Commit c181ddaa authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180531-1' into staging 



target-arm queue:
 * target/arm: Honour FPCR.FZ in FRECPX
 * MAINTAINERS: Add entries for newer MPS2 boards and devices
 * hw/intc/arm_gicv3: Fix APxR<n> register dispatching
 * arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel
   GIC state
 * tcg: Fix helper function vs host abi for float16
 * arm: fix qemu crash on startup with -bios option
 * arm: fix malloc type mismatch
 * xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
 * Correct CPACR reset value for v7 cores
 * memory.h: Improve IOMMU related documentation
 * exec: Plumb transaction attributes through various functions in
   preparation for allowing IOMMUs to see them
 * vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
 * ARM: ACPI: Fix use-after-free due to memory realloc
 * KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

# gpg: Signature made Thu 31 May 2018 16:54:40 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180531-1: (25 commits)
  KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice
  ARM: ACPI: Fix use-after-free due to memory realloc
  vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
  Make address_space_translate_iommu take a MemTxAttrs argument
  Make flatview_do_translate() take a MemTxAttrs argument
  Make address_space_get_iotlb_entry() take a MemTxAttrs argument
  Make flatview_translate() take a MemTxAttrs argument
  Make flatview_access_valid() take a MemTxAttrs argument
  Make MemoryRegion valid.accepts callback take a MemTxAttrs argument
  Make memory_region_access_valid() take a MemTxAttrs argument
  Make flatview_extend_translation() take a MemTxAttrs argument
  Make address_space_access_valid() take a MemTxAttrs argument
  Make address_space_map() take a MemTxAttrs argument
  Make address_space_translate{, _cached}() take a MemTxAttrs argument
  Make tb_invalidate_phys_addr() take a MemTxAttrs argument
  memory.h: Improve IOMMU related documentation
  Correct CPACR reset value for v7 cores
  xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
  arm: fix malloc type mismatch
  arm: fix qemu crash on startup with -bios option
  ...

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents a3ac12fb 2f15b792

MAINTAINERS

+7 −2
Original line number Diff line number Diff line
@@ -447,6 +447,8 @@ F: hw/timer/cmsdk-apb-timer.c 
F: include/hw/timer/cmsdk-apb-timer.h

F: hw/char/cmsdk-apb-uart.c

F: include/hw/char/cmsdk-apb-uart.h

F: hw/misc/tz-ppc.c

F: include/hw/misc/tz-ppc.h



ARM cores

M: Peter Maydell <peter.maydell@linaro.org>
@@ -515,8 +517,11 @@ M: Peter Maydell <peter.maydell@linaro.org> 
L: qemu-arm@nongnu.org

S: Maintained

F: hw/arm/mps2.c

F: hw/misc/mps2-scc.c

F: include/hw/misc/mps2-scc.h

F: hw/arm/mps2-tz.c

F: hw/misc/mps2-*.c

F: include/hw/misc/mps2-*.h

F: hw/arm/iotkit.c

F: include/hw/arm/iotkit.h



Musicpal

M: Jan Kiszka <jan.kiszka@web.de>

accel/tcg/translate-all.c

+2 −2
Original line number Diff line number Diff line
@@ -1669,14 +1669,14 @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr) 
}



#if !defined(CONFIG_USER_ONLY)

void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)

void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)

{

    ram_addr_t ram_addr;

    MemoryRegion *mr;

    hwaddr l = 1;



    rcu_read_lock();

    mr = address_space_translate(as, addr, &addr, &l, false);

    mr = address_space_translate(as, addr, &addr, &l, false, attrs);

    if (!(memory_region_is_ram(mr)

          || memory_region_is_romd(mr))) {

        rcu_read_unlock();

exec.c

+58 −37
Original line number Diff line number Diff line
@@ -478,6 +478,7 @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x 
 * @is_write: whether the translation operation is for write

 * @is_mmio: whether this can be MMIO, set true if it can

 * @target_as: the address space targeted by the IOMMU

 * @attrs: transaction attributes

 *

 * This function is called from RCU critical section.  It is the common

 * part of flatview_do_translate and address_space_translate_cached.
@@ -488,7 +489,8 @@ static MemoryRegionSection address_space_translate_iommu(IOMMUMemoryRegion *iomm 
                                                         hwaddr *page_mask_out,

                                                         bool is_write,

                                                         bool is_mmio,

                                                         AddressSpace **target_as)

                                                         AddressSpace **target_as,

                                                         MemTxAttrs attrs)

{

    MemoryRegionSection *section;

    hwaddr page_mask = (hwaddr)-1;
@@ -541,6 +543,7 @@ unassigned: 
 * @is_write: whether the translation operation is for write

 * @is_mmio: whether this can be MMIO, set true if it can

 * @target_as: the address space targeted by the IOMMU

 * @attrs: memory transaction attributes

 *

 * This function is called from RCU critical section

 */
@@ -551,7 +554,8 @@ static MemoryRegionSection flatview_do_translate(FlatView *fv, 
                                                 hwaddr *page_mask_out,

                                                 bool is_write,

                                                 bool is_mmio,

                                                 AddressSpace **target_as)

                                                 AddressSpace **target_as,

                                                 MemTxAttrs attrs)

{

    MemoryRegionSection *section;

    IOMMUMemoryRegion *iommu_mr;
@@ -570,7 +574,7 @@ static MemoryRegionSection flatview_do_translate(FlatView *fv, 
        return address_space_translate_iommu(iommu_mr, xlat,

                                             plen_out, page_mask_out,

                                             is_write, is_mmio,

                                             target_as);

                                             target_as, attrs);

    }

    if (page_mask_out) {

        /* Not behind an IOMMU, use default page size. */
@@ -582,7 +586,7 @@ static MemoryRegionSection flatview_do_translate(FlatView *fv, 


/* Called from RCU critical section */

IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,

                                            bool is_write)

                                            bool is_write, MemTxAttrs attrs)

{

    MemoryRegionSection section;

    hwaddr xlat, page_mask;
@@ -592,7 +596,8 @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr, 
     * but page mask.

     */

    section = flatview_do_translate(address_space_to_flatview(as), addr, &xlat,

                                    NULL, &page_mask, is_write, false, &as);

                                    NULL, &page_mask, is_write, false, &as,

                                    attrs);



    /* Illegal translation */

    if (section.mr == &io_mem_unassigned) {
@@ -618,7 +623,8 @@ iotlb_fail: 


/* Called from RCU critical section */

MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,

                                 hwaddr *plen, bool is_write)

                                 hwaddr *plen, bool is_write,

                                 MemTxAttrs attrs)

{

    MemoryRegion *mr;

    MemoryRegionSection section;
@@ -626,7 +632,7 @@ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat, 


    /* This can be MMIO, so setup MMIO bit. */

    section = flatview_do_translate(fv, addr, xlat, plen, NULL,

                                    is_write, true, &as);

                                    is_write, true, &as, attrs);

    mr = section.mr;



    if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
@@ -898,7 +904,7 @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc) 
    if (phys != -1) {

        /* Locks grabbed by tb_invalidate_phys_addr */

        tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,

                                phys | (pc & ~TARGET_PAGE_MASK));

                                phys | (pc & ~TARGET_PAGE_MASK), attrs);

    }

}

#endif
@@ -2539,7 +2545,8 @@ static void notdirty_mem_write(void *opaque, hwaddr ram_addr, 
}



static bool notdirty_mem_accepts(void *opaque, hwaddr addr,

                                 unsigned size, bool is_write)

                                 unsigned size, bool is_write,

                                 MemTxAttrs attrs)

{

    return is_write;

}
@@ -2696,7 +2703,7 @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr, 
static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,

                                  const uint8_t *buf, int len);

static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,

                                  bool is_write);

                                  bool is_write, MemTxAttrs attrs);



static MemTxResult subpage_read(void *opaque, hwaddr addr, uint64_t *data,

                                unsigned len, MemTxAttrs attrs)
@@ -2762,7 +2769,8 @@ static MemTxResult subpage_write(void *opaque, hwaddr addr, 
}



static bool subpage_accepts(void *opaque, hwaddr addr,

                            unsigned len, bool is_write)

                            unsigned len, bool is_write,

                            MemTxAttrs attrs)

{

    subpage_t *subpage = opaque;

#if defined(DEBUG_SUBPAGE)
@@ -2771,7 +2779,7 @@ static bool subpage_accepts(void *opaque, hwaddr addr, 
#endif



    return flatview_access_valid(subpage->fv, addr + subpage->base,

                                 len, is_write);

                                 len, is_write, attrs);

}



static const MemoryRegionOps subpage_ops = {
@@ -2845,7 +2853,8 @@ static void readonly_mem_write(void *opaque, hwaddr addr, 
}



static bool readonly_mem_accepts(void *opaque, hwaddr addr,

                                 unsigned size, bool is_write)

                                 unsigned size, bool is_write,

                                 MemTxAttrs attrs)

{

    return is_write;

}
@@ -3149,7 +3158,7 @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr, 
        }



        l = len;

        mr = flatview_translate(fv, addr, &addr1, &l, true);

        mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);

    }



    return result;
@@ -3165,7 +3174,7 @@ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs, 
    MemTxResult result = MEMTX_OK;



    l = len;

    mr = flatview_translate(fv, addr, &addr1, &l, true);

    mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);

    result = flatview_write_continue(fv, addr, attrs, buf, len,

                                     addr1, l, mr);
@@ -3236,7 +3245,7 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr, 
        }



        l = len;

        mr = flatview_translate(fv, addr, &addr1, &l, false);

        mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);

    }



    return result;
@@ -3251,7 +3260,7 @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr, 
    MemoryRegion *mr;



    l = len;

    mr = flatview_translate(fv, addr, &addr1, &l, false);

    mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);

    return flatview_read_continue(fv, addr, attrs, buf, len,

                                  addr1, l, mr);

}
@@ -3322,7 +3331,8 @@ static inline void cpu_physical_memory_write_rom_internal(AddressSpace *as, 
    rcu_read_lock();

    while (len > 0) {

        l = len;

        mr = address_space_translate(as, addr, &addr1, &l, true);

        mr = address_space_translate(as, addr, &addr1, &l, true,

                                     MEMTXATTRS_UNSPECIFIED);



        if (!(memory_region_is_ram(mr) ||

              memory_region_is_romd(mr))) {
@@ -3457,17 +3467,17 @@ static void cpu_notify_map_clients(void) 
}



static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,

                                  bool is_write)

                                  bool is_write, MemTxAttrs attrs)

{

    MemoryRegion *mr;

    hwaddr l, xlat;



    while (len > 0) {

        l = len;

        mr = flatview_translate(fv, addr, &xlat, &l, is_write);

        mr = flatview_translate(fv, addr, &xlat, &l, is_write, attrs);

        if (!memory_access_is_direct(mr, is_write)) {

            l = memory_access_size(mr, l, addr);

            if (!memory_region_access_valid(mr, xlat, l, is_write)) {

            if (!memory_region_access_valid(mr, xlat, l, is_write, attrs)) {

                return false;

            }

        }
@@ -3479,14 +3489,15 @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len, 
}



bool address_space_access_valid(AddressSpace *as, hwaddr addr,

                                int len, bool is_write)

                                int len, bool is_write,

                                MemTxAttrs attrs)

{

    FlatView *fv;

    bool result;



    rcu_read_lock();

    fv = address_space_to_flatview(as);

    result = flatview_access_valid(fv, addr, len, is_write);

    result = flatview_access_valid(fv, addr, len, is_write, attrs);

    rcu_read_unlock();

    return result;

}
@@ -3495,7 +3506,7 @@ static hwaddr 
flatview_extend_translation(FlatView *fv, hwaddr addr,

                            hwaddr target_len,

                            MemoryRegion *mr, hwaddr base, hwaddr len,

                                 bool is_write)

                            bool is_write, MemTxAttrs attrs)

{

    hwaddr done = 0;

    hwaddr xlat;
@@ -3511,7 +3522,7 @@ flatview_extend_translation(FlatView *fv, hwaddr addr, 


        len = target_len;

        this_mr = flatview_translate(fv, addr, &xlat,

                                                   &len, is_write);

                                     &len, is_write, attrs);

        if (this_mr != mr || xlat != base + done) {

            return done;

        }
@@ -3528,7 +3539,8 @@ flatview_extend_translation(FlatView *fv, hwaddr addr, 
void *address_space_map(AddressSpace *as,

                        hwaddr addr,

                        hwaddr *plen,

                        bool is_write)

                        bool is_write,

                        MemTxAttrs attrs)

{

    hwaddr len = *plen;

    hwaddr l, xlat;
@@ -3543,7 +3555,7 @@ void *address_space_map(AddressSpace *as, 
    l = len;

    rcu_read_lock();

    fv = address_space_to_flatview(as);

    mr = flatview_translate(fv, addr, &xlat, &l, is_write);

    mr = flatview_translate(fv, addr, &xlat, &l, is_write, attrs);



    if (!memory_access_is_direct(mr, is_write)) {

        if (atomic_xchg(&bounce.in_use, true)) {
@@ -3571,7 +3583,7 @@ void *address_space_map(AddressSpace *as, 


    memory_region_ref(mr);

    *plen = flatview_extend_translation(fv, addr, len, mr, xlat,

                                             l, is_write);

                                        l, is_write, attrs);

    ptr = qemu_ram_ptr_length(mr->ram_block, xlat, plen, true);

    rcu_read_unlock();
@@ -3615,7 +3627,8 @@ void *cpu_physical_memory_map(hwaddr addr, 
                              hwaddr *plen,

                              int is_write)

{

    return address_space_map(&address_space_memory, addr, plen, is_write);

    return address_space_map(&address_space_memory, addr, plen, is_write,

                             MEMTXATTRS_UNSPECIFIED);

}



void cpu_physical_memory_unmap(void *buffer, hwaddr len,
@@ -3655,8 +3668,13 @@ int64_t address_space_cache_init(MemoryRegionCache *cache, 
    mr = cache->mrs.mr;

    memory_region_ref(mr);

    if (memory_access_is_direct(mr, is_write)) {

        /* We don't care about the memory attributes here as we're only

         * doing this if we found actual RAM, which behaves the same

         * regardless of attributes; so UNSPECIFIED is fine.

         */

        l = flatview_extend_translation(cache->fv, addr, len, mr,

                                        cache->xlat, l, is_write);

                                        cache->xlat, l, is_write,

                                        MEMTXATTRS_UNSPECIFIED);

        cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, &l, true);

    } else {

        cache->ptr = NULL;
@@ -3699,7 +3717,7 @@ void address_space_cache_destroy(MemoryRegionCache *cache) 
 */

static inline MemoryRegion *address_space_translate_cached(

    MemoryRegionCache *cache, hwaddr addr, hwaddr *xlat,

    hwaddr *plen, bool is_write)

    hwaddr *plen, bool is_write, MemTxAttrs attrs)

{

    MemoryRegionSection section;

    MemoryRegion *mr;
@@ -3718,7 +3736,7 @@ static inline MemoryRegion *address_space_translate_cached( 


    section = address_space_translate_iommu(iommu_mr, xlat, plen,

                                            NULL, is_write, true,

                                            &target_as);

                                            &target_as, attrs);

    return section.mr;

}
@@ -3733,7 +3751,8 @@ address_space_read_cached_slow(MemoryRegionCache *cache, hwaddr addr, 
    MemoryRegion *mr;



    l = len;

    mr = address_space_translate_cached(cache, addr, &addr1, &l, false);

    mr = address_space_translate_cached(cache, addr, &addr1, &l, false,

                                        MEMTXATTRS_UNSPECIFIED);

    flatview_read_continue(cache->fv,

                           addr, MEMTXATTRS_UNSPECIFIED, buf, len,

                           addr1, l, mr);
@@ -3750,7 +3769,8 @@ address_space_write_cached_slow(MemoryRegionCache *cache, hwaddr addr, 
    MemoryRegion *mr;



    l = len;

    mr = address_space_translate_cached(cache, addr, &addr1, &l, true);

    mr = address_space_translate_cached(cache, addr, &addr1, &l, true,

                                        MEMTXATTRS_UNSPECIFIED);

    flatview_write_continue(cache->fv,

                            addr, MEMTXATTRS_UNSPECIFIED, buf, len,

                            addr1, l, mr);
@@ -3848,7 +3868,8 @@ bool cpu_physical_memory_is_io(hwaddr phys_addr) 


    rcu_read_lock();

    mr = address_space_translate(&address_space_memory,

                                 phys_addr, &phys_addr, &l, false);

                                 phys_addr, &phys_addr, &l, false,

                                 MEMTXATTRS_UNSPECIFIED);



    res = !(memory_region_is_ram(mr) || memory_region_is_romd(mr));

    rcu_read_unlock();

hw/arm/boot.c

+9 −9
Original line number Diff line number Diff line
@@ -926,6 +926,15 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info) 
    static const ARMInsnFixup *primary_loader;

    AddressSpace *as = arm_boot_address_space(cpu, info);



    /* CPU objects (unlike devices) are not automatically reset on system

     * reset, so we must always register a handler to do so. If we're

     * actually loading a kernel, the handler is also responsible for

     * arranging that we start it correctly.

     */

    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

    }



    /* The board code is not supposed to set secure_board_setup unless

     * running its code in secure mode is actually possible, and KVM

     * doesn't support secure.
@@ -1143,15 +1152,6 @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info) 
        ARM_CPU(cs)->env.boot_info = info;

    }



    /* CPU objects (unlike devices) are not automatically reset on system

     * reset, so we must always register a handler to do so. If we're

     * actually loading a kernel, the handler is also responsible for

     * arranging that we start it correctly.

     */

    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {

        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));

    }



    if (!info->skip_dtb_autoload && have_dtb(info)) {

        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {

            exit(1);

hw/arm/virt-acpi-build.c

+15 −5
Original line number Diff line number Diff line
@@ -400,7 +400,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) 
    AcpiIortItsGroup *its;

    AcpiIortTable *iort;

    AcpiIortSmmu3 *smmu;

    size_t node_size, iort_length, smmu_offset = 0;

    size_t node_size, iort_node_offset, iort_length, smmu_offset = 0;

    AcpiIortRC *rc;



    iort = acpi_data_push(table_data, sizeof(*iort));
@@ -413,7 +413,12 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) 


    iort_length = sizeof(*iort);

    iort->node_count = cpu_to_le32(nb_nodes);

    iort->node_offset = cpu_to_le32(sizeof(*iort));

    /*

     * Use a copy in case table_data->data moves during acpi_data_push

     * operations.

     */

    iort_node_offset = sizeof(*iort);

    iort->node_offset = cpu_to_le32(iort_node_offset);



    /* ITS group node */

    node_size =  sizeof(*its) + sizeof(uint32_t);
@@ -429,7 +434,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) 
        int irq =  vms->irqmap[VIRT_SMMU];



        /* SMMUv3 node */

        smmu_offset = iort->node_offset + node_size;

        smmu_offset = iort_node_offset + node_size;

        node_size = sizeof(*smmu) + sizeof(*idmap);

        iort_length += node_size;

        smmu = acpi_data_push(table_data, node_size);
@@ -450,7 +455,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) 
        idmap->id_count = cpu_to_le32(0xFFFF);

        idmap->output_base = 0;

        /* output IORT node is the ITS group node (the first node) */

        idmap->output_reference = cpu_to_le32(iort->node_offset);

        idmap->output_reference = cpu_to_le32(iort_node_offset);

    }



    /* Root Complex Node */
@@ -479,9 +484,14 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms) 
        idmap->output_reference = cpu_to_le32(smmu_offset);

    } else {

        /* output IORT node is the ITS group node (the first node) */

        idmap->output_reference = cpu_to_le32(iort->node_offset);

        idmap->output_reference = cpu_to_le32(iort_node_offset);

    }



    /*

     * Update the pointer address in case table_data->data moves during above

     * acpi_data_push operations.

     */

    iort = (AcpiIortTable *)(table_data->data + iort_start);

    iort->length = cpu_to_le32(iort_length);



    build_header(linker, table_data, (void *)(table_data->data + iort_start),