } else {
 +            /* Index into MAIR registers for cache attributes */
 +            uint8_t attrindx = extract32(attrs, 0, 3);
 +            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
 +            assert(attrindx <= 7);
 +            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
 +        }
 +        cacheattrs->shareability = extract32(attrs, 6, 2);
 +    }
 +
      *phys_ptr = descaddr;
      *page_size_ptr = page_size;
      return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
      return false;
  }
 +/* Combine either inner or outer cacheability attributes for normal
 + * memory, according to table D4-42 and pseudocode procedure
 + * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
 + *
 + * NB: only stage 1 includes allocation hints (RW bits), leading to
 + * some asymmetry.
 + */
 +static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
 +{
 +    if (s1 == 4 || s2 == 4) {
 +        /* non-cacheable has precedence */
 +        return 4;
 +    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
 +        /* stage 1 write-through takes precedence */
 +        return s1;
 +    } else if (extract32(s2, 2, 2) == 2) {
 +        /* stage 2 write-through takes precedence, but the allocation hint
 +         * is still taken from stage 1
 +         */
 +        return (2 << 2) | extract32(s1, 0, 2);
 +    } else { /* write-back */
 +        return s1;
 +    }
 +}
 +
 +/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
 + * and CombineS1S2Desc()
 + *
 + * @s1:      Attributes from stage 1 walk
 + * @s2:      Attributes from stage 2 walk
 + */
 +static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
 +{
 +    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
 +    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
 +    ARMCacheAttrs ret;
 +
 +    /* Combine shareability attributes (table D4-43) */
 +    if (s1.shareability == 2 || s2.shareability == 2) {
 +        /* if either are outer-shareable, the result is outer-shareable */
 +        ret.shareability = 2;
 +    } else if (s1.shareability == 3 || s2.shareability == 3) {
 +        /* if either are inner-shareable, the result is inner-shareable */
 +        ret.shareability = 3;
 +    } else {
 +        /* both non-shareable */
 +        ret.shareability = 0;
 +    }
 +
 +    /* Combine memory type and cacheability attributes */
 +    if (s1hi == 0 || s2hi == 0) {
 +        /* Device has precedence over normal */
 +        if (s1lo == 0 || s2lo == 0) {
 +            /* nGnRnE has precedence over anything */
 +            ret.attrs = 0;
 +        } else if (s1lo == 4 || s2lo == 4) {
 +            /* non-Reordering has precedence over Reordering */
 +            ret.attrs = 4;  /* nGnRE */
 +        } else if (s1lo == 8 || s2lo == 8) {
 +            /* non-Gathering has precedence over Gathering */
 +            ret.attrs = 8;  /* nGRE */
 +        } else {
 +            ret.attrs = 0xc; /* GRE */
 +        }
 +
 +        /* Any location for which the resultant memory type is any
 +         * type of Device memory is always treated as Outer Shareable.
 +         */
 +        ret.shareability = 2;
 +    } else { /* Normal memory */
 +        /* Outer/inner cacheability combine independently */
 +        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
 +                  | combine_cacheattr_nibble(s1lo, s2lo);
 +
 +        if (ret.attrs == 0x44) {
 +            /* Any location for which the resultant memory type is Normal
 +             * Inner Non-cacheable, Outer Non-cacheable is always treated
 +             * as Outer Shareable.
 +             */
 +            ret.shareability = 2;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
 +
  /* get_phys_addr - get the physical address for this virtual address
   *
   * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
   * @prot: set to the permissions for the page containing phys_ptr
   * @page_size: set to the size of the page containing phys_ptr
   * @fsr: set to the DFSR/IFSR value on failure
 + * @fi: set to fault info if the translation fails
 + * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
   */
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi)
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
  {
      if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
          /* Call ourselves recursively to do the stage 1 and then stage 2
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
              hwaddr ipa;
              int s2_prot;
              int ret;
 +            ARMCacheAttrs cacheattrs2 = {};
              ret = get_phys_addr(env, address, access_type,
                                  stage_1_mmu_idx(mmu_idx), &ipa, attrs,
 -                                prot, page_size, fsr, fi);
 +                                prot, page_size, fsr, fi, cacheattrs);
              /* If S1 fails or S2 is disabled, return early.  */
              if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
              /* S1 is done. Now do S2 translation.  */
              ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
                                       phys_ptr, attrs, &s2_prot,
 -                                     page_size, fsr, fi);
 +                                     page_size, fsr, fi,
 +                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
              fi->s2addr = ipa;
              /* Combine the S1 and S2 perms.  */
              *prot &= s2_prot;
 +
 +            /* Combine the S1 and S2 cache attributes, if needed */
 +            if (!ret && cacheattrs != NULL) {
 +                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
 +            }
++
-             if (is_user) { /* User mode AP bit decoding */
+             return ret;
-                 switch (ap) {
+         } else {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+             /*
-             }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
-             /* execute never */
+     if (regime_using_lpae_format(env, mmu_idx)) {
--            if (env->pmsav7.dracr[n] & (1 << 12)) {
+         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
-+            if (xn) {
+-                                  attrs, prot, page_size, fsr, fi);
-                 *prot &= ~PAGE_EXEC;
++                                  attrs, prot, page_size, fsr, fi, cacheattrs);
-             }
+     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
-         }
+         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
                                  attrs, prot, page_size, fsr, fi);
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
      ret = get_phys_addr(env, address, access_type,
                          core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
 -                        &attrs, &prot, &page_size, fsr, fi);
 +                        &attrs, &prot, &page_size, fsr, fi, NULL);
      if (!ret) {
          /* Map a single [sub]page.  */
          phys_addr &= TARGET_PAGE_MASK;
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
      *attrs = (MemTxAttrs) {};
      ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
 -                        attrs, &prot, &page_size, &fsr, &fi);
 +                        attrs, &prot, &page_size, &fsr, &fi, NULL);
      if (ret) {
          return -1;
 --
 .7.4

-[Qemu-devel] [PULL 7/7] hw/mps2_scc: fix incorrect properties
+[Qemu-devel] [PULL 2/7] hw/arm: Mark the "fsl, imx6" device with user_creatable = false
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+This device causes QEMU to abort if the user tries to instantiate it:
-Message-id: 20170729234930.725-1-f4bug@amsat.org
 $ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
 Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
 qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
 Aborted (core dumped)
 The device uses serial_hds[] directly in its realize function, so it
 can not be instantiated again by the user.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/mps2-scc.c | 4 ++--
+ hw/arm/fsl-imx6.c | 3 ++-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/mps2-scc.c
+--- a/hw/arm/fsl-imx6.c
-+++ b/hw/misc/mps2-scc.c
++++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
-     /* Values for various read-only ID registers (which are specific
+     DeviceClass *dc = DEVICE_CLASS(oc);
-      * to the board model or FPGA image)
-      */
+     dc->realize = fsl_imx6_realize;
--    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, aid, 0),
+-
-+    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
+     dc->desc = "i.MX6 SOC";
-     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
++    /* Reason: Uses serial_hds[] in the realize() function */
--    DEFINE_PROP_UINT32("scc-id", MPS2SCC, aid, 0),
++    dc->user_creatable = false;
-+    DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
+ }
-     /* These are the initial settings for the source clocks on the board.
-      * In hardware they can be configured via a config file read by the
+ static const TypeInfo fsl_imx6_type_info = {
       * motherboard configuration controller to suit the FPGA image.
 --
 .7.4

-[Qemu-devel] [PULL 6/7] target/arm: Migrate MPU_RNR register state for M profile cores
+[Qemu-devel] [PULL 3/7] hw/arm: Mark the "fsl, imx25" device with user_creatable = false
-The PMSAv7 region number register is migrated for R profile
+From: Thomas Huth <thuth@redhat.com>
 cores using the cpreg scheme, but M profile doesn't use
 cpregs, and so we weren't migrating the MPU_RNR register state
 at all. Fix that by adding a migration subsection for the
 M profile case.
+QEMU currently crashes when the user tries to instantiate the fsl,imx25
+device manually:
+$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
+**
+ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
+ assertion failed: (n < max_cpus)
+The imx25-pdk board (which is the one that uses this CPU type) only
+supports one CPU, and the realize function of the "fsl,imx25" device
+also uses serial_hds[] directly, so this device clearly can not be
+instantiated twice and thus we should mark it with user_creatable = 0.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1501153150-19984-6-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/machine.c | 28 ++++++++++++++++++++++++++++
+ hw/arm/fsl-imx25.c | 6 +++++-
-file changed, 28 insertions(+)
+file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/hw/arm/fsl-imx25.c
-+++ b/target/arm/machine.c
++++ b/hw/arm/fsl-imx25.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmsav7 = {
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
-     }
+     DeviceClass *dc = DEVICE_CLASS(oc);
- };
+     dc->realize = fsl_imx25_realize;
-+static bool pmsav7_rnr_needed(void *opaque)
+-
-+{
+     dc->desc = "i.MX25 SOC";
-+    ARMCPU *cpu = opaque;
++    /*
-+    CPUARMState *env = &cpu->env;
++     * Reason: uses serial_hds in realize and the imx25 board does not
-+
++     * support multiple CPUs
 +    /* For R profile cores pmsav7.rnr is migrated via the cpreg
 +     * "RGNR" definition in helper.h. For M profile we have to
 +     * migrate it separately.
 +     */
-+    return arm_feature(env, ARM_FEATURE_M);
++    dc->user_creatable = false;
-+}
+ }
-+
-+static const VMStateDescription vmstate_pmsav7_rnr = {
+ static const TypeInfo fsl_imx25_type_info = {
 +    .name = "cpu/pmsav7-rnr",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = pmsav7_rnr_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(env.pmsav7.rnr, ARMCPU),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static int get_cpsr(QEMUFile *f, void *opaque, size_t size,
                      VMStateField *field)
  {
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
          &vmstate_iwmmxt,
          &vmstate_m,
          &vmstate_thumb2ee,
 +        /* pmsav7_rnr must come before pmsav7 so that we have the
 +         * region number before we test it in the VMSTATE_VALIDATE
 +         * in vmstate_pmsav7.
 +         */
 +        &vmstate_pmsav7_rnr,
          &vmstate_pmsav7,
          NULL
      }
 --
 .7.4

-[Qemu-devel] [PULL 2/7] target/arm: Don't do MPU lookups for addresses in M profile PPB region
+[Qemu-devel] [PULL 4/7] hw/arm: Mark the "fsl, imx31" device with user_creatable = false
-The M profile PMSAv7 specification says that if the address being looked
+From: Thomas Huth <thuth@redhat.com>
 up is in the PPB region (0xe0000000 - 0xe00fffff) then we do not use
 the MPU regions but always use the default memory map. Implement this
 (we were previously behaving like an R profile PMSAv7, which does not
 special case this).
+QEMU currently crashes when the user tries to instantiate the fsl,imx31
+device manually:
+$ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
+**
+ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
+ assertion failed: (n < max_cpus)
+Aborted (core dumped)
+The kzm board (which is the one that uses this CPU type) only supports
+one CPU, and the realize function of the "fsl,imx31" device also uses
+serial_hds[] directly, so this device clearly can not be instantiated
+twice and thus we should mark it with user_creatable = false.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1501153150-19984-2-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 17 ++++++++++++++++-
+ hw/arm/fsl-imx31.c | 6 +++++-
-file changed, 16 insertions(+), 1 deletion(-)
+file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/fsl-imx31.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/fsl-imx31.c
-@@ -XXX,XX +XXX,XX @@ static bool pmsav7_use_background_region(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
-     }
+     DeviceClass *dc = DEVICE_CLASS(oc);
      dc->realize = fsl_imx31_realize;
 -
      dc->desc = "i.MX31 SOC";
 +    /*
 +     * Reason: uses serial_hds in realize and the kzm board does not
 +     * support multiple CPUs
 +     */
 +    dc->user_creatable = false;
  }
-+static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
+ static const TypeInfo fsl_imx31_type_info = {
 +{
 +    /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
 +    return arm_feature(env, ARM_FEATURE_M) &&
 +        extract32(address, 20, 12) == 0xe00;
 +}
 +
  static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                                   int access_type, ARMMMUIdx mmu_idx,
                                   hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
      *phys_ptr = address;
      *prot = 0;
 -    if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
 +    if (regime_translation_disabled(env, mmu_idx) ||
 +        m_is_ppb_region(env, address)) {
 +        /* MPU disabled or M profile PPB access: use default memory map.
 +         * The other case which uses the default memory map in the
 +         * v7M ARM ARM pseudocode is exception vector reads from the vector
 +         * table. In QEMU those accesses are done in arm_v7m_load_vector(),
 +         * which always does a direct read using address_space_ldl(), rather
 +         * than going via this function, so we don't need to check that here.
 +         */
          get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
      } else { /* MPU enabled */
          for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
 --
 .7.4

-[Qemu-devel] [PULL 5/7] target/arm: Move PMSAv7 reset into arm_cpu_reset() so M profile MPUs get reset
+[Qemu-devel] [PULL 5/7] translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
-When the PMSAv7 implementation was originally added it was for R profile
+For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
-CPUs only, and reset was handled using the cpreg .resetfn hooks.
+lowest address is always Rt and the one at addr+4 is Rt2, even if the
-Unfortunately for M profile cores this doesn't work, because they do
+CPU is big-endian. Our implementation does these with a single
-not register any cpregs. Move the reset handling into arm_cpu_reset(),
+-bit store, so if we're big-endian then we need to put the two
-where it will work for both R profile and M profile cores.
+-bit halves together in the opposite order to little-endian,
 so that they end up in the right places. We were trying to do
 this with the gen_aa32_frob64() function, but that is not correct
 for the usermode emulator, because there there is a distinction
 between "load a 64 bit value" (which does a BE 64-bit access
 and doesn't need swapping) and "load two 32 bit values as one
 bit access" (where we still need to do the swapping, like
 system mode BE32).
+Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
+Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1501153150-19984-5-git-send-email-peter.maydell@linaro.org
+Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.c    | 14 ++++++++++++++
+ target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
- target/arm/helper.c | 28 ++++++++++++----------------
+file changed, 34 insertions(+), 5 deletions(-)
 files changed, 26 insertions(+), 16 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/translate.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+         TCGv_i32 tmp2 = tcg_temp_new_i32();
-     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
+         TCGv_i64 t64 = tcg_temp_new_i64();
- #endif
 -        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
 +        /* For AArch32, architecturally the 32-bit word at the lowest
 +         * address is always Rt and the one at addr+4 is Rt2, even if
 +         * the CPU is big-endian. That means we don't want to do a
 +         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
 +         * for an architecturally 64-bit access, but instead do a
 +         * 64-bit access using MO_BE if appropriate and then split
 +         * the two halves.
 +         * This only makes a difference for BE32 user-mode, where
 +         * frob64() must not flip the two halves of the 64-bit data
 +         * but this code must treat BE32 user-mode like BE32 system.
 +         */
 +        TCGv taddr = gen_aa32_addr(s, addr, opc);
 +
-+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
++        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
-+        arm_feature(env, ARM_FEATURE_V7)) {
++        tcg_temp_free(taddr);
-+        if (cpu->pmsav7_dregion > 0) {
+         tcg_gen_mov_i64(cpu_exclusive_val, t64);
-+            memset(env->pmsav7.drbar, 0,
+-        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
-+                   sizeof(*env->pmsav7.drbar) * cpu->pmsav7_dregion);
++        if (s->be_data == MO_BE) {
-+            memset(env->pmsav7.drsr, 0,
++            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
-+                   sizeof(*env->pmsav7.drsr) * cpu->pmsav7_dregion);
++        } else {
-+            memset(env->pmsav7.dracr, 0,
++            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
 +                   sizeof(*env->pmsav7.dracr) * cpu->pmsav7_dregion);
 +        }
-+        env->pmsav7.rnr = 0;
+         tcg_temp_free_i64(t64);
-+    }
-+
+         store_reg(s, rt2, tmp2);
-     set_flush_to_zero(1, &env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
+         TCGv_i64 n64 = tcg_temp_new_i64();
-     set_default_nan_mode(1, &env->vfp.standard_fp_status);
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+         t2 = load_reg(s, rt2);
-index XXXXXXX..XXXXXXX 100644
+-        tcg_gen_concat_i32_i64(n64, t1, t2);
---- a/target/arm/helper.c
++        /* For AArch32, architecturally the 32-bit word at the lowest
-+++ b/target/arm/helper.c
++         * address is always Rt and the one at addr+4 is Rt2, even if
-@@ -XXX,XX +XXX,XX @@ static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
++         * the CPU is big-endian. Since we're going to treat this as a
-     *u32p = value;
++         * single 64-bit BE store, we need to put the two halves in the
- }
++         * opposite order for BE to LE, so that they end up in the right
++         * places.
--static void pmsav7_reset(CPUARMState *env, const ARMCPRegInfo *ri)
++         * We don't want gen_aa32_frob64() because that does the wrong
--{
++         * thing for BE32 usermode.
--    ARMCPU *cpu = arm_env_get_cpu(env);
++         */
--    uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
++        if (s->be_data == MO_BE) {
--
++            tcg_gen_concat_i32_i64(n64, t2, t1);
--    if (!u32p) {
++        } else {
--        return;
++            tcg_gen_concat_i32_i64(n64, t1, t2);
--    }
++        }
--
+         tcg_temp_free_i32(t2);
--    memset(u32p, 0, sizeof(*u32p) * cpu->pmsav7_dregion);
+-        gen_aa32_frob64(s, n64);
--}
--
+         tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
- static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                    get_mem_index(s), opc);
-                               uint64_t value)
+         tcg_temp_free_i64(n64);
- {
-@@ -XXX,XX +XXX,XX @@ static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+-        gen_aa32_frob64(s, o64);
- }
+         tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
+         tcg_gen_extrl_i64_i32(t0, o64);
  static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
 +    /* Reset for all these registers is handled in arm_cpu_reset(),
 +     * because the PMSAv7 is also used by M-profile CPUs, which do
 +     * not register cpregs but still need the state to be reset.
 +     */
      { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
        .access = PL1_RW, .type = ARM_CP_NO_RAW,
        .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
 -      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
 +      .readfn = pmsav7_read, .writefn = pmsav7_write,
 +      .resetfn = arm_cp_reset_ignore },
      { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
        .access = PL1_RW, .type = ARM_CP_NO_RAW,
        .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
 -      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
 +      .readfn = pmsav7_read, .writefn = pmsav7_write,
 +      .resetfn = arm_cp_reset_ignore },
      { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
        .access = PL1_RW, .type = ARM_CP_NO_RAW,
        .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
 -      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
 +      .readfn = pmsav7_read, .writefn = pmsav7_write,
 +      .resetfn = arm_cp_reset_ignore },
      { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
        .access = PL1_RW,
        .fieldoffset = offsetof(CPUARMState, pmsav7.rnr),
 -      .writefn = pmsav7_rgnr_write },
 +      .writefn = pmsav7_rgnr_write,
 +      .resetfn = arm_cp_reset_ignore },
      REGINFO_SENTINEL
  };
 --
 .7.4

-[Qemu-devel] [PULL 1/7] target/arm: Correct MPU trace handling of write vs execute
+[Qemu-devel] [PULL 6/7] hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
-Correct off-by-one bug in the PSMAv7 MPU tracing where it would print
+From: Shanker Donthineni <shankerd@codeaurora.org>
 a write access as "reading", an insn fetch as "writing", and a read
 access as "execute".
-Since we have an MMUAccessType enum now, we can make the code clearer
+The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
-in the process by using that rather than the raw 0/1/2 values.
+/restore") breaks the backward compatibility with the older kernels
 where vITS save/restore support is not available. The vmstate function
 vm_change_state_handler() should not be registered if the running kernel
 doesn't support ITS save/restore feature. Otherwise VM instance will be
 killed whenever vmstate callback function is invoked.
+Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
+the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.
+KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'
+Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <rth@twiddle.net>
-Message-id: 1500906792-18010-1-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 4 ++--
+ hw/intc/arm_gicv3_its_kvm.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/intc/arm_gicv3_its_kvm.c
-+++ b/target/arm/helper.c
++++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-                                    phys_ptr, prot, fsr);
+             error_free(s->migration_blocker);
-         qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
+             return;
-                       " mmu_idx %u -> %s (prot %c%c%c)\n",
+         }
--                      access_type == 1 ? "reading" :
++    } else {
--                      (access_type == 2 ? "writing" : "execute"),
++        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
-+                      access_type == MMU_DATA_LOAD ? "reading" :
+     }
-+                      (access_type == MMU_DATA_STORE ? "writing" : "execute"),
-                       (uint32_t)address, mmu_idx,
+     kvm_msi_use_devid = true;
-                       ret ? "Miss" : "Hit",
+     kvm_gsi_direct_mapping = false;
-                       *prot & PAGE_READ ? 'r' : '-',
+     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 -
 -    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
  }
  /**
 --
 .7.4

-[Qemu-devel] [PULL 4/7] target/arm: Rename cp15.c6_rgnr to pmsav7.rnr
+[Qemu-devel] [PULL 7/7] hw/intc/arm_gicv3_its: Don't abort on table save failure
-Almost all of the PMSAv7 state is in the pmsav7 substruct of
+From: Eric Auger <eric.auger@redhat.com>
 the ARM CPU state structure. The exception is the region
 number register, which is in cp15.c6_rgnr. This exception
 is a bit odd for M profile, which otherwise generally does
 not store state in the cp15 substruct.
-Rename cp15.c6_rgnr to pmsav7.rnr accordingly.
+The ITS is not fully properly reset at the moment. Caches are
 not emptied.
+After a reset, in case we attempt to save the state before
+the bound devices have registered their MSIs and after the
+st level table has been allocated by the ITS driver
+(device BASER is valid), the first level entries are still
+invalid. If the device cache is not empty (devices registered
+before the reset), vgic_its_save_device_tables fails with -EINVAL.
+This causes a QEMU abort().
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1501153150-19984-4-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  3 +--
+ hw/intc/arm_gicv3_its_kvm.c | 8 ++------
- hw/intc/armv7m_nvic.c | 14 +++++++-------
+file changed, 2 insertions(+), 6 deletions(-)
  target/arm/helper.c   |  6 +++---
  target/arm/machine.c  |  2 +-
 files changed, 12 insertions(+), 13 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/arm_gicv3_its_kvm.c
-+++ b/target/arm/cpu.h
++++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
-             uint64_t par_el[4];
+ {
-         };
+     GICv3ITSState *s = (GICv3ITSState *)opaque;
+     Error *err = NULL;
--        uint32_t c6_rgnr;
+-    int ret;
--
-         uint32_t c9_insn; /* Cache lockdown registers.  */
+     if (running) {
          uint32_t c9_data;
          uint64_t c9_pmcr; /* performance monitor control register */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          uint32_t *drbar;
          uint32_t *drsr;
          uint32_t *dracr;
 +        uint32_t rnr;
      } pmsav7;
      void *nvic;
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
      case 0xd94: /* MPU_CTRL */
          return cpu->env.v7m.mpu_ctrl;
      case 0xd98: /* MPU_RNR */
 -        return cpu->env.cp15.c6_rgnr;
 +        return cpu->env.pmsav7.rnr;
      case 0xd9c: /* MPU_RBAR */
      case 0xda4: /* MPU_RBAR_A1 */
      case 0xdac: /* MPU_RBAR_A2 */
      case 0xdb4: /* MPU_RBAR_A3 */
      {
 -        int region = cpu->env.cp15.c6_rgnr;
 +        int region = cpu->env.pmsav7.rnr;
          if (region >= cpu->pmsav7_dregion) {
              return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
      case 0xdb0: /* MPU_RASR_A2 */
      case 0xdb8: /* MPU_RASR_A3 */
      {
 -        int region = cpu->env.cp15.c6_rgnr;
 +        int region = cpu->env.pmsav7.rnr;
          if (region >= cpu->pmsav7_dregion) {
              return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                            PRIu32 "/%" PRIu32 "\n",
                            value, cpu->pmsav7_dregion);
          } else {
 -            cpu->env.cp15.c6_rgnr = value;
 +            cpu->env.pmsav7.rnr = value;
          }
          break;
      case 0xd9c: /* MPU_RBAR */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                                region, cpu->pmsav7_dregion);
                  return;
              }
 -            cpu->env.cp15.c6_rgnr = region;
 +            cpu->env.pmsav7.rnr = region;
          } else {
 -            region = cpu->env.cp15.c6_rgnr;
 +            region = cpu->env.pmsav7.rnr;
          }
          if (region >= cpu->pmsav7_dregion) {
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
      case 0xdb0: /* MPU_RASR_A2 */
      case 0xdb8: /* MPU_RASR_A3 */
      {
 -        int region = cpu->env.cp15.c6_rgnr;
 +        int region = cpu->env.pmsav7.rnr;
          if (region >= cpu->pmsav7_dregion) {
              return;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
          return 0;
      }
 -    u32p += env->cp15.c6_rgnr;
 +    u32p += env->pmsav7.rnr;
      return *u32p;
  }
@@ -XXX,XX +XXX,XX @@ static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
          return;
      }
--    u32p += env->cp15.c6_rgnr;
+-    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+    u32p += env->pmsav7.rnr;
+-                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
-     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
++    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-     *u32p = value;
++                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
      if (err) {
          error_report_err(err);
      }
 -    if (ret < 0 && ret != -EFAULT) {
 -        abort();
 -    }
  }
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
-       .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
+ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
        .access = PL1_RW,
 -      .fieldoffset = offsetof(CPUARMState, cp15.c6_rgnr),
 +      .fieldoffset = offsetof(CPUARMState, pmsav7.rnr),
        .writefn = pmsav7_rgnr_write },
      REGINFO_SENTINEL
  };
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_rgnr_vmstate_validate(void *opaque, int version_id)
  {
      ARMCPU *cpu = opaque;
 -    return cpu->env.cp15.c6_rgnr < cpu->pmsav7_dregion;
 +    return cpu->env.pmsav7.rnr < cpu->pmsav7_dregion;
  }
  static const VMStateDescription vmstate_pmsav7 = {
 --
 .7.4

ARM queue for 2.10: all M profile bugfixes...

thanks
-- PMM

The following changes since commit 25dd0e77898c3e10796d4cbeb35e8af5ba6ce975:

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging (2017-07-31 11:27:43 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170731

for you to fetch changes up to 89cbc3778a3d61761e2231e740269218c9a8a41d:

hw/mps2_scc: fix incorrect properties (2017-07-31 13:11:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * fix broken properties on MPS2 SCC device
 * fix MPU trace handling of write vs exec
 * fix MPU M profile bugs:
   - not handling system space or PPB region correctly
   - not resetting state
   - not migrating MPU_RNR

----------------------------------------------------------------
Peter Maydell (6):
      target/arm: Correct MPU trace handling of write vs execute
      target/arm: Don't do MPU lookups for addresses in M profile PPB region
      target/arm: Don't allow guest to make System space executable for M profile
      target/arm: Rename cp15.c6_rgnr to pmsav7.rnr
      target/arm: Move PMSAv7 reset into arm_cpu_reset() so M profile MPUs get reset
      target/arm: Migrate MPU_RNR register state for M profile cores

Philippe Mathieu-Daudé (1):
      hw/mps2_scc: fix incorrect properties

target/arm/cpu.h      |  3 +--
 hw/intc/armv7m_nvic.c | 14 +++++-----
 hw/misc/mps2-scc.c    |  4 +--
 target/arm/cpu.c      | 14 ++++++++++
 target/arm/helper.c   | 71 ++++++++++++++++++++++++++++++++++-----------------
 target/arm/machine.c  | 30 +++++++++++++++++++++-
 6 files changed, 101 insertions(+), 35 deletions(-)

Correct off-by-one bug in the PSMAv7 MPU tracing where it would print
a write access as "reading", an insn fetch as "writing", and a read
access as "execute".

Since we have an MMUAccessType enum now, we can make the code clearer
in the process by using that rather than the raw 0/1/2 values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 1500906792-18010-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
                                    phys_ptr, prot, fsr);
         qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
                       " mmu_idx %u -> %s (prot %c%c%c)\n",
-                      access_type == 1 ? "reading" :
-                      (access_type == 2 ? "writing" : "execute"),
+                      access_type == MMU_DATA_LOAD ? "reading" :
+                      (access_type == MMU_DATA_STORE ? "writing" : "execute"),
                       (uint32_t)address, mmu_idx,
                       ret ? "Miss" : "Hit",
                       *prot & PAGE_READ ? 'r' : '-',
-- 
2.7.4

The M profile PMSAv7 specification says that if the address being looked
up is in the PPB region (0xe0000000 - 0xe00fffff) then we do not use
the MPU regions but always use the default memory map. Implement this
(we were previously behaving like an R profile PMSAv7, which does not
special case this).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_use_background_region(ARMCPU *cpu,
     }
 }
 
+static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
+{
+    /* True if address is in the M profile PPB region 0xe0000000 - 0xe00fffff */
+    return arm_feature(env, ARM_FEATURE_M) &&
+        extract32(address, 20, 12) == 0xe00;
+}
+
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                                  int access_type, ARMMMUIdx mmu_idx,
                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
     *phys_ptr = address;
     *prot = 0;
 
-    if (regime_translation_disabled(env, mmu_idx)) { /* MPU disabled */
+    if (regime_translation_disabled(env, mmu_idx) ||
+        m_is_ppb_region(env, address)) {
+        /* MPU disabled or M profile PPB access: use default memory map.
+         * The other case which uses the default memory map in the
+         * v7M ARM ARM pseudocode is exception vector reads from the vector
+         * table. In QEMU those accesses are done in arm_v7m_load_vector(),
+         * which always does a direct read using address_space_ldl(), rather
+         * than going via this function, so we don't need to check that here.
+         */
         get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
     } else { /* MPU enabled */
         for (n = (int)cpu->pmsav7_dregion - 1; n >= 0; n--) {
-- 
2.7.4

For an M profile v7PMSA, the system space (0xe0000000 - 0xffffffff) can
never be executable, even if the guest tries to set the MPU registers
up that way. Enforce this restriction.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline bool m_is_ppb_region(CPUARMState *env, uint32_t address)
         extract32(address, 20, 12) == 0xe00;
 }
 
+static inline bool m_is_system_region(CPUARMState *env, uint32_t address)
+{
+    /* True if address is in the M profile system region
+     * 0xe0000000 - 0xffffffff
+     */
+    return arm_feature(env, ARM_FEATURE_M) && extract32(address, 29, 3) == 0x7;
+}
+
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                                  int access_type, ARMMMUIdx mmu_idx,
                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
             get_phys_addr_pmsav7_default(env, mmu_idx, address, prot);
         } else { /* a MPU hit! */
             uint32_t ap = extract32(env->pmsav7.dracr[n], 8, 3);
+            uint32_t xn = extract32(env->pmsav7.dracr[n], 12, 1);
+
+            if (m_is_system_region(env, address)) {
+                /* System space is always execute never */
+                xn = 1;
+            }
 
             if (is_user) { /* User mode AP bit decoding */
                 switch (ap) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
             }
 
             /* execute never */
-            if (env->pmsav7.dracr[n] & (1 << 12)) {
+            if (xn) {
                 *prot &= ~PAGE_EXEC;
             }
         }
-- 
2.7.4

Almost all of the PMSAv7 state is in the pmsav7 substruct of
the ARM CPU state structure. The exception is the region
number register, which is in cp15.c6_rgnr. This exception
is a bit odd for M profile, which otherwise generally does
not store state in the cp15 substruct.

Rename cp15.c6_rgnr to pmsav7.rnr accordingly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  3 +--
 hw/intc/armv7m_nvic.c | 14 +++++++-------
 target/arm/helper.c   |  6 +++---
 target/arm/machine.c  |  2 +-
 4 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
             uint64_t par_el[4];
         };
 
-        uint32_t c6_rgnr;
-
         uint32_t c9_insn; /* Cache lockdown registers.  */
         uint32_t c9_data;
         uint64_t c9_pmcr; /* performance monitor control register */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
+        uint32_t rnr;
     } pmsav7;
 
     void *nvic;
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xd94: /* MPU_CTRL */
         return cpu->env.v7m.mpu_ctrl;
     case 0xd98: /* MPU_RNR */
-        return cpu->env.cp15.c6_rgnr;
+        return cpu->env.pmsav7.rnr;
     case 0xd9c: /* MPU_RBAR */
     case 0xda4: /* MPU_RBAR_A1 */
     case 0xdac: /* MPU_RBAR_A2 */
     case 0xdb4: /* MPU_RBAR_A3 */
     {
-        int region = cpu->env.cp15.c6_rgnr;
+        int region = cpu->env.pmsav7.rnr;
 
         if (region >= cpu->pmsav7_dregion) {
             return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xdb0: /* MPU_RASR_A2 */
     case 0xdb8: /* MPU_RASR_A3 */
     {
-        int region = cpu->env.cp15.c6_rgnr;
+        int region = cpu->env.pmsav7.rnr;
 
         if (region >= cpu->pmsav7_dregion) {
             return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                           PRIu32 "/%" PRIu32 "\n",
                           value, cpu->pmsav7_dregion);
         } else {
-            cpu->env.cp15.c6_rgnr = value;
+            cpu->env.pmsav7.rnr = value;
         }
         break;
     case 0xd9c: /* MPU_RBAR */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                               region, cpu->pmsav7_dregion);
                 return;
             }
-            cpu->env.cp15.c6_rgnr = region;
+            cpu->env.pmsav7.rnr = region;
         } else {
-            region = cpu->env.cp15.c6_rgnr;
+            region = cpu->env.pmsav7.rnr;
         }
 
         if (region >= cpu->pmsav7_dregion) {
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
     case 0xdb0: /* MPU_RASR_A2 */
     case 0xdb8: /* MPU_RASR_A3 */
     {
-        int region = cpu->env.cp15.c6_rgnr;
+        int region = cpu->env.pmsav7.rnr;
 
         if (region >= cpu->pmsav7_dregion) {
             return;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pmsav7_read(CPUARMState *env, const ARMCPRegInfo *ri)
         return 0;
     }
 
-    u32p += env->cp15.c6_rgnr;
+    u32p += env->pmsav7.rnr;
     return *u32p;
 }
 
@@ -XXX,XX +XXX,XX @@ static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
         return;
     }
 
-    u32p += env->cp15.c6_rgnr;
+    u32p += env->pmsav7.rnr;
     tlb_flush(CPU(cpu)); /* Mappings may have changed - purge! */
     *u32p = value;
 }
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
       .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
     { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
       .access = PL1_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c6_rgnr),
+      .fieldoffset = offsetof(CPUARMState, pmsav7.rnr),
       .writefn = pmsav7_rgnr_write },
     REGINFO_SENTINEL
 };
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_rgnr_vmstate_validate(void *opaque, int version_id)
 {
     ARMCPU *cpu = opaque;
 
-    return cpu->env.cp15.c6_rgnr < cpu->pmsav7_dregion;
+    return cpu->env.pmsav7.rnr < cpu->pmsav7_dregion;
 }
 
 static const VMStateDescription vmstate_pmsav7 = {
-- 
2.7.4

When the PMSAv7 implementation was originally added it was for R profile
CPUs only, and reset was handled using the cpreg .resetfn hooks.
Unfortunately for M profile cores this doesn't work, because they do
not register any cpregs. Move the reset handling into arm_cpu_reset(),
where it will work for both R profile and M profile cores.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c    | 14 ++++++++++++++
 target/arm/helper.c | 28 ++++++++++++----------------
 2 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
 
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
+
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
+        arm_feature(env, ARM_FEATURE_V7)) {
+        if (cpu->pmsav7_dregion > 0) {
+            memset(env->pmsav7.drbar, 0,
+                   sizeof(*env->pmsav7.drbar) * cpu->pmsav7_dregion);
+            memset(env->pmsav7.drsr, 0,
+                   sizeof(*env->pmsav7.drsr) * cpu->pmsav7_dregion);
+            memset(env->pmsav7.dracr, 0,
+                   sizeof(*env->pmsav7.dracr) * cpu->pmsav7_dregion);
+        }
+        env->pmsav7.rnr = 0;
+    }
+
     set_flush_to_zero(1, &env->vfp.standard_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void pmsav7_write(CPUARMState *env, const ARMCPRegInfo *ri,
     *u32p = value;
 }
 
-static void pmsav7_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    ARMCPU *cpu = arm_env_get_cpu(env);
-    uint32_t *u32p = *(uint32_t **)raw_ptr(env, ri);
-
-    if (!u32p) {
-        return;
-    }
-
-    memset(u32p, 0, sizeof(*u32p) * cpu->pmsav7_dregion);
-}
-
 static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                               uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static void pmsav7_rgnr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 static const ARMCPRegInfo pmsav7_cp_reginfo[] = {
+    /* Reset for all these registers is handled in arm_cpu_reset(),
+     * because the PMSAv7 is also used by M-profile CPUs, which do
+     * not register cpregs but still need the state to be reset.
+     */
     { .name = "DRBAR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 0,
       .access = PL1_RW, .type = ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, pmsav7.drbar),
-      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
+      .readfn = pmsav7_read, .writefn = pmsav7_write,
+      .resetfn = arm_cp_reset_ignore },
     { .name = "DRSR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 2,
       .access = PL1_RW, .type = ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, pmsav7.drsr),
-      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
+      .readfn = pmsav7_read, .writefn = pmsav7_write,
+      .resetfn = arm_cp_reset_ignore },
     { .name = "DRACR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 1, .opc2 = 4,
       .access = PL1_RW, .type = ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, pmsav7.dracr),
-      .readfn = pmsav7_read, .writefn = pmsav7_write, .resetfn = pmsav7_reset },
+      .readfn = pmsav7_read, .writefn = pmsav7_write,
+      .resetfn = arm_cp_reset_ignore },
     { .name = "RGNR", .cp = 15, .crn = 6, .opc1 = 0, .crm = 2, .opc2 = 0,
       .access = PL1_RW,
       .fieldoffset = offsetof(CPUARMState, pmsav7.rnr),
-      .writefn = pmsav7_rgnr_write },
+      .writefn = pmsav7_rgnr_write,
+      .resetfn = arm_cp_reset_ignore },
     REGINFO_SENTINEL
 };
 
-- 
2.7.4

The PMSAv7 region number register is migrated for R profile
cores using the cpreg scheme, but M profile doesn't use
cpregs, and so we weren't migrating the MPU_RNR register state
at all. Fix that by adding a migration subsection for the
M profile case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1501153150-19984-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/machine.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmsav7 = {
     }
 };
 
+static bool pmsav7_rnr_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+
+    /* For R profile cores pmsav7.rnr is migrated via the cpreg
+     * "RGNR" definition in helper.h. For M profile we have to
+     * migrate it separately.
+     */
+    return arm_feature(env, ARM_FEATURE_M);
+}
+
+static const VMStateDescription vmstate_pmsav7_rnr = {
+    .name = "cpu/pmsav7-rnr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pmsav7_rnr_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.pmsav7.rnr, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static int get_cpsr(QEMUFile *f, void *opaque, size_t size,
                     VMStateField *field)
 {
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_iwmmxt,
         &vmstate_m,
         &vmstate_thumb2ee,
+        /* pmsav7_rnr must come before pmsav7 so that we have the
+         * region number before we test it in the VMSTATE_VALIDATE
+         * in vmstate_pmsav7.
+         */
+        &vmstate_pmsav7_rnr,
         &vmstate_pmsav7,
         NULL
     }
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170729234930.725-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/mps2-scc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mps2-scc.c
+++ b/hw/misc/mps2-scc.c
@@ -XXX,XX +XXX,XX @@ static Property mps2_scc_properties[] = {
     /* Values for various read-only ID registers (which are specific
      * to the board model or FPGA image)
      */
-    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, aid, 0),
+    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
-    DEFINE_PROP_UINT32("scc-id", MPS2SCC, aid, 0),
+    DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
     /* These are the initial settings for the source clocks on the board.
      * In hardware they can be configured via a config file read by the
      * motherboard configuration controller to suit the FPGA image.
-- 
2.7.4

A small set of arm bugfixes for rc0.

The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107

for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:

hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm_gicv3_its: Don't abort on table save failure
 * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
 * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
 * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
 * arm: implement cache/shareability attribute bits for PAR registers

----------------------------------------------------------------
Andrew Baumann (1):
      arm: implement cache/shareability attribute bits for PAR registers

Eric Auger (1):
      hw/intc/arm_gicv3_its: Don't abort on table save failure

Peter Maydell (1):
      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD

Shanker Donthineni (1):
      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()

Thomas Huth (3):
      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
      hw/arm: Mark the "fsl,imx25" device with user_creatable = false
      hw/arm: Mark the "fsl,imx31" device with user_creatable = false

From: Andrew Baumann <Andrew.Baumann@microsoft.com>

On a successful address translation instruction, PAR is supposed to
contain cacheability and shareability attributes determined by the
translation. We previously returned 0 for these bits (in line with the
general strategy of ignoring caches and memory attributes), but some
guest OSes may depend on them.

This patch collects the attribute bits in the page-table walk, and
updates PAR with the correct attributes for all LPAE translations.
Short descriptor formats still return 0 for these bits, as in the
prior implementation.

Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 164 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
 
 #ifndef CONFIG_USER_ONLY
+/* Cacheability and shareability attributes for a memory access */
+typedef struct ARMCacheAttrs {
+    unsigned int attrs:8; /* as in the MAIR register encoding */
+    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
+} ARMCacheAttrs;
+
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi);
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi);
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 /* Security attributes for an address, as returned by v8m_security_lookup. */
 typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
     uint64_t par64;
     MemTxAttrs attrs = {};
     ARMMMUFaultInfo fi = {};
+    ARMCacheAttrs cacheattrs = {};
 
-    ret = get_phys_addr(env, value, access_type, mmu_idx,
-                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
+    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
+                        &prot, &page_size, &fsr, &fi, &cacheattrs);
     if (extended_addresses_enabled(env)) {
         /* fsr is a DFSR/IFSR value for the long descriptor
          * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
             if (!attrs.secure) {
                 par64 |= (1 << 9); /* NS */
             }
-            /* We don't set the ATTR or SH fields in the PAR. */
+            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
+            par64 |= cacheattrs.shareability << 7; /* SH */
         } else {
             par64 |= 1; /* F */
             par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
         return false;
     }
     if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
-                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
+                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
         /* the MPU lookup failed */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         int ret;
 
         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
-                                 &txattrs, &s2prot, &s2size, fsr, fi);
+                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
         if (ret) {
             fi->s2addr = addr;
             fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
     return true;
 }
 
+/* Translate from the 4-bit stage 2 representation of
+ * memory attributes (without cache-allocation hints) to
+ * the 8-bit representation of the stage 1 MAIR registers
+ * (which includes allocation hints).
+ *
+ * ref: shared/translation/attrs/S2AttrDecode()
+ *      .../S2ConvertAttrsHints()
+ */
+static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
+{
+    uint8_t hiattr = extract32(s2attrs, 2, 2);
+    uint8_t loattr = extract32(s2attrs, 0, 2);
+    uint8_t hihint = 0, lohint = 0;
+
+    if (hiattr != 0) { /* normal memory */
+        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
+            hiattr = loattr = 1; /* non-cacheable */
+        } else {
+            if (hiattr != 1) { /* Write-through or write-back */
+                hihint = 3; /* RW allocate */
+            }
+            if (loattr != 1) { /* Write-through or write-back */
+                lohint = 3; /* RW allocate */
+            }
+        }
+    }
+
+    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
+}
+
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi)
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          */
         txattrs->secure = false;
     }
+
+    if (cacheattrs != NULL) {
+        if (mmu_idx == ARMMMUIdx_S2NS) {
+            cacheattrs->attrs = convert_stage2_attrs(env,
+                                                     extract32(attrs, 0, 4));
+        } else {
+            /* Index into MAIR registers for cache attributes */
+            uint8_t attrindx = extract32(attrs, 0, 3);
+            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
+            assert(attrindx <= 7);
+            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
+        }
+        cacheattrs->shareability = extract32(attrs, 6, 2);
+    }
+
     *phys_ptr = descaddr;
     *page_size_ptr = page_size;
     return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
     return false;
 }
 
+/* Combine either inner or outer cacheability attributes for normal
+ * memory, according to table D4-42 and pseudocode procedure
+ * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
+ *
+ * NB: only stage 1 includes allocation hints (RW bits), leading to
+ * some asymmetry.
+ */
+static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
+{
+    if (s1 == 4 || s2 == 4) {
+        /* non-cacheable has precedence */
+        return 4;
+    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
+        /* stage 1 write-through takes precedence */
+        return s1;
+    } else if (extract32(s2, 2, 2) == 2) {
+        /* stage 2 write-through takes precedence, but the allocation hint
+         * is still taken from stage 1
+         */
+        return (2 << 2) | extract32(s1, 0, 2);
+    } else { /* write-back */
+        return s1;
+    }
+}
+
+/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
+ * and CombineS1S2Desc()
+ *
+ * @s1:      Attributes from stage 1 walk
+ * @s2:      Attributes from stage 2 walk
+ */
+static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
+{
+    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
+    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
+    ARMCacheAttrs ret;
+
+    /* Combine shareability attributes (table D4-43) */
+    if (s1.shareability == 2 || s2.shareability == 2) {
+        /* if either are outer-shareable, the result is outer-shareable */
+        ret.shareability = 2;
+    } else if (s1.shareability == 3 || s2.shareability == 3) {
+        /* if either are inner-shareable, the result is inner-shareable */
+        ret.shareability = 3;
+    } else {
+        /* both non-shareable */
+        ret.shareability = 0;
+    }
+
+    /* Combine memory type and cacheability attributes */
+    if (s1hi == 0 || s2hi == 0) {
+        /* Device has precedence over normal */
+        if (s1lo == 0 || s2lo == 0) {
+            /* nGnRnE has precedence over anything */
+            ret.attrs = 0;
+        } else if (s1lo == 4 || s2lo == 4) {
+            /* non-Reordering has precedence over Reordering */
+            ret.attrs = 4;  /* nGnRE */
+        } else if (s1lo == 8 || s2lo == 8) {
+            /* non-Gathering has precedence over Gathering */
+            ret.attrs = 8;  /* nGRE */
+        } else {
+            ret.attrs = 0xc; /* GRE */
+        }
+
+        /* Any location for which the resultant memory type is any
+         * type of Device memory is always treated as Outer Shareable.
+         */
+        ret.shareability = 2;
+    } else { /* Normal memory */
+        /* Outer/inner cacheability combine independently */
+        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
+                  | combine_cacheattr_nibble(s1lo, s2lo);
+
+        if (ret.attrs == 0x44) {
+            /* Any location for which the resultant memory type is Normal
+             * Inner Non-cacheable, Outer Non-cacheable is always treated
+             * as Outer Shareable.
+             */
+            ret.shareability = 2;
+        }
+    }
+
+    return ret;
+}
+
+
 /* get_phys_addr - get the physical address for this virtual address
  *
  * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
  * @prot: set to the permissions for the page containing phys_ptr
  * @page_size: set to the size of the page containing phys_ptr
  * @fsr: set to the DFSR/IFSR value on failure
+ * @fi: set to fault info if the translation fails
+ * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
  */
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi)
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
         /* Call ourselves recursively to do the stage 1 and then stage 2
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            ARMCacheAttrs cacheattrs2 = {};
 
             ret = get_phys_addr(env, address, access_type,
                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
-                                prot, page_size, fsr, fi);
+                                prot, page_size, fsr, fi, cacheattrs);
 
             /* If S1 fails or S2 is disabled, return early.  */
             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             /* S1 is done. Now do S2 translation.  */
             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
                                      phys_ptr, attrs, &s2_prot,
-                                     page_size, fsr, fi);
+                                     page_size, fsr, fi,
+                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
             fi->s2addr = ipa;
             /* Combine the S1 and S2 perms.  */
             *prot &= s2_prot;
+
+            /* Combine the S1 and S2 cache attributes, if needed */
+            if (!ret && cacheattrs != NULL) {
+                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+            }
+
             return ret;
         } else {
             /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     if (regime_using_lpae_format(env, mmu_idx)) {
         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
-                                  attrs, prot, page_size, fsr, fi);
+                                  attrs, prot, page_size, fsr, fi, cacheattrs);
     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
                                 attrs, prot, page_size, fsr, fi);
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
 
     ret = get_phys_addr(env, address, access_type,
                         core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
-                        &attrs, &prot, &page_size, fsr, fi);
+                        &attrs, &prot, &page_size, fsr, fi, NULL);
     if (!ret) {
         /* Map a single [sub]page.  */
         phys_addr &= TARGET_PAGE_MASK;
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     *attrs = (MemTxAttrs) {};
 
     ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-                        attrs, &prot, &page_size, &fsr, &fi);
+                        attrs, &prot, &page_size, &fsr, &fi, NULL);
 
     if (ret) {
         return -1;
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

This device causes QEMU to abort if the user tries to instantiate it:

$ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
Aborted (core dumped)

The device uses serial_hds[] directly in its realize function, so it
can not be instantiated again by the user.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx6_realize;
-
     dc->desc = "i.MX6 SOC";
+    /* Reason: Uses serial_hds[] in the realize() function */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx6_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx25
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)

The imx25-pdk board (which is the one that uses this CPU type) only
supports one CPU, and the realize function of the "fsl,imx25" device
also uses serial_hds[] directly, so this device clearly can not be
instantiated twice and thus we should mark it with user_creatable = 0.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx25.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx25_realize;
-
     dc->desc = "i.MX25 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the imx25 board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx25_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx31
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)
Aborted (core dumped)

The kzm board (which is the one that uses this CPU type) only supports
one CPU, and the realize function of the "fsl,imx31" device also uses
serial_hds[] directly, so this device clearly can not be instantiated
twice and thus we should mark it with user_creatable = false.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx31.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx31_realize;
-
     dc->desc = "i.MX31 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the kzm board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx31_type_info = {
-- 
2.7.4

For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
lowest address is always Rt and the one at addr+4 is Rt2, even if the
CPU is big-endian. Our implementation does these with a single
64-bit store, so if we're big-endian then we need to put the two
32-bit halves together in the opposite order to little-endian,
so that they end up in the right places. We were trying to do
this with the gen_aa32_frob64() function, but that is not correct
for the usermode emulator, because there there is a distinction
between "load a 64 bit value" (which does a BE 64-bit access
and doesn't need swapping) and "load two 32 bit values as one
64 bit access" (where we still need to do the swapping, like
system mode BE32).

Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
         TCGv_i32 tmp2 = tcg_temp_new_i32();
         TCGv_i64 t64 = tcg_temp_new_i64();
 
-        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. That means we don't want to do a
+         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
+         * for an architecturally 64-bit access, but instead do a
+         * 64-bit access using MO_BE if appropriate and then split
+         * the two halves.
+         * This only makes a difference for BE32 user-mode, where
+         * frob64() must not flip the two halves of the 64-bit data
+         * but this code must treat BE32 user-mode like BE32 system.
+         */
+        TCGv taddr = gen_aa32_addr(s, addr, opc);
+
+        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
+        tcg_temp_free(taddr);
         tcg_gen_mov_i64(cpu_exclusive_val, t64);
-        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        if (s->be_data == MO_BE) {
+            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
+        } else {
+            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        }
         tcg_temp_free_i64(t64);
 
         store_reg(s, rt2, tmp2);
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         TCGv_i64 n64 = tcg_temp_new_i64();
 
         t2 = load_reg(s, rt2);
-        tcg_gen_concat_i32_i64(n64, t1, t2);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. Since we're going to treat this as a
+         * single 64-bit BE store, we need to put the two halves in the
+         * opposite order for BE to LE, so that they end up in the right
+         * places.
+         * We don't want gen_aa32_frob64() because that does the wrong
+         * thing for BE32 usermode.
+         */
+        if (s->be_data == MO_BE) {
+            tcg_gen_concat_i32_i64(n64, t2, t1);
+        } else {
+            tcg_gen_concat_i32_i64(n64, t1, t2);
+        }
         tcg_temp_free_i32(t2);
-        gen_aa32_frob64(s, n64);
 
         tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
                                    get_mem_index(s), opc);
         tcg_temp_free_i64(n64);
 
-        gen_aa32_frob64(s, o64);
         tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
         tcg_gen_extrl_i64_i32(t0, o64);
 
-- 
2.7.4

From: Shanker Donthineni <shankerd@codeaurora.org>

The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
/restore") breaks the backward compatibility with the older kernels
where vITS save/restore support is not available. The vmstate function
vm_change_state_handler() should not be registered if the running kernel
doesn't support ITS save/restore feature. Otherwise VM instance will be
killed whenever vmstate callback function is invoked.

Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.

KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'

Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
             error_free(s->migration_blocker);
             return;
         }
+    } else {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
     }
 
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-
-    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 /**
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

The ITS is not fully properly reset at the moment. Caches are
not emptied.

After a reset, in case we attempt to save the state before
the bound devices have registered their MSIs and after the
1st level table has been allocated by the ITS driver
(device BASER is valid), the first level entries are still
invalid. If the device cache is not empty (devices registered
before the reset), vgic_its_save_device_tables fails with -EINVAL.
This causes a QEMU abort().

Cc: qemu-stable@nongnu.org
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
 {
     GICv3ITSState *s = (GICv3ITSState *)opaque;
     Error *err = NULL;
-    int ret;
 
     if (running) {
         return;
     }
 
-    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
     if (err) {
         error_report_err(err);
     }
-    if (ret < 0 && ret != -EFAULT) {
-        abort();
-    }
 }
 
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-- 
2.7.4