Merge tag 'accel-20230628' of https://github.com/philmd/qemu into staging

Accelerators patches

- MAINTAINERS: Update Roman Bolshakov email address
- HAX: Fix a memory leak
- HAX/NVMM/WHPX/HVF: Rena

Merge tag 'accel-20230628' of https://github.com/philmd/qemu into staging

Accelerators patches

- MAINTAINERS: Update Roman Bolshakov email address
- HAX: Fix a memory leak
- HAX/NVMM/WHPX/HVF: Rename per-accel state as AccelCPUState
- KVM: Restrict specific fields from ArchCPU
- WHPX: Re-enable cross-build gitlab-ci job on case sensitive filesystems
- WHPX: Fix error message when setting ProcessorCount fails
- exec/memory: Add definitions for memory listener priorities

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmScVtkACgkQ4+MsLN6t
# wN7p8A//RXuX9gLFT35zx+5axocU3/XBbCsQWSvzzkYoXxmC/TLxvivO66NPGMc0
# C76b1FJUoLS/u9SyJUeIeYkL0rjkzARUKcRpiJXM21WM6ou8Nkz0kuI4ouowt+4K
# i/4chTjxlN5/4PKlHHcX9ZUJ9acVj01zO1BCuj/bVsxO6WMT1kjL+kplVxxFR3aW
# tlbYtUT3v4xmp94FfE2Q9lR25z4usrGnmz2rchaadlVc43kmsNcQRx+EoUdi148n
# lkViRR90sacYPX586s2yxhPpUdtrXjJmEdX0X00urdPqljkRxekHtyTqG4CRZi+K
# hG5NztK7p37GNNXZroL0gpHyr9IX6hZ3o8rmN3IiCOGU6BgQBRUhvvG2sblwcJ1A
# SSiBK4RWtgyIGWt4U6PgVj8IAu55JuqT5xR2r34fH/zccxXlp/B13vadGs7TUK15
# oHDUT4GnKL2R29lVFTl95BzsxwaMtbB9w01CLJk8va2T/97eqtFgvJyuVC9vZb0N
# 41u2RkinaQZ+hbq9TP1G21zpG0eyucEMIQ6loUd7+G3KJFjFfB4JzE2VDm0Y/OVy
# 77cEEQ67wts29fMNSqqPIQCMttDrNj7JqMMknGBQS2iHPgF+B3KjwIjnRaMBt73I
# CKPITOJPmb+kvIUsK3KlONdicEG57cBxFBTZW5+P9pJXF5izrAY=
# =b9hj
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 28 Jun 2023 05:50:49 PM CEST
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]

* tag 'accel-20230628' of https://github.com/philmd/qemu: (30 commits)
exec/memory: Add symbol for the min value of memory listener priority
exec/memory: Add symbol for memory listener priority for device backend
exec/memory: Add symbolic value for memory listener priority for accel
target/i386/WHPX: Fix error message when fail to set ProcessorCount
target/riscv: Restrict KVM-specific fields from ArchCPU
target/ppc: Restrict KVM-specific fields from ArchCPU
target/arm: Restrict KVM-specific fields from ArchCPU
hw/arm/sbsa-ref: Include missing 'sysemu/kvm.h' header
hw/intc/arm_gic: Rename 'first_cpu' argument
hw/intc/arm_gic: Un-inline GIC*/ITS class_name() helpers
accel/kvm: Declare kvm_direct_msi_allowed in stubs
accel/kvm: Re-include "exec/memattrs.h" header
accel: Rename HVF 'struct hvf_vcpu_state' -> AccelCPUState
accel: Rename 'cpu_state' -> 'cs'
accel: Inline WHPX get_whpx_vcpu()
accel: Rename WHPX 'struct whpx_vcpu' -> AccelCPUState
accel: Remove WHPX unreachable error path
accel: Inline NVMM get_qemu_vcpu()
accel: Rename NVMM 'struct qemu_vcpu' -> AccelCPUState
accel: Remove NVMM unreachable error path
...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

hw/intc/arm_gic: Un-inline GIC*/ITS class_name() helpers

"kvm_arm.h" contains external and internal prototype declarations.
Files under the hw/ directory should only access the KVM external
API.

In

hw/intc/arm_gic: Un-inline GIC*/ITS class_name() helpers

"kvm_arm.h" contains external and internal prototype declarations.
Files under the hw/ directory should only access the KVM external
API.

In order to avoid machine / device models to include "kvm_arm.h"
simply to get the QOM GIC/ITS class name, un-inline each class
name getter to the proper device model file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230405160454.97436-4-philmd@linaro.org>

show more ...

Merge tag 'pull-target-arm-20220422-1' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Implement GICv4 emulation
* Some cleanup patches in target/arm
* hw/arm/

Merge tag 'pull-target-arm-20220422-1' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Implement GICv4 emulation
* Some cleanup patches in target/arm
* hw/arm/smmuv3: Pass the actual perm to returned IOMMUTLBEntry in smmuv3_translate()

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmJisasZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3vcdEACIcvC8E93tFfeKwDQHSdPx
# 7dPCdq+EZc/xEA2U/q282PFtvNBP6zo65RzWKXTkyfE5exLkCmqJqXSIUVfiuTyT
# IAx9mL++StpBJMiqAebzEp2n8gwG7JymFeGuHYGet/nRrcwQYacBNxSl+BIVqZAm
# mUy2UOlqJDlzMAVOcs/Ikfhj0z3qa52aZ8eF6sQI3mbSggiSIWOhyzNYo7jMB1x7
# UuHlYpvYDltKT7PveA5JSuBP9OmV5RrqqO4s5c22Y+o4k+La/NURDPdegblMfRA9
# MfWAEHqjA1WQaxh/Tb4Bex1u875mFMOXMZk3P910wSeqxMLhTCmjTA2g4p1KhfcA
# LQJ5G2IvSA7HN660NLhZAqL601/1tS7Qcl387TfcU7WCDbgmzv2RCvH6UACF2hVl
# CH4bC3lKvemT324aOBs/TCnvdu54qR6hkJZ57XSn59QHvrRvrREVdYNfQnl/g751
# GTp8aMcmvTkZ8I7k2t4Tx+CoFO38+rv7PupLN+Eq4k97ovXmAWxekizv8KYu5itY
# emg63kItorwCgRwkKP28RKWLS/7dEpoF8sg5jBiBtGBGNG0AWPq4GZdrhaL58cr4
# lr4nSseN2IRsrp3SgM2203RjdghFM8ey1Dq+x2mRp+Q21vVTltI/VSiUSz0c2Vpo
# JgbC4Jo+jufMkav31zOCAg==
# =jqHX
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 22 Apr 2022 06:46:19 AM PDT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]

* tag 'pull-target-arm-20220422-1' of https://git.linaro.org/people/pmaydell/qemu-arm: (61 commits)
hw/arm/smmuv3: Pass the actual perm to returned IOMMUTLBEntry in smmuv3_translate()
target/arm: Use tcg_constant_i32 in translate.h
target/arm: Use tcg_constant in translate-vfp.c
target/arm: Use smin/smax for do_sat_addsub_32
target/arm: Use tcg_constant in translate-neon.c
target/arm: Use tcg_constant in translate-m-nocp.c
target/arm: Simplify aa32 DISAS_WFI
target/arm: Simplify gen_sar
target/arm: Simplify GEN_SHIFT in translate.c
target/arm: Split out gen_rebuild_hflags
target/arm: Split out set_btype_raw
target/arm: Remove fpexc32_access
target/arm: Change CPUArchState.thumb to bool
target/arm: Change DisasContext.thumb to bool
target/arm: Extend store_cpu_offset to take field size
target/arm: Change CPUArchState.aarch64 to bool
target/arm: Change DisasContext.aarch64 to bool
target/arm: Update SCTLR bits to ARMv9.2
target/arm: Update SCR_EL3 bits to ARMv8.8
target/arm: Update ISAR fields for ARMv8.8
...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Implement VMOVP

Implement the GICv4 VMOVP command, which updates an entry in the vPE
table to change its rdbase field. This command is unique in the ITS
command set because it

hw/intc/arm_gicv3_its: Implement VMOVP

Implement the GICv4 VMOVP command, which updates an entry in the vPE
table to change its rdbase field. This command is unique in the ITS
command set because its effects must be propagated to all the other
ITSes connected to the same GIC as the ITS which executes the VMOVP
command.

The GICv4 spec allows two implementation choices for handling the
propagation to other ITSes:
* If GITS_TYPER.VMOVP is 1, the guest only needs to issue the command
on one ITS, and the implementation handles the propagation to
all ITSes
* If GITS_TYPER.VMOVP is 0, the guest must issue the command on
every ITS, and arrange for the ITSes to synchronize the updates
with each other by setting ITSList and Sequence Number fields
in the command packets

We choose the GITS_TYPER.VMOVP = 1 approach, and synchronously
execute the update on every ITS.

For GICv4.1 this command has extra fields in the command packet and
additional behaviour. We define the 4.1-only fields with the FIELD
macro, but only implement the GICv4.0 version of the command.

Note that we don't update the reported GITS_TYPER value here;
we'll do that later in a commit which updates all the reported
feature bit and ID register values for GICv4.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220408141550.1271295-17-peter.maydell@linaro.org
[PMM: Moved gicv3_foreach_its() to arm_gicv3_its_common.h,
for consistency with gicv3_add_its()]

show more ...

hw/intc/arm_gicv3: Keep pointers to every connected ITS

The GICv4 ITS VMOVP command's semantics require it to perform the
operation on every ITS connected to the same GIC that the ITS that
received

hw/intc/arm_gicv3: Keep pointers to every connected ITS

The GICv4 ITS VMOVP command's semantics require it to perform the
operation on every ITS connected to the same GIC that the ITS that
received the command is attached to. This means that the GIC object
needs to keep a pointer to every ITS that is connected to it
(previously it was sufficient for the ITS to have a pointer to its
GIC).

Add a glib ptrarray to the GICv3 object which holds pointers to every
connected ITS, and make the ITS add itself to the array for the GIC
it is connected to when it is realized.

Note that currently all QEMU machine types with an ITS have exactly
one ITS in the system, so typically the length of this ptrarray will
be 1. Multiple ITSes are typically used to improve performance on
real hardware, so we wouldn't need to have more than one unless we
were modelling a real machine type that had multile ITSes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: Moved gicv3_add_its() to arm_gicv3_its_common.h to avoid
compilation error building the KVM ITS]
Message-id: 20220408141550.1271295-16-peter.maydell@linaro.org

show more ...

hw/intc/arm_gicv3_its: Implement GITS_BASER2 for GICv4

The GICv4 defines a new in-guest-memory table for the ITS: this is
the vPE table. Implement the new GITS_BASER2 register which the
guest uses

hw/intc/arm_gicv3_its: Implement GITS_BASER2 for GICv4

The GICv4 defines a new in-guest-memory table for the ITS: this is
the vPE table. Implement the new GITS_BASER2 register which the
guest uses to tell the ITS where the vPE table is located, including
the decode of the register fields into the TableDesc structure which
we do for the GITS_BASER<n> when the guest enables the ITS.

We guard provision of the new register with the its_feature_virtual()
function, which does a check of the GITS_TYPER.Virtual bit which
indicates presence of ITS support for virtual LPIs. Since this bit
is currently always zero, GICv4-specific features will not be
accessible to the guest yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220408141550.1271295-8-peter.maydell@linaro.org

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220208' into staging

target-arm queue:
* Fix handling of SVE ZCR_LEN when using VHE
* xlnx-zynqmp: 'Or' the QSPI / QSPI DMA IR

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220208' into staging

target-arm queue:
* Fix handling of SVE ZCR_LEN when using VHE
* xlnx-zynqmp: 'Or' the QSPI / QSPI DMA IRQs
* Don't ever enable PSCI when booting guest in EL3
* Adhere to SMCCC 1.3 section 5.2
* highbank: Fix issues with booting SMP
* midway: Fix issues booting at all
* boot: Drop existing dtb /psci node rather than retaining it
* versal-virt: Always call arm_load_kernel()
* force flag recalculation when messing with DAIF
* hw/timer/armv7m_systick: Update clock source before enabling timer
* hw/arm/smmuv3: Fix device reset
* hw/intc/arm_gicv3_its: refactorings and minor bug fixes
* hw/sensor: Add lsm303dlhc magnetometer device

# gpg: Signature made Tue 08 Feb 2022 11:39:15 GMT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20220208: (39 commits)
hw/sensor: Add lsm303dlhc magnetometer device
hw/intc/arm_gicv3_its: Split error checks
hw/intc/arm_gicv3_its: Don't allow intid 1023 in MAPI/MAPTI
hw/intc/arm_gicv3_its: In MAPC with V=0, don't check rdbase field
hw/intc/arm_gicv3_its: Drop TableDesc and CmdQDesc valid fields
hw/intc/arm_gicv3_its: Make update_ite() use ITEntry
hw/intc/arm_gicv3_its: Pass ITE values back from get_ite() via a struct
hw/intc/arm_gicv3_its: Avoid nested ifs in get_ite()
hw/intc/arm_gicv3_its: Fix address calculation in get_ite() and update_ite()
hw/intc/arm_gicv3_its: Pass CTEntry to update_cte()
hw/intc/arm_gicv3_its: Keep CTEs as a struct, not a raw uint64_t
hw/intc/arm_gicv3_its: Pass DTEntry to update_dte()
hw/intc/arm_gicv3_its: Keep DTEs as a struct, not a raw uint64_t
hw/intc/arm_gicv3_its: Use address_space_map() to access command queue packets
hw/arm/smmuv3: Fix device reset
hw/timer/armv7m_systick: Update clock source before enabling timer
arm: force flag recalculation when messing with DAIF
hw/arm: versal-virt: Always call arm_load_kernel()
hw/arm/boot: Drop existing dtb /psci node rather than retaining it
hw/arm/boot: Drop nb_cpus field from arm_boot_info
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Drop TableDesc and CmdQDesc valid fields

Currently we track in the TableDesc and CmdQDesc structs the state of
the GITS_BASER<n> and GITS_CBASER Valid bits. However we aren't

hw/intc/arm_gicv3_its: Drop TableDesc and CmdQDesc valid fields

Currently we track in the TableDesc and CmdQDesc structs the state of
the GITS_BASER<n> and GITS_CBASER Valid bits. However we aren't very
consistent abut checking the valid field: we test it in update_cte()
and update_dte(), but not anywhere else we look things up in tables.

The GIC specification says that it is UNPREDICTABLE if a guest fails
to set any of these Valid bits before enabling the ITS via
GITS_CTLR.Enabled. So we can choose to handle Valid == 0 as
equivalent to a zero-length table. This is in fact how we're already
catching this case in most of the table-access paths: when Valid is 0
we leave the num_entries fields in TableDesc or CmdQDesc set to zero,
and then the out-of-bounds check "index >= num_entries" that we have
to do anyway before doing any of these table lookups will always be
true, catching the no-valid-table case without any extra code.

So we can remove the checks on the valid field from update_cte()
and update_dte(): since these happen after the bounds check there
was never any case when the test could fail. That means the valid
fields would be entirely unused, so just remove them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220201193207.2771604-11-peter.maydell@linaro.org

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220128' into staging

target-arm queue:
* Update copyright dates to 2022
* hw/armv7m: Fix broken VMStateDescription
* hw/char/

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220128' into staging

target-arm queue:
* Update copyright dates to 2022
* hw/armv7m: Fix broken VMStateDescription
* hw/char/exynos4210_uart: Fix crash on trying to load VM state
* rtc: Move RTC function prototypes to their own header
* xlnx-versal-virt: Support PMC SLCR
* xlnx-versal-virt: Support OSPI flash memory controller
* scripts: Explain the difference between linux-headers and standard-headers
* target/arm: Log CPU index in 'Taking exception' log
* arm_gicv3_its: Various bugfixes and cleanups
* arm_gicv3_its: Implement the missing MOVI and MOVALL commands
* ast2600: Fix address mapping of second SPI controller
* target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp

# gpg: Signature made Fri 28 Jan 2022 15:29:36 GMT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20220128: (32 commits)
target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp
hw/arm: ast2600: Fix address mapping of second SPI controller
hw/intc/arm_gicv3_its: Implement MOVI
hw/intc/arm_gicv3_its: Implement MOVALL
hw/intc/arm_gicv3_its: Check table bounds against correct limit
hw/intc/arm_gicv3_its: Make GITS_BASER<n> RAZ/WI for unimplemented registers
hw/intc/arm_gicv3_its: Provide read accessor for translation_ops
hw/intc/arm_gicv3: Set GICR_CTLR.CES if LPIs are supported
hw/intc/arm_gicv3_redist: Remove unnecessary zero checks
hw/intc/arm_gicv3_its: Sort ITS command list into numeric order
hw/intc/arm_gicv3: Honour GICD_CTLR.EnableGrp1NS for LPIs
hw/intc/arm_gicv3_its: Don't clear GITS_CWRITER on writes to GITS_CBASER
hw/intc/arm_gicv3_its: Don't clear GITS_CREADR when GITS_CTLR.ENABLED is set
hw/intc/arm_gicv3: Initialise dma_as in GIC, not ITS
hw/intc/arm_gicv3_its: Add tracepoints
target/arm: Log CPU index in 'Taking exception' log
scripts: Explain the difference between linux-headers and standard-headers
MAINTAINERS: Remove myself (for raspi).
MAINTAINERS: Add an entry for Xilinx Versal OSPI
hw/arm/xlnx-versal-virt: Connect mt35xu01g flashes to the OSPI
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Check table bounds against correct limit

Currently when we fill in a TableDesc based on the value the guest
has written to the GITS_BASER<n> register, we calculate both:
* nu

hw/intc/arm_gicv3_its: Check table bounds against correct limit

Currently when we fill in a TableDesc based on the value the guest
has written to the GITS_BASER<n> register, we calculate both:
* num_entries : the number of entries in the table, constrained
by the amount of memory the guest has given it
* num_ids : the number of IDs we support for this table,
constrained by the implementation choices and the architecture
(eg DeviceIDs are 16 bits, so num_ids is 1 << 16)

When validating ITS commands, however, we check only num_ids,
thus allowing a broken guest to specify table entries that
index off the end of it. This will only corrupt guest memory,
but the ITS is supposed to reject such commands as invalid.

Instead of calculating both num_entries and num_ids, set
num_entries to the minimum of the two limits, and check that.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-13-peter.maydell@linaro.org

show more ...

Merge tag 'pull-target-arm-20220107' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
* Add missing FEAT_TLBIOS

Merge tag 'pull-target-arm-20220107' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
* Add missing FEAT_TLBIOS instructions
* arm_gicv3_its: Various bug fixes and cleanups
* kudo-bmc: Add more devices

# gpg: Signature made Fri 07 Jan 2022 09:20:24 AM PST
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]

* tag 'pull-target-arm-20220107' of https://git.linaro.org/people/pmaydell/qemu-arm:
hw/arm: kudo add lm75s on bus 13
hw/arm: add i2c muxes to kudo-bmc
hw/arm: attach MMC to kudo-bmc
hw/arm: Add kudo i2c eeproms.
hw/intc/arm_gicv3_its: Rename max_l2_entries to num_l2_entries
hw/intc/arm_gicv3_its: Fix various off-by-one errors
hw/intc/arm_gicv3_its: Use FIELD macros for CTEs
hw/intc/arm_gicv3_its: Correct comment about CTE RDBase field size
hw/intc/arm_gicv3_its: Use FIELD macros for DTEs
hw/intc/arm_gicv3_its: Correct handling of MAPI
hw/intc/arm_gicv3_its: Don't misuse GITS_TYPE_PHYSICAL define
hw/intc/arm_gicv3_its: Correct setting of TableDesc entry_sz
hw/intc/arm_gicv3_its: Reduce code duplication in extract_table_params()
hw/intc/arm_gicv3_its: Don't return early in extract_table_params() loop
hw/intc/arm_gicv3_its: Remove maxids union from TableDesc
hw/intc/arm_gicv3_its: Remove redundant ITS_CTLR_ENABLED define
hw/intc/arm_gicv3_its: Correct off-by-one bounds check on rdbase
target/arm: Add missing FEAT_TLBIOS instructions
Add dummy Aspeed AST2600 Display Port MCU (DPMCU)

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Fix various off-by-one errors

The ITS code has to check whether various parameters passed in
commands are in-bounds, where the limit is defined in terms of the
number of bits

hw/intc/arm_gicv3_its: Fix various off-by-one errors

The ITS code has to check whether various parameters passed in
commands are in-bounds, where the limit is defined in terms of the
number of bits that are available for the parameter. (For example,
the GITS_TYPER.Devbits ID register field specifies the number of
DeviceID bits minus 1, and device IDs passed in the MAPTI and MAPD
command packets must fit in that many bits.)

Currently we have off-by-one bugs in many of these bounds checks.
The typical problem is that we define a max_foo as 1 << n. In
the Devbits example, we set
s->dt.max_ids = 1UL << (GITS_TYPER.Devbits + 1).
However later when we do the bounds check we write
if (devid > s->dt.max_ids) { /* command error */ }
which incorrectly permits a devid of 1 << n.

These bugs will not cause QEMU crashes because the ID values being
checked are only used for accesses into tables held in guest memory
which we access with address_space_*() functions, but they are
incorrect behaviour of our emulation.

Fix them by standardizing on this pattern:
* bounds limits are named num_foos and are the 2^n value
(equal to the number of valid foo values)
* bounds checks are either
if (fooid < num_foos) { good }
or
if (fooid >= num_foos) { bad }

In this commit we fix the handling of the number of IDs
in the device table and the collection table, and the number
of commands that will fit in the command queue.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Remove maxids union from TableDesc

The TableDesc struct defines properties of the in-guest-memory tables
which the guest tells us about by writing to the GITS_BASER<n>
registe

hw/intc/arm_gicv3_its: Remove maxids union from TableDesc

The TableDesc struct defines properties of the in-guest-memory tables
which the guest tells us about by writing to the GITS_BASER<n>
registers. This struct currently has a union 'maxids', but all the
fields of the union have the same type (uint32_t) and do the same
thing (record one-greater-than the maximum ID value that can be used
as an index into the table).

We're about to add another table type (the GICv4 vPE table); rather
than adding another specifically-named union field for that table
type with the same type as the other union fields, remove the union
entirely and just have a 'uint32_t max_ids' struct field.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210913-3' into staging

target-arm queue:
* mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
line user-creat

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210913-3' into staging

target-arm queue:
* mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
line user-created devices are not plugged into them
* Take an exception if PSTATE.IL is set
* Support an emulated ITS in the virt board
* Add support for kudo-bmc board
* Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
* cadence_uart: Fix clock handling issues that prevented
u-boot from running

# gpg: Signature made Mon 13 Sep 2021 21:04:52 BST
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20210913-3: (23 commits)
hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
qdev: Support marking individual buses as 'full'
target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
target/arm: Take an exception if PSTATE.IL is set
tests/data/acpi/virt: Update IORT files for ITS
hw/arm/virt: add ITS support in virt GIC
tests/data/acpi/virt: Add IORT files for ITS
hw/intc: GICv3 redistributor ITS processing
hw/intc: GICv3 ITS Feature enablement
hw/intc: GICv3 ITS Command processing
hw/intc: GICv3 ITS command queue framework
hw/intc: GICv3 ITS register definitions added
hw/intc: GICv3 ITS initial framework
hw/arm: Add support for kudo-bmc board.
hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
hw/char: cadence_uart: Convert to memop_with_attrs() ops
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc: GICv3 ITS register definitions added

Defined descriptors for ITS device table,collection table and ITS
command queue entities.Implemented register read/write functions,
extract ITS table pa

hw/intc: GICv3 ITS register definitions added

Defined descriptors for ITS device table,collection table and ITS
command queue entities.Implemented register read/write functions,
extract ITS table parameters and command queue parameters,extended
gicv3 common to capture qemu address space(which host the ITS table
platform memories required for subsequent ITS processing) and
initialize the same in ITS device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc: GICv3 ITS initial framework

Added register definitions relevant to ITS,implemented overall
ITS device framework with stubs for ITS control and translater
regions read/write,extended ITS com

hw/intc: GICv3 ITS initial framework

Added register definitions relevant to ITS,implemented overall
ITS device framework with stubs for ITS control and translater
regions read/write,extended ITS common to handle mmio init between
existing kvm device and newer qemu device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging

QOM boilerplate cleanup

Documentation build fix:
* memory: Remove kernel-doc comment marker (Eduardo Habk

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging

QOM boilerplate cleanup

Documentation build fix:
* memory: Remove kernel-doc comment marker (Eduardo Habkost)

QOM cleanups:
* Rename QOM macros for consistency between
TYPE_* and type checking constants (Eduardo Habkost)

QOM new macros:
* OBJECT_DECLARE_* and OBJECT_DEFINE_* macros (Daniel P. Berrangé)
* DECLARE_*_CHECKER macros (Eduardo Habkost)

Automated QOM boilerplate changes:
* Automated changes to use DECLARE_*_CHECKER (Eduardo Habkost
* Automated changes to use OBJECT_DECLARE* (Eduardo Habkost)

# gpg: Signature made Thu 10 Sep 2020 19:17:49 BST
# gpg: using RSA key 5A322FD5ABC4D3DBACCFD1AA2807936F984DC5A6
# gpg: issuer "ehabkost@redhat.com"
# gpg: Good signature from "Eduardo Habkost <ehabkost@redhat.com>" [full]
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF D1AA 2807 936F 984D C5A6

* remotes/ehabkost/tags/machine-next-pull-request: (33 commits)
virtio-vga: Use typedef name for instance_size
vhost-user-vga: Use typedef name for instance_size
xilinx_axienet: Use typedef name for instance_size
lpc_ich9: Use typedef name for instance_size
omap_intc: Use typedef name for instance_size
xilinx_axidma: Use typedef name for instance_size
tusb6010: Rename TUSB to TUSB6010
pc87312: Rename TYPE_PC87312_SUPERIO to TYPE_PC87312
vfio: Rename PCI_VFIO to VFIO_PCI
usb: Rename USB_SERIAL_DEV to USB_SERIAL
sabre: Rename SABRE_DEVICE to SABRE
rs6000_mc: Rename RS6000MC_DEVICE to RS6000MC
filter-rewriter: Rename FILTER_COLO_REWRITER to FILTER_REWRITER
esp: Rename ESP_STATE to ESP
ahci: Rename ICH_AHCI to ICH9_AHCI
vmgenid: Rename VMGENID_DEVICE to TYPE_VMGENID
vfio: Rename VFIO_AP_DEVICE_TYPE to TYPE_VFIO_AP_DEVICE
dev-smartcard-reader: Rename CCID_DEV_NAME to TYPE_USB_CCID_DEV
ap-device: Rename AP_DEVICE_TYPE to TYPE_AP_DEVICE
gpex: Fix type checking function name
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Use DECLARE_*CHECKER* macros

Generated using:

$ ./scripts/codeconverter/converter.py -i \
--pattern=TypeCheckMacro $(git grep -l '' -- '*.[ch]')

Reviewed-by: Daniel P. Berrangé <berrange@redha

Use DECLARE_*CHECKER* macros

Generated using:

$ ./scripts/codeconverter/converter.py -i \
--pattern=TypeCheckMacro $(git grep -l '' -- '*.[ch]')

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20200831210740.126168-12-ehabkost@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20200831210740.126168-13-ehabkost@redhat.com>
Message-Id: <20200831210740.126168-14-ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

show more ...

Move QOM typedefs and add missing includes

Some typedefs and macros are defined after the type check macros.
This makes it difficult to automatically replace their
definitions with OBJECT_DECLARE_TY

Move QOM typedefs and add missing includes

Some typedefs and macros are defined after the type check macros.
This makes it difficult to automatically replace their
definitions with OBJECT_DECLARE_TYPE.

Patch generated using:

$ ./scripts/codeconverter/converter.py -i \
--pattern=QOMStructTypedefSplit $(git grep -l '' -- '*.[ch]')

which will split "typdef struct { ... } TypedefName"
declarations.

Followed by:

$ ./scripts/codeconverter/converter.py -i --pattern=MoveSymbols \
$(git grep -l '' -- '*.[ch]')

which will:
- move the typedefs and #defines above the type check macros
- add missing #include "qom/object.h" lines if necessary

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20200831210740.126168-9-ehabkost@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20200831210740.126168-10-ehabkost@redhat.com>
Message-Id: <20200831210740.126168-11-ehabkost@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20170613' into staging

target-arm queue:
* vITS: Support save/restore
* timer/aspeed: Fix timer enablement when reload is not se

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20170613' into staging

target-arm queue:
* vITS: Support save/restore
* timer/aspeed: Fix timer enablement when reload is not set
* aspped: add temperature sensor device
* timer.h: Provide better monotonic time on ARM hosts
* exynos4210: various cleanups
* exynos4210: support system poweroff

# gpg: Signature made Tue 13 Jun 2017 15:05:49 BST
# gpg: using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20170613:
hw/intc/arm_gicv3_its: Allow save/restore
hw/intc/arm_gicv3_kvm: Implement pending table save
hw/intc/arm_gicv3_its: Implement state save/restore
kvm-all: Pass an error object to kvm_device_access
timer/aspeed: fix timer enablement when a reload is not set
aspeed: add a temp sensor device on I2C bus 3
hw/misc: add a TMP42{1, 2, 3} device model
timer.h: Provide better monotonic time
hw/misc/exynos4210_pmu: Add support for system poweroff
hw/intc/exynos4210_gic: Constify array of combiner interrupts
hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
hw/arm/exynos: Declare local variables in some order
hw/arm/exynos: Move DRAM initialization next boards
hw/timer/exynos4210_mct: Remove unused defines
hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
hw/timer/exynos4210_mct: Fix checkpatch style errors
hw/intc/exynos4210_gic: Use more meaningful name for local variable

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Implement state save/restore

We need to handle both registers and ITS tables. While
register handling is standard, ITS table handling is more
challenging since the kernel API

hw/intc/arm_gicv3_its: Implement state save/restore

We need to handle both registers and ITS tables. While
register handling is standard, ITS table handling is more
challenging since the kernel API is devised so that the
tables are flushed into guest RAM and not in vmstate buffers.

Flushing the ITS tables on device pre_save() is too late
since the guest RAM is already saved at this point.

Table flushing needs to happen when we are sure the vcpus
are stopped and before the last dirty page saving. The
right point is RUN_STATE_FINISH_MIGRATE but sometimes the
VM gets stopped before migration launch so let's simply
flush the tables each time the VM gets stopped.

For regular ITS registers we just can use vmstate pre_save()
and post_load() callbacks.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20161004' into staging

target-arm queue:
* Netduino 2 improvements (SPI, ADC devices)
* fix some Mainstone key mappings
* vmsta

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20161004' into staging

target-arm queue:
* Netduino 2 improvements (SPI, ADC devices)
* fix some Mainstone key mappings
* vmstateify tsc210x, tsc2005
* virt: add 2.8 machine type
* virt: support in-kernel GICv3 ITS
* generic-loader device
* A64: fix iss_sf decoding in disas_ld_lit
* correctly handle 'sub pc, pc, 1' for ARMv6

# gpg: Signature made Tue 04 Oct 2016 13:41:34 BST
# gpg: using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg: aka "Peter Maydell <pmaydell@gmail.com>"
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20161004: (27 commits)
target-arm: Correctly handle 'sub pc, pc, 1' for ARMv6
target-arm: A64: Fix decoding of iss_sf in disas_ld_lit
cadence_gem: Fix priority queue out of bounds access
docs: Add a generic loader explanation document
generic-loader: Add a generic loader
ARM: Virt: ACPI: Add GIC ITS description in ACPI MADT table
ACPI: Add GIC Interrupt Translation Service Structure definition
arm/virt: Add ITS to the virt board
hw/intc/arm_gicv3_its: Implement support for in-kernel ITS emulation
kvm-all: Pass requester ID to MSI routing functions
target-arm: move gicv3_class_name from machine to kvm_arm.h
hw/intc/arm_gicv3_its: Implement ITS base class
hw/intc/arm_gic(v3)_kvm: Initialize gsi routing
hw/arm/virt: add 2.8 machine type
vmstateify tsc210x
vmstateify tsc2005
hw/arm: Fix Integrator/CM initialization
mainstone: Add mapping for dot, slash and backspace.
mainstone: Fix incorrect key mapping for Enter key.
MAINTAINERS: Add Alistair to the maintainers list
...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/intc/arm_gicv3_its: Implement ITS base class

This is the basic skeleton for both KVM and software-emulated ITS.
Since we already prepare status structure, we also introduce complete
VMState descr

hw/intc/arm_gicv3_its: Implement ITS base class

This is the basic skeleton for both KVM and software-emulated ITS.
Since we already prepare status structure, we also introduce complete
VMState description. But, because we currently have no migratable
implementations, we also set unmigratable flag.

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1474616617-366-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...