target-arm queue: a smallish set of patches for rc1 tomorrow.

I've included the tcg patches because RTH has no others that

would merit a pullreq.

The following changes since commit 102ad0a80f5110483efd06877c29c4236be267f9:

Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2018-07-16' into staging (2018-07-16 15:34:38 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180716

for you to fetch changes up to 3474c98a2a2afcefa7c665f02ad2bed2a43ab0f7:

accel/tcg: Assert that tlb fill gave us a valid TLB entry (2018-07-16 17:26:01 +0100)

* accel/tcg: Use correct test when looking in victim TLB for code

* bcm2835_aux: Swap RX and TX interrupt assignments

* hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false

* hw/intc/arm_gic: Fix handling of GICD_ITARGETSR

* hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()

* aspeed: Implement write-1-{set, clear} for AST2500 strapping

* target/arm: Fix LD1W and LDFF1W (scalar plus vector)

Andrew Jeffery (1):

aspeed: Implement write-1-{set, clear} for AST2500 strapping

Guenter Roeck (1):

bcm2835_aux: Swap RX and TX interrupt assignments

Peter Maydell (4):

hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()

hw/intc/arm_gic: Fix handling of GICD_ITARGETSR

accel/tcg: Use correct test when looking in victim TLB for code

accel/tcg: Assert that tlb fill gave us a valid TLB entry

Richard Henderson (1):

target/arm: Fix LD1W and LDFF1W (scalar plus vector)

Thomas Huth (1):

hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false

include/hw/misc/aspeed_scu.h | 2 ++

accel/tcg/cputlb.c | 6 +++---

hw/arm/bcm2836.c | 2 ++

hw/char/bcm2835_aux.c | 4 ++--

hw/intc/arm_gic.c | 22 +++++++++++++++++++---

hw/misc/aspeed_scu.c | 19 +++++++++++++++++--

target/arm/sve_helper.c | 4 ++--

7 files changed, 47 insertions(+), 12 deletions(-)

In get_page_addr_code(), we were incorrectly looking in the victim

TLB for an entry which matched the target address for reads, not

for code accesses. This meant that we could hit on a victim TLB

entry that indicated that the address was readable but not

executable, and incorrectly bypass the call to tlb_fill() which

should generate the guest MMU exception. Fix this bug.

accel/tcg/cputlb.c | 2 +-

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c

--- a/accel/tcg/cputlb.c

+++ b/accel/tcg/cputlb.c

@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)

index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);

mmu_idx = cpu_mmu_index(env, true);

if (unlikely(!tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr))) {

- if (!VICTIM_TLB_HIT(addr_read, addr)) {

+ if (!VICTIM_TLB_HIT(addr_code, addr)) {

tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);

2.17.1

In commit 4b1a3e1e34ad97 we added a check for whether the TLB entry

we had following a tlb_fill had the INVALID bit set. This could

happen in some circumstances because a stale or wrong TLB entry was

pulled out of the victim cache. However, after commit

68fea038553039e (which prevents stale entries being in the victim

cache) and the previous commit (which ensures we don't incorrectly

hit in the victim cache)) this should never be possible.

Drop the check on TLB_INVALID_MASK from the "is this a TLB_RECHECK?"

condition, and instead assert that the tlb fill procedure has given

us a valid TLB entry (or longjumped out with a guest exception).

accel/tcg/cputlb.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c

--- a/accel/tcg/cputlb.c

+++ b/accel/tcg/cputlb.c

@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)

if (!VICTIM_TLB_HIT(addr_code, addr)) {

tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);

- if (unlikely((env->tlb_table[mmu_idx][index].addr_code &

- (TLB_RECHECK | TLB_INVALID_MASK)) == TLB_RECHECK)) {

+ if (unlikely(env->tlb_table[mmu_idx][index].addr_code & TLB_RECHECK)) {

* This is a TLB_RECHECK access, where the MMU protection

* covers a smaller range than a target page, and we must

2.17.1

'I' was being double-incremented; correctly within the inner loop

and incorrectly within the outer loop.

Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Tested-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180711103957.3040-1-richard.henderson@linaro.org

target/arm/sve_helper.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c

--- a/target/arm/sve_helper.c

+++ b/target/arm/sve_helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm, \

intptr_t i, oprsz = simd_oprsz(desc); \

unsigned scale = simd_data(desc); \

uintptr_t ra = GETPC(); \

- for (i = 0; i < oprsz; i++) { \

+ for (i = 0; i < oprsz; ) { \

uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3)); \

do { \

TYPEM m = 0; \

@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm, \

uintptr_t ra = GETPC(); \

bool first = true; \

mmap_lock(); \

- for (i = 0; i < oprsz; i++) { \

+ for (i = 0; i < oprsz; ) { \

uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3)); \

do { \

TYPEM m = 0; \

2.17.1