target-arm queue: this time around is all small fixes

and changes.

The following changes since commit fec105c2abda8567ec15230429c41429b5ee307c:

Merge remote-tracking branch 'remotes/kraxel/tags/audio-20190828-pull-request' into staging (2019-09-03 14:03:15 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190903

for you to fetch changes up to 5e5584c89f36b302c666bc6db535fd3f7ff35ad2:

target/arm: Don't abort on M-profile exception return in linux-user mode (2019-09-03 16:20:35 +0100)

* Revert and correctly fix refactoring of unallocated_encoding()

* Take exceptions on ATS instructions when needed

* aspeed/timer: Provide back-pressure information for short periods

* memory: Remove unused memory_region_iommu_replay_all()

* hw/arm/smmuv3: Log a guest error when decoding an invalid STE

* hw/arm/smmuv3: Remove spurious error messages on IOVA invalidations

* target/arm: Fix SMMLS argument order

* hw/arm: Use ARM_CPU_TYPE_NAME() macro when appropriate

* hw/arm: Correct reference counting for creation of various objects

* includes: remove stale [smp|max]_cpus externs

* tcg/README: fix typo

* atomic_template: fix indentation in GEN_ATOMIC_HELPER

* include/exec/cpu-defs.h: fix typo

* target/arm: Free TCG temps in trans_VMOV_64_sp()

* target/arm: Don't abort on M-profile exception return in linux-user mode

Alex Bennée (2):

includes: remove stale [smp|max]_cpus externs

include/exec/cpu-defs.h: fix typo

Andrew Jeffery (1):

aspeed/timer: Provide back-pressure information for short periods

Emilio G. Cota (2):

tcg/README: fix typo s/afterwise/afterwards/

atomic_template: fix indentation in GEN_ATOMIC_HELPER

Eric Auger (3):

memory: Remove unused memory_region_iommu_replay_all()

hw/arm/smmuv3: Log a guest error when decoding an invalid STE

hw/arm/smmuv3: Remove spurious error messages on IOVA invalidations

An attempt to do an exception-return (branch to one of the magic

addresses) in linux-user mode for M-profile should behave like

a normal branch, because linux-user mode is always going to be

in 'handler' mode. This used to work, but we broke it when we added

support for the M-profile security extension in commit d02a8698d7ae2bfed.

In that commit we allowed even handler-mode calls to magic return

values to be checked for and dealt with by causing an

EXCP_EXCEPTION_EXIT exception to be taken, because this is

needed for the FNC_RETURN return-from-non-secure-function-call

handling. For system mode we added a check in do_v7m_exception_exit()

to make any spurious calls from Handler mode behave correctly, but

forgot that linux-user mode would also be affected.

How an attempted return-from-non-secure-function-call in linux-user

mode should be handled is not clear -- on real hardware it would

result in return to secure code (not to the Linux kernel) which

could then handle the error in any way it chose. For QEMU we take

the simple approach of treating this erroneous return the same way

it would be handled on a CPU without the security extensions --

treat it as a normal branch.

The upshot of all this is that for linux-user mode we should never

do any of the bx_excret magic, so the code change is simple.

This ought to be a weird corner case that only affects broken guest

code (because Linux user processes should never be attempting to do

exception returns or NS function returns), except that the code that

assigns addresses in RAM for the process and stack in our linux-user

code does not attempt to avoid this magic address range, so

legitimate code attempting to return to a trampoline routine on the

stack can fall into this case. This change fixes those programs,

but we should also look at restricting the range of memory we

use for M-profile linux-user guests to the area that would be

real RAM in hardware.

Cc: qemu-stable@nongnu.org

Reported-by: Christophe Lyon <christophe.lyon@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20190822131534.16602-1-peter.maydell@linaro.org

Fixes: https://bugs.launchpad.net/qemu/+bug/1840922

target/arm/translate.c | 21 ++++++++++++++++++++-

1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static inline void gen_bx(DisasContext *s, TCGv_i32 var)

store_cpu_field(var, thumb);

-/* Set PC and Thumb state from var. var is marked as dead.

+ * Set PC and Thumb state from var. var is marked as dead.

* For M-profile CPUs, include logic to detect exception-return

* branches and handle them. This is needed for Thumb POP/LDM to PC, LDR to PC,

* and BX reg, and no others, and happens only for code in Handler mode.

+ * The Security Extension also requires us to check for the FNC_RETURN

+ * which signals a function return from non-secure state; this can happen

+ * in both Handler and Thread mode.

+ * To avoid having to do multiple comparisons in inline generated code,

+ * we make the check we do here loose, so it will match for EXC_RETURN

+ * in Thread mode. For system emulation do_v7m_exception_exit() checks

+ * for these spurious cases and returns without doing anything (giving

+ * the same behaviour as for a branch to a non-magic address).

+ *

+ * In linux-user mode it is unclear what the right behaviour for an

+ * attempted FNC_RETURN should be, because in real hardware this will go

+ * directly to Secure code (ie not the Linux kernel) which will then treat

+ * the error in any way it chooses. For QEMU we opt to make the FNC_RETURN

+ * attempt behave the way it would on a CPU without the security extension,

+ * which is to say "like a normal branch". That means we can simply treat

+ * all branches as normal with no magic address behaviour.

*/

static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)

{

@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)

* s->base.is_jmp that we need to do the rest of the work later.

*/

gen_bx(s, var);

+#ifndef CONFIG_USER_ONLY

if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||

(s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {

s->base.is_jmp = DISAS_BX_EXCRET;

}

+#endif

}

static inline void gen_bx_excret_final_code(DisasContext *s)

From: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20190828165307.18321-10-alex.bennee@linaro.org

include/exec/cpu-defs.h | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h

--- a/include/exec/cpu-defs.h

+++ b/include/exec/cpu-defs.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUTLB { } CPUTLB;

#endif /* !CONFIG_USER_ONLY && CONFIG_TCG */

/*

- * This structure must be placed in ArchCPU immedately

+ * This structure must be placed in ArchCPU immediately

* before CPUArchState, as a field named "neg".

*/

typedef struct CPUNegativeOffsetState {

From: "Emilio G. Cota" <cota@braap.org>

Afterwise is "wise after the fact", as in "hindsight".

Here we meant "afterwards" (as in "subsequently"). Fix it.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Emilio G. Cota <cota@braap.org>

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20190828165307.18321-7-alex.bennee@linaro.org

tcg/README | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/README b/tcg/README

--- a/tcg/README

+++ b/tcg/README

@@ -XXX,XX +XXX,XX @@ This can be overridden using the following function modifiers:

canonical locations before calling the helper.

- TCG_CALL_NO_WRITE_GLOBALS means that the helper does not modify any globals.

They will only be saved to their canonical location before calling helpers,

- but they won't be reloaded afterwise.

+ but they won't be reloaded afterwards.

- TCG_CALL_NO_SIDE_EFFECTS means that the call to the function is removed if

the return value is not used.

Currently the only part of an ARMCPRegInfo which is allowed to cause

a CPU exception is the access function, which returns a value indicating

that some flavour of UNDEF should be generated.

For the ATS system instructions, we would like to conditionally

generate exceptions as part of the writefn, because some faults

during the page table walk (like external aborts) should cause

an exception to be raised rather than returning a value.

There are several ways we could do this:

* plumb the GETPC() value from the top level set_cp_reg/get_cp_reg

helper functions through into the readfn and writefn hooks

* add extra readfn_with_ra/writefn_with_ra hooks that take the GETPC()

value

* require the ATS instructions to provide a dummy accessfn,

which serves no purpose except to cause the code generation

to emit TCG ops to sync the CPU state

* add an ARM_CP_ flag to mark the ARMCPRegInfo as possibly

throwing an exception in its read/write hooks, and make the

codegen sync the CPU state before calling the hooks if the

flag is set

This patch opts for the last of these, as it is fairly simple

to implement and doesn't require invasive changes like updating

the readfn/writefn hook function prototype signature.

target/arm/cpu.h | 6 +++++-

target/arm/translate-a64.c | 6 ++++++

target/arm/translate.c | 7 +++++++

3 files changed, 18 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)

* IO indicates that this register does I/O and therefore its accesses

* need to be surrounded by gen_io_start()/gen_io_end(). In particular,

* registers which implement clocks or timers require this.

+ * RAISES_EXC is for when the read or write hook might raise an exception;

+ * the generated code will synchronize the CPU state before calling the hook

+ * so that it is safe for the hook to call raise_exception().