target-arm queue for 3.0:

Thomas' fixes for instrospection issues with a handful of

devices (including one microblaze one that I include in this

pullreq for convenience's sake), plus my bugfix for a

corner case of small MPU region support.

thanks

-- PMM

The following changes since commit 55b1f14cefcb19ce6d5e28c4c83404230888aa7e:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging (2018-07-23 14:03:14 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180723

for you to fetch changes up to 1ddc9b98c3cb89fe23a55ba924000fd645253e87:

hw/intc/exynos4210_gic: Turn instance_init into realize function (2018-07-23 15:21:27 +0100)

* spitz, exynos: fix bugs when introspecting some devices

* hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

* target/arm: Correctly handle overlapping small MPU regions

* hw/sd/bcm2835_sdhost: Fix PIO mode writes

Guenter Roeck (1):

hw/sd/bcm2835_sdhost: Fix PIO mode writes

Peter Maydell (1):

target/arm: Correctly handle overlapping small MPU regions

Thomas Huth (3):

hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

hw/arm/spitz: Move problematic nand_init() code to realize function

hw/intc/exynos4210_gic: Turn instance_init into realize function

hw/arm/spitz.c | 15 ++++++++++----

hw/intc/exynos4210_gic.c | 6 +++---

hw/microblaze/xlnx-zynqmp-pmu.c | 10 ++++-----

hw/sd/bcm2835_sdhost.c | 20 ++++++++++++++----

target/arm/helper.c | 46 +++++++++++++++++++++++++++++++++++++++++

5 files changed, 80 insertions(+), 17 deletions(-)

To correctly handle small (less than TARGET_PAGE_SIZE) MPU regions,

we must correctly handle the case where the address being looked

up hits in an MPU region that is not small but the address is

in the same page as a small region. For instance if MPU region

1 covers an entire page from 0x2000 to 0x2400 and MPU region

2 is small and covers only 0x2200 to 0x2280, then for an access

to 0x2000 we must not return a result covering the full page

even though we hit the page-sized region 1. Otherwise we will

then cache that result in the TLB and accesses that should

hit region 2 will incorrectly find the region 1 information.

Check for the case where we miss an MPU region but it is still

within the same page, and in that case narrow the size we will

pass to tlb_set_page_with_attrs() for whatever the final

outcome is of the MPU lookup.

Message-id: 20180716133302.25989-1-peter.maydell@linaro.org

target/arm/helper.c | 46 +++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 46 insertions(+)

@@ -XXX,XX +XXX,XX @@

#include "exec/semihost.h"

#include "sysemu/kvm.h"

#include "fpu/softfloat.h"

+#include "qemu/range.h"

#define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,

}

if (address < base || address > base + rmask) {

+ /*

+ * Address not in this region. We must check whether the

+ * region covers addresses in the same page as our address.

+ * In that case we must not report a size that covers the

+ * whole page for a subsequent hit against a different MPU

+ * region or the background region, because it would result in

+ * incorrect TLB hits for subsequent accesses to addresses that

+ * are in this MPU region.

+ */

+ if (ranges_overlap(base, rmask,

+ address & TARGET_PAGE_MASK,

+ TARGET_PAGE_SIZE)) {

+ *page_size = 1;

+ }

continue;

}

@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,

sattrs->srvalid = true;

sattrs->sregion = r;

}

+ } else {

+ /*

+ * Address not in this region. We must check whether the

+ * region covers addresses in the same page as our address.

+ * In that case we must not report a size that covers the

+ * whole page for a subsequent hit against a different MPU

+ * region or the background region, because it would result

+ * in incorrect TLB hits for subsequent accesses to

+ * addresses that are in this MPU region.

+ */

+ if (limit >= base &&

+ ranges_overlap(base, limit - base + 1,

+ addr_page_base,

+ TARGET_PAGE_SIZE)) {

+ sattrs->subpage = true;

+ }

@@ -XXX,XX +XXX,XX @@ static bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,

}

if (address < base || address > limit) {

+ /*

+ * Address not in this region. We must check whether the

+ * region covers addresses in the same page as our address.

+ * In that case we must not report a size that covers the

+ * whole page for a subsequent hit against a different MPU

+ * region or the background region, because it would result in

+ * incorrect TLB hits for subsequent accesses to addresses that

+ * are in this MPU region.

+ */

+ if (limit >= base &&

+ ranges_overlap(base, limit - base + 1,

+ addr_page_base,

+ TARGET_PAGE_SIZE)) {

+ *is_subpage = true;

+ }

continue;

}

2.17.1

From: Thomas Huth <thuth@redhat.com>

nand_init() does not only create the NAND device, it also realizes

the device with qdev_init_nofail() already. So we must not call

nand_init() from an instance_init function like sl_nand_init(),

otherwise we get superfluous NAND devices in the QOM tree after

introspecting the 'sl-nand' device. So move the nand_init() to the

realize function of 'sl-nand' instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 1532006134-7701-1-git-send-email-thuth@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/spitz.c | 15 +++++++++++----

1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c

--- a/hw/arm/spitz.c

+++ b/hw/arm/spitz.c

@@ -XXX,XX +XXX,XX @@ static void sl_nand_init(Object *obj)

{

SLNANDState *s = SL_NAND(obj);

SysBusDevice *dev = SYS_BUS_DEVICE(obj);

- DriveInfo *nand;

s->ctl = 0;

+

+ memory_region_init_io(&s->iomem, obj, &sl_ops, s, "sl", 0x40);

+ sysbus_init_mmio(dev, &s->iomem);

+}

+

+static void sl_nand_realize(DeviceState *dev, Error **errp)

+{

+ SLNANDState *s = SL_NAND(dev);

+ DriveInfo *nand;

+

/* FIXME use a qdev drive property instead of drive_get() */

nand = drive_get(IF_MTD, 0, 0);

s->nand = nand_init(nand ? blk_by_legacy_dinfo(nand) : NULL,

s->manf_id, s->chip_id);

-

- memory_region_init_io(&s->iomem, obj, &sl_ops, s, "sl", 0x40);

- sysbus_init_mmio(dev, &s->iomem);

}

/* Spitz Keyboard */

@@ -XXX,XX +XXX,XX @@ static void sl_nand_class_init(ObjectClass *klass, void *data)

dc->vmsd = &vmstate_sl_nand_info;

dc->props = sl_nand_properties;

+ dc->realize = sl_nand_realize;

/* Reason: init() method uses drive_get() */

dc->user_creatable = false;

}