target-arm queue: Eric's SMMUv3 patchset, and an array

of minor bugfixes and improvements from various others.

The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504

for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:

hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)

* Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board

if the commandline includes "-machine iommu=smmuv3"

* target/arm: Implement v8M VLLDM and VLSTM

* hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

* Some fixes to silence Coverity false-positives

* arm: boot: set boot_info starting from first_cpu

(fixes a technical bug not visible in practice)

* hw/net/smc91c111: Convert away from old_mmio

* hw/usb/tusb6010: Convert away from old_mmio

* hw/char/cmsdk-apb-uart.c: Accept more input after character read

* target/arm: Make MPUIR write-ignored on OMAP, StrongARM

* hw/arm/virt: Add linux,pci-domain property

Eric Auger (11):

hw/arm/smmu-common: smmu base device and datatypes

hw/arm/smmu-common: IOMMU memory region and address space setup

hw/arm/smmu-common: VMSAv8-64 page table walk

hw/arm/smmuv3: Wired IRQ and GERROR helpers

hw/arm/smmuv3: Queue helpers

hw/arm/smmuv3: Implement MMIO write operations

hw/arm/smmuv3: Event queue recording helper

hw/arm/smmuv3: Implement translate callback

hw/arm/smmuv3: Abort on vfio or vhost case

target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route

hw/arm/virt: Introduce the iommu option

arm: boot: set boot_info starting from first_cpu

Jan Kiszka (1):

hw/arm/virt: Add linux,pci-domain property

Mathew Maidment (1):

target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case

Patrick Oppenlander (1):

hw/char/cmsdk-apb-uart.c: Accept more input after character read

Peter Maydell (3):

hw/usb/tusb6010: Convert away from old_mmio

hw/net/smc91c111: Convert away from old_mmio

target/arm: Implement v8M VLLDM and VLSTM

Prem Mallappa (3):

hw/arm/smmuv3: Skeleton

hw/arm/virt: Add SMMUv3 to the virt board

hw/arm/virt-acpi-build: Add smmuv3 node in IORT table

target/arm: Tidy conditions in handle_vec_simd_shri

target/arm: Tidy condition in disas_simd_two_reg_misc

Thomas Huth (1):

hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

Convert the smc91c111 device away from using the old_mmio field of

MemoryRegionOps. This device is used by several Arm board models.

Message-id: 20180427173611.10281-3-peter.maydell@linaro.org

hw/net/smc91c111.c | 54 +++++++++++++++++++++-------------------------

1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c

--- a/hw/net/smc91c111.c

+++ b/hw/net/smc91c111.c

@@ -XXX,XX +XXX,XX @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)

return 0;

-static void smc91c111_writew(void *opaque, hwaddr offset,

- uint32_t value)

+static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)

{

- smc91c111_writeb(opaque, offset, value & 0xff);

- smc91c111_writeb(opaque, offset + 1, value >> 8);

+ int i;

+ uint32_t val = 0;

+

+ for (i = 0; i < size; i++) {

+ val |= smc91c111_readb(opaque, addr + i) << (i * 8);

+ }

+ return val;

}

-static void smc91c111_writel(void *opaque, hwaddr offset,

- uint32_t value)

+static void smc91c111_writefn(void *opaque, hwaddr addr,

+ uint64_t value, unsigned size)

{

+ int i = 0;

+

/* 32-bit writes to offset 0xc only actually write to the bank select

- register (offset 0xe) */

- if (offset != 0xc)

- smc91c111_writew(opaque, offset, value & 0xffff);

- smc91c111_writew(opaque, offset + 2, value >> 16);

-}

+ * register (offset 0xe), so skip the first two bytes we would write.

+ */

+ if (addr == 0xc && size == 4) {

+ i += 2;

+ }

-static uint32_t smc91c111_readw(void *opaque, hwaddr offset)

-{

- uint32_t val;

- val = smc91c111_readb(opaque, offset);

- val |= smc91c111_readb(opaque, offset + 1) << 8;

- return val;

-}

-

-static uint32_t smc91c111_readl(void *opaque, hwaddr offset)

-{

- uint32_t val;

- val = smc91c111_readw(opaque, offset);

- val |= smc91c111_readw(opaque, offset + 2) << 16;

- return val;

+ for (; i < size; i++) {

+ smc91c111_writeb(opaque, addr + i,

+ extract32(value, i * 8, 8));

+ }

}

static int smc91c111_can_receive_nc(NetClientState *nc)

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps smc91c111_mem_ops = {

/* The special case for 32 bit writes to 0xc means we can't just

* set .impl.min/max_access_size to 1, unfortunately

*/

- .old_mmio = {

- .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },

- .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },

- },

+ .read = smc91c111_readfn,

+ .write = smc91c111_writefn,

+ .valid.min_access_size = 1,

+ .valid.max_access_size = 4,

.endianness = DEVICE_NATIVE_ENDIAN,

};

2.17.0

For v8M the instructions VLLDM and VLSTM support lazy saving

and restoring of the secure floating-point registers. Even

if the floating point extension is not implemented, these

instructions must act as NOPs in Secure state, so they can

be used as part of the secure-to-nonsecure call sequence.

Message-id: 20180503105730.5958-1-peter.maydell@linaro.org

target/arm/translate.c | 17 ++++++++++++++++-

1 file changed, 16 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

/* Coprocessor. */

if (arm_dc_feature(s, ARM_FEATURE_M)) {

/* We don't currently implement M profile FP support,

- * so this entire space should give a NOCP fault.

+ * so this entire space should give a NOCP fault, with

+ * the exception of the v8M VLLDM and VLSTM insns, which

+ * must be NOPs in Secure state and UNDEF in Nonsecure state.

*/

+ if (arm_dc_feature(s, ARM_FEATURE_V8) &&

+ (insn & 0xffa00f00) == 0xec200a00) {

+ /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx

+ * - VLLDM, VLSTM

+ * We choose to UNDEF if the RAZ bits are non-zero.

+ */

+ if (!s->v8m_secure || (insn & 0x0040f0ff)) {

+ goto illegal_op;

+ }

+ /* Just NOP since FP support is not implemented */

+ break;

+ }

+ /* All other insns: NOCP */

gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),

default_exception_el(s));

break;

2.17.0

Convert the tusb6010 device away from using the old_mmio field

of MemoryRegionOps. This device is used only in the n800 and n810

boards.

Message-id: 20180427173611.10281-2-peter.maydell@linaro.org

hw/usb/tusb6010.c | 40 ++++++++++++++++++++++++++++++++++++----

1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/hw/usb/tusb6010.c b/hw/usb/tusb6010.c

--- a/hw/usb/tusb6010.c

+++ b/hw/usb/tusb6010.c

@@ -XXX,XX +XXX,XX @@ static void tusb_async_writew(void *opaque, hwaddr addr,

}

+static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)

+ switch (size) {

+ case 1:

+ return tusb_async_readb(opaque, addr);

+ case 2:

+ return tusb_async_readh(opaque, addr);

+ case 4:

+ return tusb_async_readw(opaque, addr);

+ default:

+ g_assert_not_reached();

+ }

+static void tusb_async_writefn(void *opaque, hwaddr addr,

+ uint64_t value, unsigned size)

+{

+ switch (size) {

+ case 1:

+ tusb_async_writeb(opaque, addr, value);

+ break;

+ case 2:

+ tusb_async_writeh(opaque, addr, value);

+ break;

+ case 4:

+ tusb_async_writew(opaque, addr, value);

+ break;

+ default:

+ g_assert_not_reached();

+ }

+}

+

static const MemoryRegionOps tusb_async_ops = {

- .old_mmio = {

- .read = { tusb_async_readb, tusb_async_readh, tusb_async_readw, },

- .write = { tusb_async_writeb, tusb_async_writeh, tusb_async_writew, },

- },

+ .read = tusb_async_readfn,

+ .write = tusb_async_writefn,

+ .valid.min_access_size = 1,

+ .valid.max_access_size = 4,

.endianness = DEVICE_NATIVE_ENDIAN,

};

2.17.0

From: Eric Auger <eric.auger@redhat.com>

At the moment, the SMMUv3 does not support notification on

TLB invalidation. So let's log an error as soon as such notifier

gets enabled.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 1524665762-31355-11-git-send-email-eric.auger@redhat.com

hw/arm/smmuv3.c | 11 +++++++++++

1 file changed, 11 insertions(+)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)

dc->realize = smmu_realize;

+static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,

+ IOMMUNotifierFlag old,

+ IOMMUNotifierFlag new)

+{

+ if (old == IOMMU_NOTIFIER_NONE) {

+ warn_report("SMMUV3 does not support vhost/vfio integration yet: "

+ "devices of those types will not function properly");

+ }

+}

static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,

void *data)

{

IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);

imrc->translate = smmuv3_translate;

+ imrc->notify_flag_changed = smmuv3_notify_flag_changed;

}

static const TypeInfo smmuv3_type_info = {

2.17.0

From: Eric Auger <eric.auger@redhat.com>

Now we have relevant helpers for queue and irq

management, let's implement MMIO write operations.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 1524665762-31355-8-git-send-email-eric.auger@redhat.com

hw/arm/smmuv3-internal.h | 8 +-

hw/arm/smmuv3.c | 170 +++++++++++++++++++++++++++++++++++++--

hw/arm/trace-events | 6 ++

3 files changed, 174 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h

--- a/hw/arm/smmuv3-internal.h

+++ b/hw/arm/smmuv3-internal.h

@@ -XXX,XX +XXX,XX @@ REG32(CR0, 0x20)

FIELD(CR0, EVENTQEN, 2, 1)

FIELD(CR0, CMDQEN, 3, 1)

+#define SMMU_CR0_RESERVED 0xFFFFFC20

+

REG32(CR0ACK, 0x24)

REG32(CR1, 0x28)

REG32(CR2, 0x2c)

@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)

return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);

}

-/* public until callers get introduced */

-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);

-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);

-

/* Queue Handling */

#define Q_BASE(q) ((q)->base & SMMU_BASE_ADDR_MASK)

@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */

addr; \

})

-int smmuv3_cmdq_consume(SMMUv3State *s);

+#define SMMU_FEATURE_2LVL_STE (1 << 0)

#endif

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@

* @irq: irq type

* @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)

*/

-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)

+static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,

+ uint32_t gerror_mask)

{

bool pulse = false;

@@ -XXX,XX +XXX,XX @@ void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)

-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)

+static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)

uint32_t pending = s->gerror ^ s->gerrorn;

uint32_t toggled = s->gerrorn ^ new_gerrorn;

@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)

s->sid_split = 0;

-int smmuv3_cmdq_consume(SMMUv3State *s)

+static int smmuv3_cmdq_consume(SMMUv3State *s)

SMMUCmdError cmd_error = SMMU_CERROR_NONE;

SMMUQueue *q = &s->cmdq;

@@ -XXX,XX +XXX,XX @@ int smmuv3_cmdq_consume(SMMUv3State *s)

return 0;

+static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,

+ uint64_t data, MemTxAttrs attrs)

+{

+ switch (offset) {

+ case A_GERROR_IRQ_CFG0:

+ s->gerror_irq_cfg0 = data;

+ return MEMTX_OK;

+ case A_STRTAB_BASE:

+ s->strtab_base = data;

+ return MEMTX_OK;

+ case A_CMDQ_BASE:

+ s->cmdq.base = data;

+ s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);

+ if (s->cmdq.log2size > SMMU_CMDQS) {

+ s->cmdq.log2size = SMMU_CMDQS;

+ }

+ return MEMTX_OK;

+ case A_EVENTQ_BASE:

+ s->eventq.base = data;

+ s->eventq.log2size = extract64(s->eventq.base, 0, 5);

+ if (s->eventq.log2size > SMMU_EVENTQS) {

+ s->eventq.log2size = SMMU_EVENTQS;

+ }

+ return MEMTX_OK;

+ case A_EVENTQ_IRQ_CFG0:

+ s->eventq_irq_cfg0 = data;

+ return MEMTX_OK;

+ default:

+ qemu_log_mask(LOG_UNIMP,

+ "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",

+ __func__, offset);

+ return MEMTX_OK;

+ }

+}

+

+static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,

+ uint64_t data, MemTxAttrs attrs)

+{

+ switch (offset) {

+ case A_CR0:

+ s->cr[0] = data;

+ s->cr0ack = data & ~SMMU_CR0_RESERVED;

+ /* in case the command queue has been enabled */

+ smmuv3_cmdq_consume(s);

+ return MEMTX_OK;

+ case A_CR1:

+ s->cr[1] = data;

+ return MEMTX_OK;

+ case A_CR2:

+ s->cr[2] = data;

+ return MEMTX_OK;

+ case A_IRQ_CTRL:

+ s->irq_ctrl = data;

+ return MEMTX_OK;

+ case A_GERRORN:

+ smmuv3_write_gerrorn(s, data);

+ /*

+ * By acknowledging the CMDQ_ERR, SW may notify cmds can

+ * be processed again

+ */

+ smmuv3_cmdq_consume(s);

+ return MEMTX_OK;

+ case A_GERROR_IRQ_CFG0: /* 64b */

+ s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);

+ return MEMTX_OK;

+ case A_GERROR_IRQ_CFG0 + 4:

+ s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);

+ return MEMTX_OK;

+ case A_GERROR_IRQ_CFG1:

+ s->gerror_irq_cfg1 = data;

+ return MEMTX_OK;

+ case A_GERROR_IRQ_CFG2:

+ s->gerror_irq_cfg2 = data;

+ return MEMTX_OK;

+ case A_STRTAB_BASE: /* 64b */

+ s->strtab_base = deposit64(s->strtab_base, 0, 32, data);

+ return MEMTX_OK;

+ case A_STRTAB_BASE + 4:

+ s->strtab_base = deposit64(s->strtab_base, 32, 32, data);

+ return MEMTX_OK;

+ case A_STRTAB_BASE_CFG:

+ s->strtab_base_cfg = data;

+ if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {

+ s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);

+ s->features |= SMMU_FEATURE_2LVL_STE;

+ }

+ return MEMTX_OK;

+ case A_CMDQ_BASE: /* 64b */

+ s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);

+ s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);

+ if (s->cmdq.log2size > SMMU_CMDQS) {

+ s->cmdq.log2size = SMMU_CMDQS;

+ }

+ return MEMTX_OK;

+ case A_CMDQ_BASE + 4: /* 64b */

+ s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);

+ return MEMTX_OK;

+ case A_CMDQ_PROD:

+ s->cmdq.prod = data;

+ smmuv3_cmdq_consume(s);

+ return MEMTX_OK;

+ case A_CMDQ_CONS:

+ s->cmdq.cons = data;

+ return MEMTX_OK;

+ case A_EVENTQ_BASE: /* 64b */

+ s->eventq.base = deposit64(s->eventq.base, 0, 32, data);

+ s->eventq.log2size = extract64(s->eventq.base, 0, 5);

+ if (s->eventq.log2size > SMMU_EVENTQS) {

+ s->eventq.log2size = SMMU_EVENTQS;

+ }

+ return MEMTX_OK;

+ case A_EVENTQ_BASE + 4:

+ s->eventq.base = deposit64(s->eventq.base, 32, 32, data);

+ return MEMTX_OK;

+ case A_EVENTQ_PROD:

+ s->eventq.prod = data;

+ return MEMTX_OK;

+ case A_EVENTQ_CONS:

+ s->eventq.cons = data;

+ return MEMTX_OK;

+ case A_EVENTQ_IRQ_CFG0: /* 64b */

+ s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);

+ return MEMTX_OK;

+ case A_EVENTQ_IRQ_CFG0 + 4:

+ s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);

+ return MEMTX_OK;

+ case A_EVENTQ_IRQ_CFG1:

+ s->eventq_irq_cfg1 = data;

+ return MEMTX_OK;

+ case A_EVENTQ_IRQ_CFG2:

+ s->eventq_irq_cfg2 = data;

+ return MEMTX_OK;

+ default:

+ qemu_log_mask(LOG_UNIMP,

+ "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",

+ __func__, offset);

+ return MEMTX_OK;

+ }

+}

+

static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,

unsigned size, MemTxAttrs attrs)

- /* not yet implemented */

- return MEMTX_ERROR;

+ SMMUState *sys = opaque;

+ SMMUv3State *s = ARM_SMMUV3(sys);

+ MemTxResult r;

+

+ /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */

+ offset &= ~0x10000;

+

+ switch (size) {

+ case 8:

+ r = smmu_writell(s, offset, data, attrs);

+ break;

+ case 4:

+ r = smmu_writel(s, offset, data, attrs);

+ break;

+ default:

+ r = MEMTX_ERROR;

+ break;

+ trace_smmuv3_write_mmio(offset, data, size, r);

+ return r;

static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,

diff --git a/hw/arm/trace-events b/hw/arm/trace-events

--- a/hw/arm/trace-events

+++ b/hw/arm/trace-events

@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t con

smmuv3_cmdq_opcode(const char *opcode) "<--- %s"

smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "

smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"

+smmuv3_update(bool is_empty, uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "q empty:%d prod:%d cons:%d p.wrap:%d p.cons:%d"

+smmuv3_update_check_cmd(int error) "cmdq not enabled or error :0x%x"

+smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"

+smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"

+smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"

+smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"

2.17.0

From: Mathew Maidment <mathew1800@gmail.com>

The duplication of id_tlbtr_reginfo was unintentionally added within

3281af8114c6b8ead02f08b58e3c36895c1ea047 which should have been

id_mpuir_reginfo.

The effect was that for OMAP and StrongARM CPUs we would

incorrectly UNDEF writes to MPUIR rather than NOPing them.

Signed-off-by: Mathew Maidment <mathew1800@gmail.com>

Message-id: 20180501184933.37609-2-mathew1800@gmail.com

[PMM: tweak commit message]

target/arm/helper.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {

r->access = PL1_RW;

}

- id_tlbtr_reginfo.access = PL1_RW;

+ id_mpuir_reginfo.access = PL1_RW;

id_tlbtr_reginfo.access = PL1_RW;

}

if (arm_feature(env, ARM_FEATURE_V8)) {

2.17.0

Path analysis shows that size == 3 && !is_q has been eliminated.

Fixes: Coverity CID1385853

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180501180455.11214-3-richard.henderson@linaro.org

target/arm/translate-a64.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)

/* All 64-bit element operations can be shared with scalar 2misc */

int pass;

- for (pass = 0; pass < (is_q ? 2 : 1); pass++) {

+ /* Coverity claims (size == 3 && !is_q) has been eliminated

+ * from all paths leading to here.

+ */

+ tcg_debug_assert(is_q);

+ for (pass = 0; pass < 2; pass++) {

TCGv_i64 tcg_op = tcg_temp_new_i64();

TCGv_i64 tcg_res = tcg_temp_new_i64();

2.17.0

Even though nothing is currently broken (since all boards

use first_cpu as boot cpu), make sure that boot_info is set

on all CPUs.

If some board would like support heterogenuos setup (i.e.

init boot_info on subset of CPUs) in future, it should add

a reasonable API to do it, instead of starting assigning

boot_info from some CPU and till the end of present CPUs

list.

Ref:

"Message-ID: <CAFEAcA_NMWuA8WSs3cNeY6xX1kerO_uAcN_3=fK02BEhHJW86g@mail.gmail.com>"

hw/arm/boot.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)

info->is_linux = is_linux;

- for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {

+ for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

ARM_CPU(cs)->env.boot_info = info;

}

}

2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch builds the smmuv3 node in the ACPI IORT table.

The RID space of the root complex, which spans 0x0-0x10000

maps to streamid space 0x0-0x10000 in smmuv3, which in turn

maps to deviceid space 0x0-0x10000 in the ITS group.

The guest must feature the IOMMU probe deferral series

(https://lkml.org/lkml/2017/4/10/214) which fixes streamid

multiple lookup. This bug is not related to the SMMU emulation.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>

Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com

include/hw/acpi/acpi-defs.h | 15 ++++++++++

hw/arm/virt-acpi-build.c | 55 ++++++++++++++++++++++++++++++++-----

2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h

--- a/include/hw/acpi/acpi-defs.h

+++ b/include/hw/acpi/acpi-defs.h

@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {

} QEMU_PACKED;

typedef struct AcpiIortItsGroup AcpiIortItsGroup;

+struct AcpiIortSmmu3 {

+ ACPI_IORT_NODE_HEADER_DEF

+ uint64_t base_address;

+ uint32_t flags;

+ uint32_t reserved2;

+ uint64_t vatos_address;

+ uint32_t model;

+ uint32_t event_gsiv;

+ uint32_t pri_gsiv;

+ uint32_t gerr_gsiv;

+ uint32_t sync_gsiv;

+ AcpiIortIdMapping id_mapping_array[0];

+} QEMU_PACKED;

+typedef struct AcpiIortSmmu3 AcpiIortSmmu3;

struct AcpiIortRC {

ACPI_IORT_NODE_HEADER_DEF

AcpiIortMemoryAccess memory_properties;

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt-acpi-build.c

+++ b/hw/arm/virt-acpi-build.c

@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)

static void

-build_iort(GArray *table_data, BIOSLinker *linker)

+build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

{

- int iort_start = table_data->len;

+ int nb_nodes, iort_start = table_data->len;

AcpiIortIdMapping *idmap;

AcpiIortItsGroup *its;

AcpiIortTable *iort;

- size_t node_size, iort_length;

+ AcpiIortSmmu3 *smmu;

+ size_t node_size, iort_length, smmu_offset = 0;

AcpiIortRC *rc;

iort = acpi_data_push(table_data, sizeof(*iort));

+ if (vms->iommu == VIRT_IOMMU_SMMUV3) {

+ nb_nodes = 3; /* RC, ITS, SMMUv3 */

+ } else {

+ nb_nodes = 2; /* RC, ITS */

iort_length = sizeof(*iort);

- iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */

+ iort->node_count = cpu_to_le32(nb_nodes);

iort->node_offset = cpu_to_le32(sizeof(*iort));

/* ITS group node */