target-arm queue. This has the "plumb txattrs through various

bits of exec.c" patches, and a collection of bug fixes from

various people.

The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:

Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531

for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)

* target/arm: Honour FPCR.FZ in FRECPX

* MAINTAINERS: Add entries for newer MPS2 boards and devices

* hw/intc/arm_gicv3: Fix APxR<n> register dispatching

* arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel

GIC state

* tcg: Fix helper function vs host abi for float16

* arm: fix qemu crash on startup with -bios option

* arm: fix malloc type mismatch

* xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

* Correct CPACR reset value for v7 cores

* memory.h: Improve IOMMU related documentation

* exec: Plumb transaction attributes through various functions in

preparation for allowing IOMMUs to see them

* vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

* ARM: ACPI: Fix use-after-free due to memory realloc

* KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

Francisco Iglesias (1):

xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

Igor Mammedov (1):

arm: fix qemu crash on startup with -bios option

Jan Kiszka (1):

hw/intc/arm_gicv3: Fix APxR<n> register dispatching

Paolo Bonzini (1):

arm: fix malloc type mismatch

Peter Maydell (17):

target/arm: Honour FPCR.FZ in FRECPX

MAINTAINERS: Add entries for newer MPS2 boards and devices

Correct CPACR reset value for v7 cores

memory.h: Improve IOMMU related documentation

Make tb_invalidate_phys_addr() take a MemTxAttrs argument

Make address_space_translate{, _cached}() take a MemTxAttrs argument

Make address_space_map() take a MemTxAttrs argument

Make address_space_access_valid() take a MemTxAttrs argument

Make flatview_extend_translation() take a MemTxAttrs argument

Make memory_region_access_valid() take a MemTxAttrs argument

Make MemoryRegion valid.accepts callback take a MemTxAttrs argument

Make flatview_access_valid() take a MemTxAttrs argument

Make flatview_translate() take a MemTxAttrs argument

Make address_space_get_iotlb_entry() take a MemTxAttrs argument

Make flatview_do_translate() take a MemTxAttrs argument

Make address_space_translate_iommu take a MemTxAttrs argument

vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

Richard Henderson (1):

tcg: Fix helper function vs host abi for float16

From: Igor Mammedov <imammedo@redhat.com>

When QEMU is started with following CLI

-machine virt,gic-version=3,accel=kvm -cpu host -bios AAVMF_CODE.fd

it crashes with abort at

accel/kvm/kvm-all.c:2164:

KVM_SET_DEVICE_ATTR failed: Group 6 attr 0x000000000000c665: Invalid argument

Which is caused by implicit dependency of kvm_arm_gicv3_reset() on

arm_gicv3_icc_reset() where the later is called by CPU reset

reset callback.

However commit:

3b77f6c arm/boot: split load_dtb() from arm_load_kernel()

broke CPU reset callback registration in case

arm_load_kernel()

...

if (!info->kernel_filename || info->firmware_loaded)

branch is taken, i.e. it's sufficient to provide a firmware

or do not provide kernel on CLI to skip cpu reset callback

registration, where before offending commit the callback

has been registered unconditionally.

Fix it by registering the callback right at the beginning of

arm_load_kernel() unconditionally instead of doing it at the end.

NOTE:

we probably should eliminate that dependency anyways as well as

separate arch CPU reset parts from arm_load_kernel() into CPU

itself, but that refactoring that I probably would have to do

anyways later for CPU hotplug to work.

Reported-by: Auger Eric <eric.auger@redhat.com>

Signed-off-by: Igor Mammedov <imammedo@redhat.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527070950-208350-1-git-send-email-imammedo@redhat.com

hw/arm/boot.c | 18 +++++++++---------

1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

static const ARMInsnFixup *primary_loader;

AddressSpace *as = arm_boot_address_space(cpu, info);

+ /* CPU objects (unlike devices) are not automatically reset on system

+ * reset, so we must always register a handler to do so. If we're

+ * actually loading a kernel, the handler is also responsible for

+ * arranging that we start it correctly.

+ */

+ for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

+ qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

+ }

+

/* The board code is not supposed to set secure_board_setup unless

* running its code in secure mode is actually possible, and KVM

* doesn't support secure.

@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)

ARM_CPU(cs)->env.boot_info = info;

}

- /* CPU objects (unlike devices) are not automatically reset on system

- * reset, so we must always register a handler to do so. If we're

- * actually loading a kernel, the handler is also responsible for

- * arranging that we start it correctly.

- */

- for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

- qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

- }

-

if (!info->skip_dtb_autoload && have_dtb(info)) {

if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {

exit(1);

The FRECPX instructions should (like most other floating point operations)

honour the FPCR.FZ bit which specifies whether input denormals should

be flushed to zero (or FZ16 for the half-precision version).

We forgot to implement this, which doesn't affect the results (since

the calculation doesn't actually care about the mantissa bits) but did

mean we were failing to set the FPSR.IDC bit.

Message-id: 20180521172712.19930-1-peter.maydell@linaro.org

target/arm/helper-a64.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c

--- a/target/arm/helper-a64.c

+++ b/target/arm/helper-a64.c

@@ -XXX,XX +XXX,XX @@ float16 HELPER(frecpx_f16)(float16 a, void *fpstp)

return nan;

+ a = float16_squash_input_denormal(a, fpst);

val16 = float16_val(a);

sbit = 0x8000 & val16;

exp = extract32(val16, 10, 5);

@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)

return nan;

+ a = float32_squash_input_denormal(a, fpst);

val32 = float32_val(a);

sbit = 0x80000000ULL & val32;

exp = extract32(val32, 23, 8);

@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)

return nan;

+ a = float64_squash_input_denormal(a, fpst);

+

val64 = float64_val(a);

sbit = 0x8000000000000000ULL & val64;

exp = extract64(float64_val(a), 52, 11);

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to tb_invalidate_phys_addr().

Its callers either have an attrs value to hand, or don't care

and can use MEMTXATTRS_UNSPECIFIED.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180521140402.23318-3-peter.maydell@linaro.org

include/exec/exec-all.h | 5 +++--

accel/tcg/translate-all.c | 2 +-

exec.c | 2 +-

target/xtensa/op_helper.c | 3 ++-

4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h

--- a/include/exec/exec-all.h

+++ b/include/exec/exec-all.h

@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,

void tlb_set_page(CPUState *cpu, target_ulong vaddr,

hwaddr paddr, int prot,

int mmu_idx, target_ulong size);

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);

void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,

uintptr_t retaddr);

#else

@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,

uint16_t idxmap)

{

}

-static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr,

+ MemTxAttrs attrs)

{

}

#endif

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)

}

#if !defined(CONFIG_USER_ONLY)

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)

{

ram_addr_t ram_addr;

MemoryRegion *mr;

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)

if (phys != -1) {

/* Locks grabbed by tb_invalidate_phys_addr */

tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,

- phys | (pc & ~TARGET_PAGE_MASK));

+ phys | (pc & ~TARGET_PAGE_MASK), attrs);

}

}

#endif

diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/xtensa/op_helper.c

+++ b/target/xtensa/op_helper.c

@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_virtual_addr(CPUXtensaState *env, uint32_t vaddr)

int ret = xtensa_get_physical_addr(env, false, vaddr, 2, 0,

&paddr, &page_size, &access);

if (ret == 0) {

- tb_invalidate_phys_addr(&address_space_memory, paddr);

+ tb_invalidate_phys_addr(&address_space_memory, paddr,

+ MEMTXATTRS_UNSPECIFIED);

}

}

From: Shannon Zhao <zhaoshenglong@huawei.com>

kvm_irqchip_create called by kvm_init will call kvm_init_irq_routing to

initialize global capability variables. If we call kvm_init_irq_routing in

GIC realize function, previous allocated memory will leak.

Fix this by deleting the unnecessary call.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527750994-14360-1-git-send-email-zhaoshenglong@huawei.com

hw/intc/arm_gic_kvm.c | 1 -

hw/intc/arm_gicv3_kvm.c | 1 -

2 files changed, 2 deletions(-)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c

--- a/hw/intc/arm_gic_kvm.c

+++ b/hw/intc/arm_gic_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3_kvm.c

+++ b/hw/intc/arm_gicv3_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

Add more detail to the documentation for memory_region_init_iommu()

and other IOMMU-related functions and data structures.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20180521140402.23318-2-peter.maydell@linaro.org

include/exec/memory.h | 105 ++++++++++++++++++++++++++++++++++++++----

1 file changed, 95 insertions(+), 10 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h

--- a/include/exec/memory.h

+++ b/include/exec/memory.h

@@ -XXX,XX +XXX,XX @@ enum IOMMUMemoryRegionAttr {

IOMMU_ATTR_SPAPR_TCE_FD

};

+/**

+ * IOMMUMemoryRegionClass:

+ *

+ * All IOMMU implementations need to subclass TYPE_IOMMU_MEMORY_REGION

+ * and provide an implementation of at least the @translate method here

+ * to handle requests to the memory region. Other methods are optional.

+ *

+ * The IOMMU implementation must use the IOMMU notifier infrastructure

+ * to report whenever mappings are changed, by calling

+ * memory_region_notify_iommu() (or, if necessary, by calling

+ * memory_region_notify_one() for each registered notifier).

+ */

typedef struct IOMMUMemoryRegionClass {

/* private */

struct DeviceClass parent_class;

/*

- * Return a TLB entry that contains a given address. Flag should

- * be the access permission of this translation operation. We can

- * set flag to IOMMU_NONE to mean that we don't need any

- * read/write permission checks, like, when for region replay.

+ * Return a TLB entry that contains a given address.

+ *

+ * The IOMMUAccessFlags indicated via @flag are optional and may

+ * be specified as IOMMU_NONE to indicate that the caller needs

+ * the full translation information for both reads and writes. If

+ * the access flags are specified then the IOMMU implementation

+ * may use this as an optimization, to stop doing a page table

+ * walk as soon as it knows that the requested permissions are not

+ * allowed. If IOMMU_NONE is passed then the IOMMU must do the

+ * full page table walk and report the permissions in the returned

+ * IOMMUTLBEntry. (Note that this implies that an IOMMU may not

+ * return different mappings for reads and writes.)

+ *

+ * The returned information remains valid while the caller is

+ * holding the big QEMU lock or is inside an RCU critical section;

+ * if the caller wishes to cache the mapping beyond that it must

+ * register an IOMMU notifier so it can invalidate its cached

+ * information when the IOMMU mapping changes.

+ *

+ * @iommu: the IOMMUMemoryRegion

+ * @hwaddr: address to be translated within the memory region

+ * @flag: requested access permissions

*/

IOMMUTLBEntry (*translate)(IOMMUMemoryRegion *iommu, hwaddr addr,

IOMMUAccessFlags flag);

- /* Returns minimum supported page size */

+ /* Returns minimum supported page size in bytes.

+ * If this method is not provided then the minimum is assumed to

+ * be TARGET_PAGE_SIZE.

+ *

+ * @iommu: the IOMMUMemoryRegion

+ */

uint64_t (*get_min_page_size)(IOMMUMemoryRegion *iommu);

- /* Called when IOMMU Notifier flag changed */

+ /* Called when IOMMU Notifier flag changes (ie when the set of

+ * events which IOMMU users are requesting notification for changes).

+ * Optional method -- need not be provided if the IOMMU does not

+ * need to know exactly which events must be notified.

+ *

+ * @iommu: the IOMMUMemoryRegion

+ * @old_flags: events which previously needed to be notified

+ * @new_flags: events which now need to be notified

+ */

void (*notify_flag_changed)(IOMMUMemoryRegion *iommu,

IOMMUNotifierFlag old_flags,

IOMMUNotifierFlag new_flags);

- /* Set this up to provide customized IOMMU replay function */

+ /* Called to handle memory_region_iommu_replay().

+ *

+ * The default implementation of memory_region_iommu_replay() is to

+ * call the IOMMU translate method for every page in the address space

+ * with flag == IOMMU_NONE and then call the notifier if translate

+ * returns a valid mapping. If this method is implemented then it

+ * overrides the default behaviour, and must provide the full semantics

+ * of memory_region_iommu_replay(), by calling @notifier for every

+ * translation present in the IOMMU.

+ *

+ * Optional method -- an IOMMU only needs to provide this method

+ * if the default is inefficient or produces undesirable side effects.

+ *

+ * Note: this is not related to record-and-replay functionality.

+ */

void (*replay)(IOMMUMemoryRegion *iommu, IOMMUNotifier *notifier);

- /* Get IOMMU misc attributes */

- int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr,

+ /* Get IOMMU misc attributes. This is an optional method that

+ * can be used to allow users of the IOMMU to get implementation-specific

+ * information. The IOMMU implements this method to handle calls

+ * by IOMMU users to memory_region_iommu_get_attr() by filling in

+ * the arbitrary data pointer for any IOMMUMemoryRegionAttr values that

+ * the IOMMU supports. If the method is unimplemented then

+ * memory_region_iommu_get_attr() will always return -EINVAL.

+ *

+ * @iommu: the IOMMUMemoryRegion

+ * @attr: attribute being queried

+ * @data: memory to fill in with the attribute data

+ *

+ * Returns 0 on success, or a negative errno; in particular

+ * returns -EINVAL for unrecognized or unimplemented attribute types.

+ */

+ int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr attr,

void *data);

} IOMMUMemoryRegionClass;

@@ -XXX,XX +XXX,XX @@ static inline void memory_region_init_reservation(MemoryRegion *mr,

* An IOMMU region translates addresses and forwards accesses to a target

* memory region.

*

+ * The IOMMU implementation must define a subclass of TYPE_IOMMU_MEMORY_REGION.

+ * @_iommu_mr should be a pointer to enough memory for an instance of

+ * that subclass, @instance_size is the size of that subclass, and

+ * @mrtypename is its name. This function will initialize @_iommu_mr as an

+ * instance of the subclass, and its methods will then be called to handle

+ * accesses to the memory region. See the documentation of

+ * #IOMMUMemoryRegionClass for further details.

+ *

* @_iommu_mr: the #IOMMUMemoryRegion to be initialized

* @instance_size: the IOMMUMemoryRegion subclass instance size

* @mrtypename: the type name of the #IOMMUMemoryRegion

@@ -XXX,XX +XXX,XX @@ void memory_region_register_iommu_notifier(MemoryRegion *mr,

* a notifier with the minimum page granularity returned by

* mr->iommu_ops->get_page_size().

*

+ * Note: this is not related to record-and-replay functionality.

+ *

* @iommu_mr: the memory region to observe

* @n: the notifier to which to replay iommu mappings

*/

@@ -XXX,XX +XXX,XX @@ void memory_region_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n);

* memory_region_iommu_replay_all: replay existing IOMMU translations

* to all the notifiers registered.

*

+ * Note: this is not related to record-and-replay functionality.

+ *

* @iommu_mr: the memory region to observe

*/

void memory_region_iommu_replay_all(IOMMUMemoryRegion *iommu_mr);

@@ -XXX,XX +XXX,XX @@ void memory_region_unregister_iommu_notifier(MemoryRegion *mr,

* memory_region_iommu_get_attr: return an IOMMU attr if get_attr() is

* defined on the IOMMU.

*

- * Returns 0 if succeded, error code otherwise.

+ * Returns 0 on success, or a negative errno otherwise. In particular,

+ * -EINVAL indicates that the IOMMU does not support the requested

+ * attribute.

*

* @iommu_mr: the memory region

* @attr: the requested attribute

Depending on the host abi, float16, aka uint16_t, values are

passed and returned either zero-extended in the host register

or with garbage at the top of the host register.

The tcg code generator has so far been assuming garbage, as that

matches the x86 abi, but this is incorrect for other host abis.

Further, target/arm has so far been assuming zero-extended results,

so that it may store the 16-bit value into a 32-bit slot with the

high 16-bits already clear.

Rectify both problems by mapping "f16" in the helper definition

to uint32_t instead of (a typedef for) uint16_t. This forces

the host compiler to assume garbage in the upper 16 bits on input

and to zero-extend the result on output.

Cc: qemu-stable@nongnu.org

include/exec/helper-head.h | 2 +-

target/arm/helper-a64.c | 35 +++++++++--------

target/arm/helper.c | 80 +++++++++++++++++++-------------------

3 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h

--- a/include/exec/helper-head.h

+++ b/include/exec/helper-head.h

@@ -XXX,XX +XXX,XX @@

#define dh_ctype_int int

#define dh_ctype_i64 uint64_t

#define dh_ctype_s64 int64_t

-#define dh_ctype_f16 float16

+#define dh_ctype_f16 uint32_t

#define dh_ctype_f32 float32

#define dh_ctype_f64 float64

#define dh_ctype_ptr void *

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper-a64.c

+++ b/target/arm/helper-a64.c

@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)

return flags;

-uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)

+uint64_t HELPER(vfp_cmph_a64)(uint32_t x, uint32_t y, void *fp_status)

{

return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to address_space_translate_iommu().

exec.c | 8 +++++---

1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/exec.c b/exec.c