target-arm queue. This has the "plumb txattrs through various

bits of exec.c" patches, and a collection of bug fixes from

various people.

The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:

Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531

for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)

* target/arm: Honour FPCR.FZ in FRECPX

* MAINTAINERS: Add entries for newer MPS2 boards and devices

* hw/intc/arm_gicv3: Fix APxR<n> register dispatching

* arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel

GIC state

* tcg: Fix helper function vs host abi for float16

* arm: fix qemu crash on startup with -bios option

* arm: fix malloc type mismatch

* xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

* Correct CPACR reset value for v7 cores

* memory.h: Improve IOMMU related documentation

* exec: Plumb transaction attributes through various functions in

preparation for allowing IOMMUs to see them

* vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

* ARM: ACPI: Fix use-after-free due to memory realloc

* KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

Francisco Iglesias (1):

xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

Igor Mammedov (1):

arm: fix qemu crash on startup with -bios option

Jan Kiszka (1):

hw/intc/arm_gicv3: Fix APxR<n> register dispatching

Paolo Bonzini (1):

arm: fix malloc type mismatch

Peter Maydell (17):

target/arm: Honour FPCR.FZ in FRECPX

MAINTAINERS: Add entries for newer MPS2 boards and devices

Correct CPACR reset value for v7 cores

memory.h: Improve IOMMU related documentation

Make tb_invalidate_phys_addr() take a MemTxAttrs argument

Make address_space_translate{, _cached}() take a MemTxAttrs argument

Make address_space_map() take a MemTxAttrs argument

Make address_space_access_valid() take a MemTxAttrs argument

Make flatview_extend_translation() take a MemTxAttrs argument

Make memory_region_access_valid() take a MemTxAttrs argument

Make MemoryRegion valid.accepts callback take a MemTxAttrs argument

Make flatview_access_valid() take a MemTxAttrs argument

Make flatview_translate() take a MemTxAttrs argument

Make address_space_get_iotlb_entry() take a MemTxAttrs argument

Make flatview_do_translate() take a MemTxAttrs argument

Make address_space_translate_iommu take a MemTxAttrs argument

vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

Richard Henderson (1):

tcg: Fix helper function vs host abi for float16

From: Shannon Zhao <zhaoshenglong@huawei.com>

It forgot to increase clroffset during the loop. So it only clear the

first 4 bytes.

Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920

Cc: qemu-stable@nongnu.org

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527047633-12368-1-git-send-email-zhaoshenglong@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/intc/arm_gicv3_kvm.c | 1 +

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c

--- a/hw/intc/arm_gicv3_kvm.c

+++ b/hw/intc/arm_gicv3_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,

if (clroffset != 0) {

reg = 0;

kvm_gicd_access(s, clroffset, &reg, true);

+ clroffset += 4;

}

reg = *gic_bmp_ptr32(bmp, irq);

kvm_gicd_access(s, offset, &reg, true);

2.17.1

From: Richard Henderson <richard.henderson@linaro.org>

Depending on the host abi, float16, aka uint16_t, values are

passed and returned either zero-extended in the host register

or with garbage at the top of the host register.

The tcg code generator has so far been assuming garbage, as that

matches the x86 abi, but this is incorrect for other host abis.

Further, target/arm has so far been assuming zero-extended results,

so that it may store the 16-bit value into a 32-bit slot with the

high 16-bits already clear.

Rectify both problems by mapping "f16" in the helper definition

to uint32_t instead of (a typedef for) uint16_t. This forces

the host compiler to assume garbage in the upper 16 bits on input

and to zero-extend the result on output.

Cc: qemu-stable@nongnu.org

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Message-id: 20180522175629.24932-1-richard.henderson@linaro.org

include/exec/helper-head.h | 2 +-

target/arm/helper-a64.c | 35 +++++++++--------

target/arm/helper.c | 80 +++++++++++++++++++-------------------

3 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h

--- a/include/exec/helper-head.h

+++ b/include/exec/helper-head.h

@@ -XXX,XX +XXX,XX @@

#define dh_ctype_int int

#define dh_ctype_i64 uint64_t

#define dh_ctype_s64 int64_t

-#define dh_ctype_f16 float16

+#define dh_ctype_f16 uint32_t

#define dh_ctype_f32 float32

#define dh_ctype_f64 float64

#define dh_ctype_ptr void *

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper-a64.c

+++ b/target/arm/helper-a64.c

@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)

return flags;

}

-uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)

+uint64_t HELPER(vfp_cmph_a64)(uint32_t x, uint32_t y, void *fp_status)

{

return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));

}

-uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)

+uint64_t HELPER(vfp_cmpeh_a64)(uint32_t x, uint32_t y, void *fp_status)

{

return float_rel_to_flags(float16_compare(x, y, fp_status));

}

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, void *fpstp)

#define float64_three make_float64(0x4008000000000000ULL)

#define float64_one_point_five make_float64(0x3FF8000000000000ULL)

-float16 HELPER(recpsf_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(recpsf_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpsf_f64)(float64 a, float64 b, void *fpstp)

return float64_muladd(a, b, float64_two, 0, fpst);

}

-float16 HELPER(rsqrtsf_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_addlp_u16)(uint64_t a)

}

/* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */

-float16 HELPER(frecpx_f16)(float16 a, void *fpstp)

+uint32_t HELPER(frecpx_f16)(uint32_t a, void *fpstp)

{

float_status *fpst = fpstp;

uint16_t val16, sbit;

@@ -XXX,XX +XXX,XX @@ void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,

#define ADVSIMD_HELPER(name, suffix) HELPER(glue(glue(advsimd_, name), suffix))

#define ADVSIMD_HALFOP(name) \

-float16 ADVSIMD_HELPER(name, h)(float16 a, float16 b, void *fpstp) \

+uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, void *fpstp) \

{ \

float_status *fpst = fpstp; \

return float16_ ## name(a, b, fpst); \

@@ -XXX,XX +XXX,XX @@ ADVSIMD_HALFOP(mulx)

ADVSIMD_TWOHALFOP(mulx)

/* fused multiply-accumulate */

-float16 HELPER(advsimd_muladdh)(float16 a, float16 b, float16 c, void *fpstp)

+uint32_t HELPER(advsimd_muladdh)(uint32_t a, uint32_t b, uint32_t c,

+ void *fpstp)

{

float_status *fpst = fpstp;

return float16_muladd(a, b, c, 0, fpst);

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_muladd2h)(uint32_t two_a, uint32_t two_b,

#define ADVSIMD_CMPRES(test) (test) ? 0xffff : 0

-uint32_t HELPER(advsimd_ceq_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(advsimd_ceq_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

int compare = float16_compare_quiet(a, b, fpst);

return ADVSIMD_CMPRES(compare == float_relation_equal);

}

-uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(advsimd_cge_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

int compare = float16_compare(a, b, fpst);

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)

compare == float_relation_equal);

}

-uint32_t HELPER(advsimd_cgt_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(advsimd_cgt_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

int compare = float16_compare(a, b, fpst);

return ADVSIMD_CMPRES(compare == float_relation_greater);

}

-uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(advsimd_acge_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

float16 f0 = float16_abs(a);

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)

compare == float_relation_equal);

}

-uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)

+uint32_t HELPER(advsimd_acgt_f16)(uint32_t a, uint32_t b, void *fpstp)

{

float_status *fpst = fpstp;

float16 f0 = float16_abs(a);

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)

}

/* round to integral */

-float16 HELPER(advsimd_rinth_exact)(float16 x, void *fp_status)

+uint32_t HELPER(advsimd_rinth_exact)(uint32_t x, void *fp_status)

{

return float16_round_to_int(x, fp_status);

}

-float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)

+uint32_t HELPER(advsimd_rinth)(uint32_t x, void *fp_status)

{

int old_flags = get_float_exception_flags(fp_status), new_flags;

float16 ret;

@@ -XXX,XX +XXX,XX @@ float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)

* setting the mode appropriately before calling the helper.

*/

-uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)

+uint32_t HELPER(advsimd_f16tosinth)(uint32_t a, void *fpstp)

{

float_status *fpst = fpstp;

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)

return float16_to_int16(a, fpst);

}

-uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)

+uint32_t HELPER(advsimd_f16touinth)(uint32_t a, void *fpstp)

{

float_status *fpst = fpstp;

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)

* Square Root and Reciprocal square root

*/

-float16 HELPER(sqrt_f16)(float16 a, void *fpstp)

+uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)

{

float_status *s = fpstp;

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ DO_VFP_cmp(d, float64)

/* Integer to float and float to integer conversions */

-#define CONV_ITOF(name, fsz, sign) \

- float##fsz HELPER(name)(uint32_t x, void *fpstp) \

-{ \

- float_status *fpst = fpstp; \

- return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \

+#define CONV_ITOF(name, ftype, fsz, sign) \

+ftype HELPER(name)(uint32_t x, void *fpstp) \

+{ \

+ float_status *fpst = fpstp; \

+ return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \

}

-#define CONV_FTOI(name, fsz, sign, round) \

-uint32_t HELPER(name)(float##fsz x, void *fpstp) \

-{ \

- float_status *fpst = fpstp; \

- if (float##fsz##_is_any_nan(x)) { \

- float_raise(float_flag_invalid, fpst); \

- return 0; \

- } \

- return float##fsz##_to_##sign##int32##round(x, fpst); \

+#define CONV_FTOI(name, ftype, fsz, sign, round) \

+uint32_t HELPER(name)(ftype x, void *fpstp) \

+{ \

+ float_status *fpst = fpstp; \

+ if (float##fsz##_is_any_nan(x)) { \

+ float_raise(float_flag_invalid, fpst); \

+ return 0; \

+ } \

+ return float##fsz##_to_##sign##int32##round(x, fpst); \

}

-#define FLOAT_CONVS(name, p, fsz, sign) \

-CONV_ITOF(vfp_##name##to##p, fsz, sign) \

-CONV_FTOI(vfp_to##name##p, fsz, sign, ) \

-CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)

+#define FLOAT_CONVS(name, p, ftype, fsz, sign) \

+ CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign) \

+ CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, ) \

+ CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero)

-FLOAT_CONVS(si, h, 16, )

-FLOAT_CONVS(si, s, 32, )

-FLOAT_CONVS(si, d, 64, )

-FLOAT_CONVS(ui, h, 16, u)

-FLOAT_CONVS(ui, s, 32, u)

-FLOAT_CONVS(ui, d, 64, u)

+FLOAT_CONVS(si, h, uint32_t, 16, )

+FLOAT_CONVS(si, s, float32, 32, )

+FLOAT_CONVS(si, d, float64, 64, )

+FLOAT_CONVS(ui, h, uint32_t, 16, u)

+FLOAT_CONVS(ui, s, float32, 32, u)

+FLOAT_CONVS(ui, d, float64, 64, u)

#undef CONV_ITOF

#undef CONV_FTOI

@@ -XXX,XX +XXX,XX @@ static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)

return float64_to_float16(float64_scalbn(f, -shift, fpst), true, fpst);

}

-float16 HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(int32_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);

}

-float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)

{

return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);

}

@@ -XXX,XX +XXX,XX @@ static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)

-uint32_t HELPER(vfp_toshh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int16(do_prescale_fp16(x, shift, fpst), fpst);

-uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)

+uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)

+uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);

}

-uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)

+uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst)

{

return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);

}

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)

}

/* Half precision conversions. */

-float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)

+float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing input denormals.

@@ -XXX,XX +XXX,XX @@ float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

+uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing output denormals.

@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)

+float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing input denormals.

@@ -XXX,XX +XXX,XX @@ float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)

return r;

}

-float16 HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)

+uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)

{

/* Squash FZ16 to 0 for the duration of conversion. In this case,

* it would affect flushing output denormals.

@@ -XXX,XX +XXX,XX @@ static bool round_to_inf(float_status *fpst, bool sign_bit)

g_assert_not_reached();

}

-float16 HELPER(recpe_f16)(float16 input, void *fpstp)

+uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)

{

float_status *fpst = fpstp;

float16 f16 = float16_squash_input_denormal(input, fpst);

@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)

return extract64(estimate, 0, 8) << 44;

}

-float16 HELPER(rsqrte_f16)(float16 input, void *fpstp)

+uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)

{

float_status *s = fpstp;

float16 f16 = float16_squash_input_denormal(input, s);

2.17.1

Provide a VMSTATE_BOOL_SUB_ARRAY to go with VMSTATE_UINT8_SUB_ARRAY

and friends.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180521140402.23318-23-peter.maydell@linaro.org

include/migration/vmstate.h | 3 +++

1 file changed, 3 insertions(+)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h

--- a/include/migration/vmstate.h

+++ b/include/migration/vmstate.h

@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;

#define VMSTATE_BOOL_ARRAY(_f, _s, _n) \

VMSTATE_BOOL_ARRAY_V(_f, _s, _n, 0)

+#define VMSTATE_BOOL_SUB_ARRAY(_f, _s, _start, _num) \

+ VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_bool, bool)

+

#define VMSTATE_UINT16_ARRAY_V(_f, _s, _n, _v) \

VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_uint16, uint16_t)

2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

kvm_irqchip_create called by kvm_init will call kvm_init_irq_routing to

initialize global capability variables. If we call kvm_init_irq_routing in

GIC realize function, previous allocated memory will leak.

Fix this by deleting the unnecessary call.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527750994-14360-1-git-send-email-zhaoshenglong@huawei.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gic_kvm.c | 1 -

hw/intc/arm_gicv3_kvm.c | 1 -

2 files changed, 2 deletions(-)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c

--- a/hw/intc/arm_gic_kvm.c

+++ b/hw/intc/arm_gic_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

}

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3_kvm.c

+++ b/hw/intc/arm_gicv3_kvm.c

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)

if (kvm_has_gsi_routing()) {

/* set up irq routing */

- kvm_init_irq_routing(kvm_state);

for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {

kvm_irqchip_add_irq_route(kvm_state, i, 0, i);

}

2.17.1

From: Jan Kiszka <jan.kiszka@siemens.com>

There was a nasty flip in identifying which register group an access is

targeting. The issue caused spuriously raised priorities of the guest

when handing CPUs over in the Jailhouse hypervisor.

Cc: qemu-stable@nongnu.org

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

Message-id: 28b927d3-da58-bce4-cc13-bfec7f9b1cb9@siemens.com

hw/intc/arm_gicv3_cpuif.c | 12 ++++++------

1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

@@ -XXX,XX +XXX,XX @@ static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

uint64_t value = cs->ich_apr[grp][regno];

trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

@@ -XXX,XX +XXX,XX @@ static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

@@ -XXX,XX +XXX,XX @@ static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

uint64_t value;

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;

+ int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;

if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {

return icv_ap_read(env, ri);

@@ -XXX,XX +XXX,XX @@ static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;

+ int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;

if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {

icv_ap_write(env, ri, value);

@@ -XXX,XX +XXX,XX @@ static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

uint64_t value;

value = cs->ich_apr[grp][regno];

@@ -XXX,XX +XXX,XX @@ static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

GICv3CPUState *cs = icc_cs_from_env(env);

int regno = ri->opc2 & 3;

- int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;

+ int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;

trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);

2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

acpi_data_push uses g_array_set_size to resize the memory size. If there

is no enough contiguous memory, the address will be changed. So previous

pointer could not be used any more. It must update the pointer and use

the new one.

Also, previous codes wrongly use le32 conversion of iort->node_offset

for subsequent computations that will result incorrect value if host is

not litlle endian. So use the non-converted one instead.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 1527663951-14552-1-git-send-email-zhaoshenglong@huawei.com

hw/arm/virt-acpi-build.c | 20 +++++++++++++++-----

1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c

--- a/hw/arm/virt-acpi-build.c

+++ b/hw/arm/virt-acpi-build.c

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

AcpiIortItsGroup *its;

AcpiIortTable *iort;

AcpiIortSmmu3 *smmu;

- size_t node_size, iort_length, smmu_offset = 0;

+ size_t node_size, iort_node_offset, iort_length, smmu_offset = 0;

AcpiIortRC *rc;

iort = acpi_data_push(table_data, sizeof(*iort));

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

iort_length = sizeof(*iort);

iort->node_count = cpu_to_le32(nb_nodes);

- iort->node_offset = cpu_to_le32(sizeof(*iort));

+ /*

+ * Use a copy in case table_data->data moves during acpi_data_push

+ * operations.

+ */

+ iort_node_offset = sizeof(*iort);

+ iort->node_offset = cpu_to_le32(iort_node_offset);

/* ITS group node */

node_size = sizeof(*its) + sizeof(uint32_t);

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

int irq = vms->irqmap[VIRT_SMMU];

/* SMMUv3 node */

- smmu_offset = iort->node_offset + node_size;

+ smmu_offset = iort_node_offset + node_size;

node_size = sizeof(*smmu) + sizeof(*idmap);

iort_length += node_size;

smmu = acpi_data_push(table_data, node_size);

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

idmap->id_count = cpu_to_le32(0xFFFF);

idmap->output_base = 0;

/* output IORT node is the ITS group node (the first node) */

- idmap->output_reference = cpu_to_le32(iort->node_offset);

+ idmap->output_reference = cpu_to_le32(iort_node_offset);

/* Root Complex Node */

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

idmap->output_reference = cpu_to_le32(smmu_offset);

} else {

/* output IORT node is the ITS group node (the first node) */

- idmap->output_reference = cpu_to_le32(iort->node_offset);

+ idmap->output_reference = cpu_to_le32(iort_node_offset);

}

+ /*

+ * Update the pointer address in case table_data->data moves during above

+ * acpi_data_push operations.

+ */

+ iort = (AcpiIortTable *)(table_data->data + iort_start);

iort->length = cpu_to_le32(iort_length);

build_header(linker, table_data, (void *)(table_data->data + iort_start),

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to flatview_do_translate().

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180521140402.23318-13-peter.maydell@linaro.org

exec.c | 9 ++++++---

1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ unassigned:

* @is_write: whether the translation operation is for write

* @is_mmio: whether this can be MMIO, set true if it can

* @target_as: the address space targeted by the IOMMU

+ * @attrs: memory transaction attributes

*

* This function is called from RCU critical section

*/

@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,

hwaddr *page_mask_out,

bool is_write,

bool is_mmio,

- AddressSpace **target_as)

+ AddressSpace **target_as,

+ MemTxAttrs attrs)

{

MemoryRegionSection *section;

IOMMUMemoryRegion *iommu_mr;

@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,

* but page mask.

*/

section = flatview_do_translate(address_space_to_flatview(as), addr, &xlat,

- NULL, &page_mask, is_write, false, &as);

+ NULL, &page_mask, is_write, false, &as,

+ attrs);

/* Illegal translation */

if (section.mr == &io_mem_unassigned) {

@@ -XXX,XX +XXX,XX @@ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,

/* This can be MMIO, so setup MMIO bit. */

section = flatview_do_translate(fv, addr, xlat, plen, NULL,

- is_write, true, &as);

+ is_write, true, &as, attrs);

mr = section.mr;

if (xen_enabled() && memory_access_is_direct(mr, is_write)) {

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to address_space_translate_iommu().

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180521140402.23318-14-peter.maydell@linaro.org

exec.c | 8 +++++---

1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/exec.c b/exec.c

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x

* @is_write: whether the translation operation is for write

* @is_mmio: whether this can be MMIO, set true if it can

* @target_as: the address space targeted by the IOMMU

+ * @attrs: transaction attributes

*

* This function is called from RCU critical section. It is the common

* part of flatview_do_translate and address_space_translate_cached.

@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection address_space_translate_iommu(IOMMUMemoryRegion *iomm

hwaddr *page_mask_out,

bool is_write,

bool is_mmio,

- AddressSpace **target_as)

+ AddressSpace **target_as,

+ MemTxAttrs attrs)

{

MemoryRegionSection *section;

hwaddr page_mask = (hwaddr)-1;

@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,

return address_space_translate_iommu(iommu_mr, xlat,

plen_out, page_mask_out,

is_write, is_mmio,

- target_as);

+ target_as, attrs);

}

if (page_mask_out) {

/* Not behind an IOMMU, use default page size. */

@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate_cached(

section = address_space_translate_iommu(iommu_mr, xlat, plen,

NULL, is_write, true,

- &target_as);

+ &target_as, attrs);

return section.mr;

2.17.1

In commit f0aff255700 we made cpacr_write() enforce that some CPACR

bits are RAZ/WI and some are RAO/WI for ARMv7 cores. Unfortunately

we forgot to also update the register's reset value. The effect

was that (a) a guest that read CPACR on reset would not see ones in

the RAO bits, and (b) if you did a migration before the guest did