target-arm queue. This has the "plumb txattrs through various

bits of exec.c" patches, and a collection of bug fixes from

various people.

The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:

Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531

for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)

* target/arm: Honour FPCR.FZ in FRECPX

* MAINTAINERS: Add entries for newer MPS2 boards and devices

* hw/intc/arm_gicv3: Fix APxR<n> register dispatching

* arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel

GIC state

* tcg: Fix helper function vs host abi for float16

* arm: fix qemu crash on startup with -bios option

* arm: fix malloc type mismatch

* xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

* Correct CPACR reset value for v7 cores

* memory.h: Improve IOMMU related documentation

* exec: Plumb transaction attributes through various functions in

preparation for allowing IOMMUs to see them

* vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

* ARM: ACPI: Fix use-after-free due to memory realloc

* KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

Igor Mammedov (1):

arm: fix qemu crash on startup with -bios option

Jan Kiszka (1):

hw/intc/arm_gicv3: Fix APxR<n> register dispatching

Paolo Bonzini (1):

arm: fix malloc type mismatch

Peter Maydell (17):

target/arm: Honour FPCR.FZ in FRECPX

MAINTAINERS: Add entries for newer MPS2 boards and devices

Correct CPACR reset value for v7 cores

memory.h: Improve IOMMU related documentation

Make tb_invalidate_phys_addr() take a MemTxAttrs argument

Make address_space_translate{, _cached}() take a MemTxAttrs argument

Make address_space_map() take a MemTxAttrs argument

Make address_space_access_valid() take a MemTxAttrs argument

Make flatview_extend_translation() take a MemTxAttrs argument

Make memory_region_access_valid() take a MemTxAttrs argument

Make MemoryRegion valid.accepts callback take a MemTxAttrs argument

Make flatview_access_valid() take a MemTxAttrs argument

Make flatview_translate() take a MemTxAttrs argument

Make address_space_get_iotlb_entry() take a MemTxAttrs argument

Make flatview_do_translate() take a MemTxAttrs argument

Make address_space_translate_iommu take a MemTxAttrs argument

vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

Richard Henderson (1):

tcg: Fix helper function vs host abi for float16

Shannon Zhao (3):

arm_gicv3_kvm: increase clroffset accordingly

ARM: ACPI: Fix use-after-free due to memory realloc

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

include/exec/exec-all.h | 5 +-

include/exec/helper-head.h | 2 +-

include/exec/memory-internal.h | 3 +-

include/exec/memory.h | 128 +++++++++++++++++++++++++++++++++++------

include/migration/vmstate.h | 3 +

include/sysemu/dma.h | 6 +-

accel/tcg/translate-all.c | 4 +-

exec.c | 95 ++++++++++++++++++------------

hw/arm/boot.c | 18 +++---

hw/arm/virt-acpi-build.c | 20 +++++--

hw/dma/xlnx-zdma.c | 10 +++-

hw/hppa/dino.c | 3 +-

hw/intc/arm_gic_kvm.c | 1 -

hw/intc/arm_gicv3_cpuif.c | 12 ++--

hw/intc/arm_gicv3_kvm.c | 2 +-

hw/nvram/fw_cfg.c | 12 ++--

hw/s390x/s390-pci-inst.c | 3 +-

hw/scsi/esp.c | 3 +-

hw/vfio/common.c | 3 +-

hw/virtio/vhost.c | 3 +-

hw/xen/xen_pt_msi.c | 3 +-

memory.c | 12 ++--

memory_ldst.inc.c | 18 +++---

target/arm/gdbstub.c | 3 +-

target/arm/helper-a64.c | 41 +++++++------

target/arm/helper.c | 90 ++++++++++++++++-------------

target/ppc/mmu-hash64.c | 3 +-

target/riscv/helper.c | 2 +-

target/s390x/diag.c | 6 +-

target/s390x/excp_helper.c | 3 +-

target/s390x/mmu_helper.c | 3 +-

target/s390x/sigp.c | 3 +-

target/xtensa/op_helper.c | 3 +-

MAINTAINERS | 9 ++-

34 files changed, 353 insertions(+), 182 deletions(-)

In commit f0aff255700 we made cpacr_write() enforce that some CPACR

bits are RAZ/WI and some are RAO/WI for ARMv7 cores. Unfortunately

we forgot to also update the register's reset value. The effect

was that (a) a guest that read CPACR on reset would not see ones in

the RAO bits, and (b) if you did a migration before the guest did

a write to the CPACR then the migration would fail because the

destination would enforce the RAO bits and then complain that they

didn't match the zero value from the source.

Implement reset for the CPACR using a custom reset function

that just calls cpacr_write(), to avoid having to duplicate

the logic for which bits are RAO.

This bug would affect migration for TCG CPUs which are ARMv7

with VFP but without one of Neon or VFPv3.

Reported-by: Cédric Le Goater <clg@kaod.org>

Tested-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20180522173713.26282-1-peter.maydell@linaro.org

target/arm/helper.c | 10 +++++++++-

1 file changed, 9 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,

env->cp15.cpacr_el1 = value;

}

+static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)

+{

+ /* Call cpacr_write() so that we reset with the correct RAO bits set

+ * for our CPU features.

+ */

+ cpacr_write(env, ri, 0);

+}

+

static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,

bool isread)

{

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {

{ .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,

.crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,

.access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),

- .resetvalue = 0, .writefn = cpacr_write },

+ .resetfn = cpacr_reset, .writefn = cpacr_write },

REGINFO_SENTINEL

};

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to tb_invalidate_phys_addr().

Its callers either have an attrs value to hand, or don't care

and can use MEMTXATTRS_UNSPECIFIED.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180521140402.23318-3-peter.maydell@linaro.org

include/exec/exec-all.h | 5 +++--

accel/tcg/translate-all.c | 2 +-

exec.c | 2 +-

target/xtensa/op_helper.c | 3 ++-

4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h

--- a/include/exec/exec-all.h

+++ b/include/exec/exec-all.h

@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,

void tlb_set_page(CPUState *cpu, target_ulong vaddr,

hwaddr paddr, int prot,

int mmu_idx, target_ulong size);

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);

void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,

uintptr_t retaddr);

#else

@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,

uint16_t idxmap)

{

}

-static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr,

+ MemTxAttrs attrs)

{

}

#endif

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c

index XXXXXXX..XXXXXXX 100644

--- a/accel/tcg/translate-all.c

+++ b/accel/tcg/translate-all.c

@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)

}

#if !defined(CONFIG_USER_ONLY)

-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)

{

ram_addr_t ram_addr;

MemoryRegion *mr;

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)

if (phys != -1) {

/* Locks grabbed by tb_invalidate_phys_addr */

tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,

- phys | (pc & ~TARGET_PAGE_MASK));

+ phys | (pc & ~TARGET_PAGE_MASK), attrs);

#endif

diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/xtensa/op_helper.c

+++ b/target/xtensa/op_helper.c

@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_virtual_addr(CPUXtensaState *env, uint32_t vaddr)

int ret = xtensa_get_physical_addr(env, false, vaddr, 2, 0,

&paddr, &page_size, &access);

if (ret == 0) {

- tb_invalidate_phys_addr(&address_space_memory, paddr);

+ tb_invalidate_phys_addr(&address_space_memory, paddr,

+ MEMTXATTRS_UNSPECIFIED);

2.17.1

The FRECPX instructions should (like most other floating point operations)

honour the FPCR.FZ bit which specifies whether input denormals should

be flushed to zero (or FZ16 for the half-precision version).

We forgot to implement this, which doesn't affect the results (since

the calculation doesn't actually care about the mantissa bits) but did

mean we were failing to set the FPSR.IDC bit.

Message-id: 20180521172712.19930-1-peter.maydell@linaro.org

target/arm/helper-a64.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c

--- a/target/arm/helper-a64.c

+++ b/target/arm/helper-a64.c

@@ -XXX,XX +XXX,XX @@ float16 HELPER(frecpx_f16)(float16 a, void *fpstp)

return nan;

}

+ a = float16_squash_input_denormal(a, fpst);

+

val16 = float16_val(a);

sbit = 0x8000 & val16;

exp = extract32(val16, 10, 5);

@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)

return nan;

}

+ a = float32_squash_input_denormal(a, fpst);

+

val32 = float32_val(a);

sbit = 0x80000000ULL & val32;

exp = extract32(val32, 23, 8);

@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)

return nan;

}

+ a = float64_squash_input_denormal(a, fpst);

+

val64 = float64_val(a);

sbit = 0x8000000000000000ULL & val64;

exp = extract64(float64_val(a), 52, 11);

2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,

add MemTxAttrs as an argument to address_space_access_valid().

Its callers either have an attrs value to hand, or don't care

and can use MEMTXATTRS_UNSPECIFIED.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

include/exec/memory.h | 4 +++-

include/sysemu/dma.h | 3 ++-

exec.c | 3 ++-

target/s390x/diag.c | 6 ++++--

target/s390x/excp_helper.c | 3 ++-

target/s390x/mmu_helper.c | 3 ++-

target/s390x/sigp.c | 3 ++-

7 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h

--- a/include/exec/memory.h

+++ b/include/exec/memory.h

@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate(AddressSpace *as,

* @addr: address within that address space

* @len: length of the area to be checked

* @is_write: indicates the transfer direction

+ * @attrs: memory attributes

*/

-bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write);

+bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len,

+ bool is_write, MemTxAttrs attrs);

/* address_space_map: map a physical memory region into a host virtual address

*

diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h

index XXXXXXX..XXXXXXX 100644

--- a/include/sysemu/dma.h

+++ b/include/sysemu/dma.h

@@ -XXX,XX +XXX,XX @@ static inline bool dma_memory_valid(AddressSpace *as,

DMADirection dir)

return address_space_access_valid(as, addr, len,

- dir == DMA_DIRECTION_FROM_DEVICE);

+ dir == DMA_DIRECTION_FROM_DEVICE,

+ MEMTXATTRS_UNSPECIFIED);

static inline int dma_memory_rw_relaxed(AddressSpace *as, dma_addr_t addr,

diff --git a/exec.c b/exec.c

index XXXXXXX..XXXXXXX 100644

--- a/exec.c

+++ b/exec.c

@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,

bool address_space_access_valid(AddressSpace *as, hwaddr addr,

- int len, bool is_write)

+ int len, bool is_write,

+ MemTxAttrs attrs)

{

FlatView *fv;

bool result;

diff --git a/target/s390x/diag.c b/target/s390x/diag.c

index XXXXXXX..XXXXXXX 100644

--- a/target/s390x/diag.c

+++ b/target/s390x/diag.c

@@ -XXX,XX +XXX,XX @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)

return;

}

if (!address_space_access_valid(&address_space_memory, addr,

- sizeof(IplParameterBlock), false)) {

+ sizeof(IplParameterBlock), false,

+ MEMTXATTRS_UNSPECIFIED)) {

s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);

return;

}

@@ -XXX,XX +XXX,XX @@ out:

return;

}

if (!address_space_access_valid(&address_space_memory, addr,

- sizeof(IplParameterBlock), true)) {

+ sizeof(IplParameterBlock), true,

+ MEMTXATTRS_UNSPECIFIED)) {

s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);

return;

}

diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/s390x/excp_helper.c

+++ b/target/s390x/excp_helper.c

@@ -XXX,XX +XXX,XX @@ int s390_cpu_handle_mmu_fault(CPUState *cs, vaddr orig_vaddr, int size,

/* check out of RAM access */

if (!address_space_access_valid(&address_space_memory, raddr,

- TARGET_PAGE_SIZE, rw)) {

+ TARGET_PAGE_SIZE, rw,

+ MEMTXATTRS_UNSPECIFIED)) {

DPRINTF("%s: raddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,

(uint64_t)raddr, (uint64_t)ram_size);

trigger_pgm_exception(env, PGM_ADDRESSING, ILEN_AUTO);

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/s390x/mmu_helper.c

+++ b/target/s390x/mmu_helper.c

@@ -XXX,XX +XXX,XX @@ static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,

return ret;

}

if (!address_space_access_valid(&address_space_memory, pages[i],

- TARGET_PAGE_SIZE, is_write)) {

+ TARGET_PAGE_SIZE, is_write,

+ MEMTXATTRS_UNSPECIFIED)) {

trigger_access_exception(env, PGM_ADDRESSING, ILEN_AUTO, 0);

return -EFAULT;

}

diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c