target-arm queue. This has the "plumb txattrs through various

bits of exec.c" patches, and a collection of bug fixes from

various people.

The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:

Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531

for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)

* target/arm: Honour FPCR.FZ in FRECPX

* MAINTAINERS: Add entries for newer MPS2 boards and devices

* hw/intc/arm_gicv3: Fix APxR<n> register dispatching

* arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel

GIC state

* tcg: Fix helper function vs host abi for float16

* arm: fix qemu crash on startup with -bios option

* arm: fix malloc type mismatch

* xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

* Correct CPACR reset value for v7 cores

* memory.h: Improve IOMMU related documentation

* exec: Plumb transaction attributes through various functions in

preparation for allowing IOMMUs to see them

* vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

* ARM: ACPI: Fix use-after-free due to memory realloc

* KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

Francisco Iglesias (1):

xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

Igor Mammedov (1):

arm: fix qemu crash on startup with -bios option

Jan Kiszka (1):

hw/intc/arm_gicv3: Fix APxR<n> register dispatching

Paolo Bonzini (1):

arm: fix malloc type mismatch

Peter Maydell (17):

target/arm: Honour FPCR.FZ in FRECPX

MAINTAINERS: Add entries for newer MPS2 boards and devices

Correct CPACR reset value for v7 cores

memory.h: Improve IOMMU related documentation

Make tb_invalidate_phys_addr() take a MemTxAttrs argument

Make address_space_translate{, _cached}() take a MemTxAttrs argument

Make address_space_map() take a MemTxAttrs argument

Make address_space_access_valid() take a MemTxAttrs argument

Make flatview_extend_translation() take a MemTxAttrs argument

Make memory_region_access_valid() take a MemTxAttrs argument

Make MemoryRegion valid.accepts callback take a MemTxAttrs argument

Make flatview_access_valid() take a MemTxAttrs argument

Make flatview_translate() take a MemTxAttrs argument

Make address_space_get_iotlb_entry() take a MemTxAttrs argument

Make flatview_do_translate() take a MemTxAttrs argument

Make address_space_translate_iommu take a MemTxAttrs argument

vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

From: Richard Henderson <richard.henderson@linaro.org>

Depending on the host abi, float16, aka uint16_t, values are

passed and returned either zero-extended in the host register

or with garbage at the top of the host register.

The tcg code generator has so far been assuming garbage, as that

matches the x86 abi, but this is incorrect for other host abis.

Further, target/arm has so far been assuming zero-extended results,

so that it may store the 16-bit value into a 32-bit slot with the

high 16-bits already clear.

Rectify both problems by mapping "f16" in the helper definition

to uint32_t instead of (a typedef for) uint16_t. This forces

the host compiler to assume garbage in the upper 16 bits on input

and to zero-extend the result on output.

Cc: qemu-stable@nongnu.org

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Message-id: 20180522175629.24932-1-richard.henderson@linaro.org

include/exec/helper-head.h | 2 +-

target/arm/helper-a64.c | 35 +++++++++--------

target/arm/helper.c | 80 +++++++++++++++++++-------------------

3 files changed, 59 insertions(+), 58 deletions(-)

@@ -XXX,XX +XXX,XX @@ DO_VFP_cmp(d, float64)

/* Integer to float and float to integer conversions */

-#define CONV_ITOF(name, fsz, sign) \

- float##fsz HELPER(name)(uint32_t x, void *fpstp) \

-{ \

- float_status *fpst = fpstp; \

- return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \

+#define CONV_ITOF(name, ftype, fsz, sign) \

+ftype HELPER(name)(uint32_t x, void *fpstp) \

+{ \

+ float_status *fpst = fpstp; \

+ return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \

}

-#define CONV_FTOI(name, fsz, sign, round) \

-uint32_t HELPER(name)(float##fsz x, void *fpstp) \

-{ \

- float_status *fpst = fpstp; \

- if (float##fsz##_is_any_nan(x)) { \

- float_raise(float_flag_invalid, fpst); \

- return 0; \

- } \

- return float##fsz##_to_##sign##int32##round(x, fpst); \

+#define CONV_FTOI(name, ftype, fsz, sign, round) \

+uint32_t HELPER(name)(ftype x, void *fpstp) \

+{ \

+ float_status *fpst = fpstp; \

+ if (float##fsz##_is_any_nan(x)) { \

+ float_raise(float_flag_invalid, fpst); \

+ return 0; \

+ } \

+ return float##fsz##_to_##sign##int32##round(x, fpst); \

}

-#define FLOAT_CONVS(name, p, fsz, sign) \

-CONV_ITOF(vfp_##name##to##p, fsz, sign) \

-CONV_FTOI(vfp_to##name##p, fsz, sign, ) \

-CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)

+#define FLOAT_CONVS(name, p, ftype, fsz, sign) \

+ CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign) \

+ CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, ) \

+ CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero)

-FLOAT_CONVS(si, h, 16, )

-FLOAT_CONVS(si, s, 32, )

-FLOAT_CONVS(si, d, 64, )

-FLOAT_CONVS(ui, h, 16, u)

-FLOAT_CONVS(ui, s, 32, u)

-FLOAT_CONVS(ui, d, 64, u)

+FLOAT_CONVS(si, h, uint32_t, 16, )

+FLOAT_CONVS(si, s, float32, 32, )

+FLOAT_CONVS(si, d, float64, 64, )

+FLOAT_CONVS(ui, h, uint32_t, 16, u)

+FLOAT_CONVS(ui, s, float32, 32, u)

+FLOAT_CONVS(ui, d, float64, 64, u)

#undef CONV_ITOF

#undef CONV_FTOI

@@ -XXX,XX +XXX,XX @@ static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)

return float64_to_float16(float64_scalbn(f, -shift, fpst), true, fpst);

}

-float16 HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(int32_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);

}

@@ -XXX,XX +XXX,XX @@ static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)

}

-uint32_t HELPER(vfp_toshh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int16(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)

+uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)

+uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);

}

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)

}

/* Half precision conversions. */

-float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)

+float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing input denormals.

@@ -XXX,XX +XXX,XX @@ float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

+uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing output denormals.

@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)

+float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing input denormals.

@@ -XXX,XX +XXX,XX @@ float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float16 HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)

+uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing output denormals.

@@ -XXX,XX +XXX,XX @@ static bool round_to_inf(float_status *fpst, bool sign_bit)

g_assert_not_reached();

}

-float16 HELPER(recpe_f16)(float16 input, void *fpstp)

+uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)

{

float_status *fpst = fpstp;

float16 f16 = float16_squash_input_denormal(input, fpst);

@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)

return extract64(estimate, 0, 8) << 44;

}

-float16 HELPER(rsqrte_f16)(float16 input, void *fpstp)

+uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)

{

float_status *s = fpstp;

float16 f16 = float16_squash_input_denormal(input, s);

2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

kvm_irqchip_create called by kvm_init will call kvm_init_irq_routing to

initialize global capability variables. If we call kvm_init_irq_routing in

GIC realize function, previous allocated memory will leak.

Fix this by deleting the unnecessary call.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527750994-14360-1-git-send-email-zhaoshenglong@huawei.com

hw/intc/arm_gic_kvm.c | 1 -

hw/intc/arm_gicv3_kvm.c | 1 -

2 files changed, 2 deletions(-)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c

--- a/hw/intc/arm_gic_kvm.c

+++ b/hw/intc/arm_gic_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

}

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c

--- a/hw/intc/arm_gicv3_kvm.c

+++ b/hw/intc/arm_gicv3_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

}

2.17.1

From: Francisco Iglesias <frasse.iglesias@gmail.com>

Coverity found that the string return by 'object_get_canonical_path' was not

being freed at two locations in the model (CID 1391294 and CID 1391293) and

also that a memset was being called with a value greater than the max of a byte

on the second argument (CID 1391286). This patch corrects this by adding the

freeing of the strings and also changing to memset to zero instead on

descriptor unaligned errors.

Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180528184859.3530-1-frasse.iglesias@gmail.com

hw/dma/xlnx-zdma.c | 10 +++++++---

1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c

--- a/hw/dma/xlnx-zdma.c

+++ b/hw/dma/xlnx-zdma.c

@@ -XXX,XX +XXX,XX @@ static bool zdma_load_descriptor(XlnxZDMA *s, uint64_t addr, void *buf)

qemu_log_mask(LOG_GUEST_ERROR,

"zdma: unaligned descriptor at %" PRIx64,

addr);

- memset(buf, 0xdeadbeef, sizeof(XlnxZDMADescr));

+ memset(buf, 0x0, sizeof(XlnxZDMADescr));

s->error = true;

@@ -XXX,XX +XXX,XX @@ static uint64_t zdma_read(void *opaque, hwaddr addr, unsigned size)

RegisterInfo *r = &s->regs_info[addr / 4];

if (!r->data) {

+ gchar *path = object_get_canonical_path(OBJECT(s));

qemu_log("%s: Decode error: read from %" HWADDR_PRIx "\n",

- object_get_canonical_path(OBJECT(s)),

+ path,

addr);

+ g_free(path);

ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);

zdma_ch_imr_update_irq(s);

return 0;

@@ -XXX,XX +XXX,XX @@ static void zdma_write(void *opaque, hwaddr addr, uint64_t value,

RegisterInfo *r = &s->regs_info[addr / 4];

if (!r->data) {

+ gchar *path = object_get_canonical_path(OBJECT(s));

qemu_log("%s: Decode error: write to %" HWADDR_PRIx "=%" PRIx64 "\n",

- object_get_canonical_path(OBJECT(s)),

+ path,

addr, value);

+ g_free(path);

ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);

zdma_ch_imr_update_irq(s);

return;

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to address_space_translate_iommu().

exec.c | 8 +++++---

1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/exec.c b/exec.c

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x

* @is_write: whether the translation operation is for write

* @is_mmio: whether this can be MMIO, set true if it can

* @target_as: the address space targeted by the IOMMU

+ * @attrs: transaction attributes

*

* This function is called from RCU critical section. It is the common

* part of flatview_do_translate and address_space_translate_cached.

@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection address_space_translate_iommu(IOMMUMemoryRegion *iomm

hwaddr *page_mask_out,

bool is_write,

bool is_mmio,

- AddressSpace **target_as)

+ AddressSpace **target_as,

+ MemTxAttrs attrs)

MemoryRegionSection *section;

hwaddr page_mask = (hwaddr)-1;

@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,

return address_space_translate_iommu(iommu_mr, xlat,

plen_out, page_mask_out,

is_write, is_mmio,

- target_as);

+ target_as, attrs);

}

if (page_mask_out) {

/* Not behind an IOMMU, use default page size. */

@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate_cached(

section = address_space_translate_iommu(iommu_mr, xlat, plen,

NULL, is_write, true,

- &target_as);

+ &target_as, attrs);

return section.mr;

2.17.1

In commit f0aff255700 we made cpacr_write() enforce that some CPACR

bits are RAZ/WI and some are RAO/WI for ARMv7 cores. Unfortunately

we forgot to also update the register's reset value. The effect

was that (a) a guest that read CPACR on reset would not see ones in

the RAO bits, and (b) if you did a migration before the guest did

a write to the CPACR then the migration would fail because the

destination would enforce the RAO bits and then complain that they

didn't match the zero value from the source.

Implement reset for the CPACR using a custom reset function

that just calls cpacr_write(), to avoid having to duplicate

the logic for which bits are RAO.

This bug would affect migration for TCG CPUs which are ARMv7

with VFP but without one of Neon or VFPv3.

Reported-by: Cédric Le Goater <clg@kaod.org>

target/arm/helper.c | 10 +++++++++-

1 file changed, 9 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,

env->cp15.cpacr_el1 = value;

+static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)

+ /* Call cpacr_write() so that we reset with the correct RAO bits set

+ * for our CPU features.

+ */

+ cpacr_write(env, ri, 0);

+}

+

static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,

bool isread)

{

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {

{ .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,

.crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,

.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),

- .resetvalue = 0, .writefn = cpacr_write },

+ .resetfn = cpacr_reset, .writefn = cpacr_write },

REGINFO_SENTINEL

};

2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

It forgot to increase clroffset during the loop. So it only clear the

first 4 bytes.

Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920

Cc: qemu-stable@nongnu.org

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527047633-12368-1-git-send-email-zhaoshenglong@huawei.com

hw/intc/arm_gicv3_kvm.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c

--- a/hw/intc/arm_gicv3_kvm.c

+++ b/hw/intc/arm_gicv3_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,

if (clroffset != 0) {

reg = 0;

kvm_gicd_access(s, clroffset, &reg, true);

+ clroffset += 4;

}

reg = *gic_bmp_ptr32(bmp, irq);

kvm_gicd_access(s, offset, &reg, true);

2.17.1

From: Jan Kiszka <jan.kiszka@siemens.com>

There was a nasty flip in identifying which register group an access is

targeting. The issue caused spuriously raised priorities of the guest

when handing CPUs over in the Jailhouse hypervisor.

Cc: qemu-stable@nongnu.org

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

Message-id: 28b927d3-da58-bce4-cc13-bfec7f9b1cb9@siemens.com

hw/intc/arm_gicv3_cpuif.c | 12 ++++++------

1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

@@ -XXX,XX +XXX,XX @@ static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

uint64_t value = cs->ich_apr[grp][regno];

trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

@@ -XXX,XX +XXX,XX @@ static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

@@ -XXX,XX +XXX,XX @@ static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

uint64_t value;

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;

+ int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;

if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {

return icv_ap_read(env, ri);

@@ -XXX,XX +XXX,XX @@ static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;

+ int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;

if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {

icv_ap_write(env, ri, value);

@@ -XXX,XX +XXX,XX @@ static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

uint64_t value;

value = cs->ich_apr[grp][regno];

@@ -XXX,XX +XXX,XX @@ static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to tb_invalidate_phys_addr().

Its callers either have an attrs value to hand, or don't care

and can use MEMTXATTRS_UNSPECIFIED.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180521140402.23318-3-peter.maydell@linaro.org

include/exec/exec-all.h | 5 +++--

accel/tcg/translate-all.c | 2 +-

exec.c | 2 +-

target/xtensa/op_helper.c | 3 ++-

4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h

--- a/include/exec/exec-all.h

+++ b/include/exec/exec-all.h

@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,

void tlb_set_page(CPUState *cpu, target_ulong vaddr,

hwaddr paddr, int prot,

int mmu_idx, target_ulong size);

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);

void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,

uintptr_t retaddr);

#else

@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,

uint16_t idxmap)

{

}

-static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr,

+ MemTxAttrs attrs)

{

}

#endif

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)

}

#if !defined(CONFIG_USER_ONLY)

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)

{

ram_addr_t ram_addr;

MemoryRegion *mr;

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)

if (phys != -1) {

/* Locks grabbed by tb_invalidate_phys_addr */

tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,

- phys | (pc & ~TARGET_PAGE_MASK));