I might squeeze in another pullreq before softfreeze, but the

queue was already big enough that I wanted to send this lot out now.

The following changes since commit 4abf70a661a5df3886ac9d7c19c3617fa92b922a:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-06-24' into staging (2020-07-03 15:34:45 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200703

for you to fetch changes up to 0f10bf84a9d489259a5b11c6aa1b05c1175b76ea:

Deprecate TileGX port (2020-07-03 16:59:46 +0100)

* i.MX6UL EVK board: put PHYs in the correct places

* hw/arm/virt: Let the virtio-iommu bypass MSIs

* target/arm: kvm: Handle DABT with no valid ISS

* hw/arm/virt-acpi-build: Only expose flash on older machine types

* target/arm: Fix temp double-free in sve ldr/str

* hw/display/bcm2835_fb.c: Initialize all fields of struct

* hw/arm/spitz: Code cleanup to fix Coverity-detected memory leak

* Deprecate TileGX port

Andrew Jones (4):

tests/acpi: remove stale allowed tables

tests/acpi: virt: allow DSDT acpi table changes

hw/arm/virt-acpi-build: Only expose flash on older machine types

tests/acpi: virt: update golden masters for DSDT

Beata Michalska (2):

target/arm: kvm: Handle DABT with no valid ISS

target/arm: kvm: Handle misconfigured dabt injection

Eric Auger (5):

qdev: Introduce DEFINE_PROP_RESERVED_REGION

virtio-iommu: Implement RESV_MEM probe request

virtio-iommu: Handle reserved regions in the translation process

virtio-iommu-pci: Add array of Interval properties

hw/arm/virt: Let the virtio-iommu bypass MSIs

Jean-Christophe Dubois (3):

Add a phy-num property to the i.MX FEC emulator

Add the ability to select a different PHY for each i.MX6UL FEC interface

Select MDIO device 2 and 1 as PHY devices for i.MX6UL EVK board.

Peter Maydell (19):

hw/display/bcm2835_fb.c: Initialize all fields of struct

hw/arm/spitz: Detabify

hw/arm/spitz: Create SpitzMachineClass abstract base class

hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineState

hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineState

hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signals

hw/misc/max111x: provide QOM properties for setting initial values

hw/misc/max111x: Don't use vmstate_register()

ssi: Add ssi_realize_and_unref()

hw/arm/spitz: Use max111x properties to set initial values

hw/misc/max111x: Use GPIO lines rather than max111x_set_input()

hw/misc/max111x: Create header file for documentation, TYPE_ macros

hw/arm/spitz: Encapsulate misc GPIO handling in a device

hw/gpio/zaurus.c: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/pxa2xx_pic: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Provide usual QOM macros for corgi-ssp and spitz-lcdtg

Replace uses of FROM_SSI_SLAVE() macro with QOM casts

Deprecate TileGX port

From: Jean-Christophe Dubois <jcd@tribudubois.net>

We need a solution to use an Ethernet PHY that is not the first device

on the MDIO bus (device 0 on MDIO bus).

As an example with the i.MX6UL the NXP SOC has 2 Ethernet devices but

only one MDIO bus on which the 2 related PHY are connected but at unique

addresses.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: a1a5c0e139d1c763194b8020573dcb6025daeefa.1593296112.git.jcd@tribudubois.net

include/hw/net/imx_fec.h | 1 +

hw/net/imx_fec.c | 24 +++++++++++++++++-------

hw/net/trace-events | 4 ++--

3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h

--- a/include/hw/net/imx_fec.h

+++ b/include/hw/net/imx_fec.h

@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {

uint32_t phy_advertise;

uint32_t phy_int;

uint32_t phy_int_mask;

+ uint32_t phy_num;

bool is_fec;

@@ -XXX,XX +XXX,XX @@ static void imx_phy_reset(IMXFECState *s)

static uint32_t imx_phy_read(IMXFECState *s, int reg)

uint32_t val;

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return 0;

}

+ reg %= 32;

+

switch (reg) {

case 0: /* Basic Control */

val = s->phy_control;

@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)

break;

}

- trace_imx_phy_read(val, reg);

+ trace_imx_phy_read(val, phy, reg);

return val;

}

static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)

{

- trace_imx_phy_write(val, reg);

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return;

}

+ reg %= 32;

+

+ trace_imx_phy_write(val, phy, reg);

+

switch (reg) {

case 0: /* Basic Control */

if (val & 0x8000) {

@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,

extract32(value,

18, 10)));

} else {

- /* This a write operation */

+ /* This is a write operation */

imx_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));

}

/* raise the interrupt as the PHY operation is done */

@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)

static Property imx_eth_properties[] = {

DEFINE_NIC_PROPERTIES(IMXFECState, conf),

DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),

+ DEFINE_PROP_UINT32("phy-num", IMXFECState, phy_num, 0),

DEFINE_PROP_END_OF_LIST(),

};

diff --git a/hw/net/trace-events b/hw/net/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/trace-events

+++ b/hw/net/trace-events

@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"

i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"

# imx_fec.c

-imx_phy_read(uint32_t val, int reg) "0x%04"PRIx32" <= reg[%d]"

-imx_phy_write(uint32_t val, int reg) "0x%04"PRIx32" => reg[%d]"

+imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"

+imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"

imx_phy_update_link(const char *s) "%s"

imx_phy_reset(void) ""

imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"

2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

The i.MX6UL EVK 14x14 board uses:

- PHY 2 for FEC 1

- PHY 1 for FEC 2

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: fb41992126c091a71d76ab3d1898959091f60583.1593296112.git.jcd@tribudubois.net

hw/arm/mcimx6ul-evk.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/mcimx6ul-evk.c b/hw/arm/mcimx6ul-evk.c

--- a/hw/arm/mcimx6ul-evk.c

+++ b/hw/arm/mcimx6ul-evk.c

@@ -XXX,XX +XXX,XX @@ static void mcimx6ul_evk_init(MachineState *machine)

s = FSL_IMX6UL(object_new(TYPE_FSL_IMX6UL));

object_property_add_child(OBJECT(machine), "soc", OBJECT(s));

+ object_property_set_uint(OBJECT(s), 2, "fec1-phy-num", &error_fatal);

+ object_property_set_uint(OBJECT(s), 1, "fec2-phy-num", &error_fatal);

qdev_realize(DEVICE(s), NULL, &error_fatal);

memory_region_add_subregion(get_system_memory(), FSL_IMX6UL_MMDC_ADDR,

2.20.1

From: Eric Auger <eric.auger@redhat.com>

This patch implements the PROBE request. At the moment,

only THE RESV_MEM property is handled. The first goal is

to report iommu wide reserved regions such as the MSI regions

set by the machine code. On x86 this will be the IOAPIC MSI

region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS

doorbell.

In the future we may introduce per device reserved regions.

This will be useful when protecting host assigned devices

which may expose their own reserved regions

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-3-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/virtio/virtio-iommu.h | 2 +

hw/virtio/virtio-iommu.c | 94 ++++++++++++++++++++++++++++++--

hw/virtio/trace-events | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/virtio/virtio-iommu.h

+++ b/include/hw/virtio/virtio-iommu.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOIOMMU {

GHashTable *as_by_busptr;

IOMMUPciBus *iommu_pcibus_by_bus_num[PCI_BUS_MAX];

PCIBus *primary_bus;

+ ReservedRegion *reserved_regions;

+ uint32_t nb_reserved_regions;

GTree *domains;

QemuMutex mutex;

GTree *endpoints;

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@

/* Max size */

#define VIOMMU_DEFAULT_QUEUE_SIZE 256

+#define VIOMMU_PROBE_SIZE 512

typedef struct VirtIOIOMMUDomain {

uint32_t id;

@@ -XXX,XX +XXX,XX @@ static int virtio_iommu_unmap(VirtIOIOMMU *s,

return ret;

}

+static ssize_t virtio_iommu_fill_resv_mem_prop(VirtIOIOMMU *s, uint32_t ep,

+ uint8_t *buf, size_t free)

+{

+ struct virtio_iommu_probe_resv_mem prop = {};

+ size_t size = sizeof(prop), length = size - sizeof(prop.head), total;

+ int i;

+

+ total = size * s->nb_reserved_regions;

+

+ if (total > free) {

+ return -ENOSPC;

+ }

+

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ unsigned subtype = s->reserved_regions[i].type;

+

+ assert(subtype == VIRTIO_IOMMU_RESV_MEM_T_RESERVED ||

+ subtype == VIRTIO_IOMMU_RESV_MEM_T_MSI);

+ prop.head.type = cpu_to_le16(VIRTIO_IOMMU_PROBE_T_RESV_MEM);

+ prop.head.length = cpu_to_le16(length);

+ prop.subtype = subtype;

+ prop.start = cpu_to_le64(s->reserved_regions[i].low);

+ prop.end = cpu_to_le64(s->reserved_regions[i].high);

+

+ memcpy(buf, &prop, size);

+

+ trace_virtio_iommu_fill_resv_property(ep, prop.subtype,

+ prop.start, prop.end);

+ buf += size;

+ }

+ return total;

+}

+

+/**

+ * virtio_iommu_probe - Fill the probe request buffer with

+ * the properties the device is able to return

+ */

+static int virtio_iommu_probe(VirtIOIOMMU *s,

+ struct virtio_iommu_req_probe *req,

+ uint8_t *buf)

+{

+ uint32_t ep_id = le32_to_cpu(req->endpoint);

+ size_t free = VIOMMU_PROBE_SIZE;

+ ssize_t count;

+

+ if (!virtio_iommu_mr(s, ep_id)) {

+ return VIRTIO_IOMMU_S_NOENT;

+ }

+

+ count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free);

+ if (count < 0) {

+ return VIRTIO_IOMMU_S_INVAL;

+ }

+ buf += count;

+ free -= count;

+

+ return VIRTIO_IOMMU_S_OK;

+}

+

static int virtio_iommu_iov_to_req(struct iovec *iov,

unsigned int iov_cnt,

void *req, size_t req_sz)

@@ -XXX,XX +XXX,XX @@ virtio_iommu_handle_req(detach)

virtio_iommu_handle_req(map)

virtio_iommu_handle_req(unmap)

+static int virtio_iommu_handle_probe(VirtIOIOMMU *s,

+ struct iovec *iov,

+ unsigned int iov_cnt,

+ uint8_t *buf)

+{

+ struct virtio_iommu_req_probe req;

+ int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req));

+

+ return ret ? ret : virtio_iommu_probe(s, &req, buf);

+}

+

static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

{

VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

struct virtio_iommu_req_head head;

struct virtio_iommu_req_tail tail = {};

+ size_t output_size = sizeof(tail), sz;

VirtQueueElement *elem;

unsigned int iov_cnt;

struct iovec *iov;

- size_t sz;

+ void *buf = NULL;

for (;;) {

elem = virtqueue_pop(vq, sizeof(VirtQueueElement));

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

case VIRTIO_IOMMU_T_UNMAP:

tail.status = virtio_iommu_handle_unmap(s, iov, iov_cnt);

break;

+ case VIRTIO_IOMMU_T_PROBE:

+ {

+ struct virtio_iommu_req_tail *ptail;

+

+ output_size = s->config.probe_size + sizeof(tail);

+ buf = g_malloc0(output_size);

+

+ ptail = (struct virtio_iommu_req_tail *)

+ (buf + s->config.probe_size);

+ ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);

+ }

default:

tail.status = VIRTIO_IOMMU_S_UNSUPP;

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

out:

sz = iov_from_buf(elem->in_sg, elem->in_num, 0,

- &tail, sizeof(tail));

- assert(sz == sizeof(tail));

+ buf ? buf : &tail, output_size);

+ assert(sz == output_size);

- virtqueue_push(vq, elem, sizeof(tail));

+ virtqueue_push(vq, elem, sz);

virtio_notify(vdev, vq);

g_free(elem);

+ g_free(buf);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

s->config.page_size_mask = TARGET_PAGE_MASK;

s->config.input_range.end = -1UL;

s->config.domain_range.end = 32;

+ s->config.probe_size = VIOMMU_PROBE_SIZE;

virtio_add_feature(&s->features, VIRTIO_RING_F_EVENT_IDX);

virtio_add_feature(&s->features, VIRTIO_RING_F_INDIRECT_DESC);

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MAP_UNMAP);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_BYPASS);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MMIO);

+ virtio_add_feature(&s->features, VIRTIO_IOMMU_F_PROBE);

qemu_mutex_init(&s->mutex);

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/trace-events

+++ b/hw/virtio/trace-events

@@ -XXX,XX +XXX,XX @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"

virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"

virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"

virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64

+virtio_iommu_fill_resv_property(uint32_t devid, uint8_t subtype, uint64_t start, uint64_t end) "dev= %d, type=%d start=0x%"PRIx64" end=0x%"PRIx64

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

At the moment the virtio-iommu translates MSI transactions.

This behavior is inherited from ARM SMMU. The virt machine

code knows where the guest MSI doorbells are so we can easily

declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that

setting the guest will not map MSIs through the IOMMU and those

transactions will be simply bypassed.

Depending on which MSI controller is in use (ITS or GICV2M),

we declare either:

- the ITS interrupt translation space (ITS_base + 0x10000),

containing the GITS_TRANSLATOR or

- The GICV2M single frame, containing the MSI_SETSP_NS register.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20200629070404.10969-6-eric.auger@redhat.com

include/hw/arm/virt.h | 7 +++++++

hw/arm/virt.c | 30 ++++++++++++++++++++++++++++++

2 files changed, 37 insertions(+)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {

VIRT_IOMMU_VIRTIO,

} VirtIOMMUType;

+typedef enum VirtMSIControllerType {

+ VIRT_MSI_CTRL_NONE,

+ VIRT_MSI_CTRL_GICV2M,

+ VIRT_MSI_CTRL_ITS,

+} VirtMSIControllerType;

+

typedef enum VirtGICType {

VIRT_GIC_VERSION_MAX,

VIRT_GIC_VERSION_HOST,

@@ -XXX,XX +XXX,XX @@ typedef struct {

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

+ VirtMSIControllerType msi_controller;

uint16_t virtio_iommu_bdf;

struct arm_boot_info bootinfo;

MemMapEntry *memmap;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_ITS].base);

fdt_add_its_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_ITS;

}

static void create_v2m(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)

}

fdt_add_v2m_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_GICV2M;

}

static void create_gic(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ out:

static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,

DeviceState *dev, Error **errp)

+ VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);

+

if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {

virt_memory_pre_plug(hotplug_dev, dev, errp);

+ } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {

+ hwaddr db_start = 0, db_end = 0;

+ char *resv_prop_str;

+

+ switch (vms->msi_controller) {

+ case VIRT_MSI_CTRL_NONE:

+ return;

+ case VIRT_MSI_CTRL_ITS:

+ /* GITS_TRANSLATER page */

+ db_start = base_memmap[VIRT_GIC_ITS].base + 0x10000;

+ db_end = base_memmap[VIRT_GIC_ITS].base +

+ base_memmap[VIRT_GIC_ITS].size - 1;

+ break;

+ case VIRT_MSI_CTRL_GICV2M:

+ /* MSI_SETSPI_NS page */

+ db_start = base_memmap[VIRT_GIC_V2M].base;

+ db_end = db_start + base_memmap[VIRT_GIC_V2M].size - 1;

+ break;

+ }

+ resv_prop_str = g_strdup_printf("0x%"PRIx64":0x%"PRIx64":%u",

+ db_start, db_end,

+ VIRTIO_IOMMU_RESV_MEM_T_MSI);

+

+ qdev_prop_set_uint32(dev, "len-reserved-regions", 1);

+ qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);

+ g_free(resv_prop_str);

}

2.20.1

From: Beata Michalska <beata.michalska@linaro.org>

Injecting external data abort through KVM might trigger

an issue on kernels that do not get updated to include the KVM fix.

For those and aarch32 guests, the injected abort gets misconfigured

to be an implementation defined exception. This leads to the guest

repeatedly re-running the faulting instruction.

Add support for handling that case.

[

Fixed-by: 018f22f95e8a

    ('KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests')

Fixed-by: 21aecdbd7f3a

    ('KVM: arm: Make inject_abt32() inject an external abort instead')

]

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>

Acked-by: Andrew Jones <drjones@redhat.com>

Message-id: 20200629114110.30723-3-beata.michalska@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.h | 2 ++

target/arm/kvm_arm.h | 10 +++++++++

target/arm/kvm.c | 30 ++++++++++++++++++++++++++-

target/arm/kvm32.c | 34 ++++++++++++++++++++++++++++++