Not much here, mostly documentation, but a few bug fixes.

The following changes since commit 873ec69aeb12e24eec7fb317fd0cd8494e8489dd:

Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-i2c-5' into staging (2020-07-20 11:03:09 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200720

for you to fetch changes up to 6a0b7505f1fd6769c3f1558fda76464d51e4118a:

docs/system: Document the arm virt board (2020-07-20 11:35:17 +0100)

* virt: Don't enable MTE emulation by default

* virt: Diagnose attempts to use MTE with memory-hotplug or KVM

(rather than silently not working correctly)

* util: Implement qemu_get_thread_id() for OpenBSD

* qdev: Add doc comments for qdev_unrealize and GPIO functions,

and standardize on doc-comments-in-header-file

* hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize()

* docs/system: Document canon-a1100, collie, gumstix, virt boards

David CARLIER (1):

util: Implement qemu_get_thread_id() for OpenBSD

Peter Maydell (8):

qdev: Move doc comments from qdev.c to qdev-core.h

qdev: Document qdev_unrealize()

qdev: Document GPIO related functions

hw/arm/armsse: Assert info->num_cpus is in-bounds in armsse_realize()

docs/system: Briefly document canon-a1100 board

docs/system: Briefly document collie board

docs/system: Briefly document gumstix boards

docs/system: Document the arm virt board

Richard Henderson (3):

hw/arm/virt: Enable MTE via a machine property

hw/arm/virt: Error for MTE enabled with KVM

hw/arm/virt: Disable memory hotplug when MTE is enabled

docs/system/arm/collie.rst | 16 +++

docs/system/arm/digic.rst | 11 ++

docs/system/arm/gumstix.rst | 21 ++++

docs/system/arm/virt.rst | 161 ++++++++++++++++++++++++++

docs/system/target-arm.rst | 4 +

include/hw/arm/virt.h | 1 +

include/hw/qdev-core.h | 267 ++++++++++++++++++++++++++++++++++++++++++-

include/hw/qdev-properties.h | 13 +++

hw/arm/armsse.c | 2 +

hw/arm/virt.c | 50 +++++++-

hw/core/qdev.c | 33 ------

target/arm/cpu.c | 19 +--

target/arm/cpu64.c | 5 +-

util/oslib-posix.c | 2 +

MAINTAINERS | 4 +

15 files changed, 559 insertions(+), 50 deletions(-)

create mode 100644 docs/system/arm/collie.rst

create mode 100644 docs/system/arm/digic.rst

create mode 100644 docs/system/arm/gumstix.rst

create mode 100644 docs/system/arm/virt.rst

From: Richard Henderson <richard.henderson@linaro.org>

Control this cpu feature via a machine property, much as we do

with secure=on, since both require specialized support in the

machine setup to be functional.

Default MTE to off, since this feature implies extra overhead.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200713213341.590275-2-richard.henderson@linaro.org

include/hw/arm/virt.h | 1 +

hw/arm/virt.c | 39 ++++++++++++++++++++++++++++++++++-----

target/arm/cpu.c | 19 +++++++++++--------

target/arm/cpu64.c | 5 +++--

4 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ typedef struct {

bool its;

bool virt;

bool ras;

+ bool mte;

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)

OBJECT(secure_sysmem), &error_abort);

}

- /*

- * The cpu adds the property if and only if MemTag is supported.

- * If it is, we must allocate the ram to back that up.

- */

- if (object_property_find(cpuobj, "tag-memory", NULL)) {

+ if (vms->mte) {

+ /* Create the memory region only once, but link to all cpus. */

if (!tag_sysmem) {

+ /*

+ * The property exists only if MemTag is supported.

+ * If it is, we must allocate the ram to back that up.

+ */

+ if (!object_property_find(cpuobj, "tag-memory", NULL)) {

+ error_report("MTE requested, but not supported "

+ "by the guest CPU");

+ exit(1);

+ }

+

tag_sysmem = g_new(MemoryRegion, 1);

memory_region_init(tag_sysmem, OBJECT(machine),

"tag-memory", UINT64_MAX / 32);

@@ -XXX,XX +XXX,XX @@ static void virt_set_ras(Object *obj, bool value, Error **errp)

vms->ras = value;

}

+static bool virt_get_mte(Object *obj, Error **errp)

+{

+ VirtMachineState *vms = VIRT_MACHINE(obj);

+

+ return vms->mte;

+}

+

+static void virt_set_mte(Object *obj, bool value, Error **errp)

+{

+ VirtMachineState *vms = VIRT_MACHINE(obj);

+

+ vms->mte = value;

+}

+

static char *virt_get_gic_version(Object *obj, Error **errp)

VirtMachineState *vms = VIRT_MACHINE(obj);

@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)

"Set on/off to enable/disable reporting host memory errors "

"to a KVM guest using ACPI and guest external abort exceptions");

+ /* MTE is disabled by default. */

+ vms->mte = false;

+ object_property_add_bool(obj, "mte", virt_get_mte, virt_set_mte);

+ object_property_set_description(obj, "mte",

+ "Set on/off to enable/disable emulating a "

+ "guest CPU which implements the ARM "

+ "Memory Tagging Extension");

+

vms->irqmap = a15irqmap;

virt_flash_create(vms);

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

cpu->id_pfr1 &= ~0xf000;

}

+#ifndef CONFIG_USER_ONLY

+ if (cpu->tag_memory == NULL && cpu_isar_feature(aa64_mte, cpu)) {

+ /*

+ * Disable the MTE feature bits if we do not have tag-memory

+ * provided by the machine.

+ */

+ cpu->isar.id_aa64pfr1 =

+ FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);

+ }

+#endif

+

/* MPU can be configured out of a PMSA CPU either by setting has-mpu

* to false or by setting pmsav7-dregion to 0.

*/

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

cpu_address_space_init(cs, ARMASIdx_TagS, "cpu-tag-memory",

cpu->secure_tag_memory);

}

- } else if (cpu_isar_feature(aa64_mte, cpu)) {

- /*

- * Since there is no tag memory, we can't meaningfully support MTE

- * to its fullest. To avoid problems later, when we would come to

- * use the tag memory, downgrade support to insns only.

- */

- cpu->isar.id_aa64pfr1 =

- FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 1);

}

cpu_address_space_init(cs, ARMASIdx_NS, "cpu-memory", cs->memory);

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu64.c

+++ b/target/arm/cpu64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

t = cpu->isar.id_aa64pfr1;

t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);

/*

- * Begin with full support for MTE; will be downgraded to MTE=1

- * during realize if the board provides no tag memory.

+ * Begin with full support for MTE. This will be downgraded to MTE=0

+ * during realize if the board provides no tag memory, much like

+ * we do for EL2 with the virtualization=on property.

*/

t = FIELD_DP64(t, ID_AA64PFR1, MTE, 2);

cpu->isar.id_aa64pfr1 = t;

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

While we expect KVM to support MTE at some future point,

it certainly won't be ready in time for qemu 5.1.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200713213341.590275-3-richard.henderson@linaro.org

hw/arm/virt.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)

exit(1);

}

+ if (vms->mte && kvm_enabled()) {

+ error_report("mach-virt: KVM does not support providing "

+ "MTE to the guest CPU");

+ exit(1);

+ }

create_fdt(vms);

possible_cpus = mc->possible_cpu_arch_ids(machine);

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

When MTE is enabled, tag memory must exist for all RAM.

It might be possible to simultaneously hot plug tag memory

alongside the corresponding normal memory, but for now just

disable hotplug.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200713213341.590275-4-richard.henderson@linaro.org

hw/arm/virt.c | 5 +++++

1 file changed, 5 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void virt_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,

return;

}

+ if (vms->mte) {

+ error_setg(errp, "memory hotplug is not enabled: MTE is enabled");

+ return;

+ }

+

if (is_nvdimm && !ms->nvdimms_state->is_enabled) {

error_setg(errp, "nvdimm is not enabled: add 'nvdimm=on' to '-M'");

return;

2.20.1

From: David CARLIER <devnexen@gmail.com>

Implement qemu_get_thread_id() for OpenBSD hosts, using

getthrid().

Signed-off-by: David Carlier <devnexen@gmail.com>

Reviewed-by: Brad Smith <brad@comstyle.com>

Message-id: CA+XhMqxD6gQDBaj8tX0CMEj3si7qYKsM8u1km47e_-U7MC37Pg@mail.gmail.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

[PMM: tidied up commit message]

util/oslib-posix.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/util/oslib-posix.c b/util/oslib-posix.c

--- a/util/oslib-posix.c

+++ b/util/oslib-posix.c

@@ -XXX,XX +XXX,XX @@ int qemu_get_thread_id(void)

return (int)tid;

#elif defined(__NetBSD__)

return _lwp_self();

+#elif defined(__OpenBSD__)

+ return getthrid();

#else

return getpid();

#endif

2.20.1

The doc-comments which document the qdev API are split between the

header file and the C source files, because as a project we haven't

been consistent about where we put them.

Move all the doc-comments in qdev.c to the header files, so that

users of the APIs don't have to look at the implementation files for

this information.

In the process, unify them into our doc-comment format and expand on

them in some cases to clarify expected use cases.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200711142425.16283-2-peter.maydell@linaro.org

include/hw/qdev-core.h | 57 ++++++++++++++++++++++++++++++++++++

include/hw/qdev-properties.h | 13 ++++++++

hw/core/qdev.c | 33 ---------------------

3 files changed, 70 insertions(+), 33 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h

--- a/include/hw/qdev-core.h

+++ b/include/hw/qdev-core.h

@@ -XXX,XX +XXX,XX @@ compat_props_add(GPtrArray *arr,

/*** Board API. This should go away once we have a machine config file. ***/

+/**

+ * qdev_new: Create a device on the heap

+ * @name: device type to create (we assert() that this type exists)

+ *

+ * This only allocates the memory and initializes the device state

+ * structure, ready for the caller to set properties if they wish.

+ * The device still needs to be realized.

+ * The returned object has a reference count of 1.

+ */

DeviceState *qdev_new(const char *name);

+/**

+ * qdev_try_new: Try to create a device on the heap

+ * @name: device type to create

+ *

+ * This is like qdev_new(), except it returns %NULL when type @name

+ * does not exist, rather than asserting.

+ */

DeviceState *qdev_try_new(const char *name);

+/**

+ * qdev_realize: Realize @dev.

+ * @dev: device to realize

+ * @bus: bus to plug it into (may be NULL)

+ * @errp: pointer to error object

+ *

+ * "Realize" the device, i.e. perform the second phase of device

+ * initialization.

+ * @dev must not be plugged into a bus already.

+ * If @bus, plug @dev into @bus. This takes a reference to @dev.

+ * If @dev has no QOM parent, make one up, taking another reference.

+ * On success, return true.

+ * On failure, store an error through @errp and return false.

+ *

+ * If you created @dev using qdev_new(), you probably want to use

+ * qdev_realize_and_unref() instead.

+ */

bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);

+/**

+ * qdev_realize_and_unref: Realize @dev and drop a reference

+ * @dev: device to realize

+ * @bus: bus to plug it into (may be NULL)

+ * @errp: pointer to error object

+ *

+ * Realize @dev and drop a reference.

+ * This is like qdev_realize(), except the caller must hold a

+ * (private) reference, which is dropped on return regardless of

+ * success or failure. Intended use::

+ *

+ * dev = qdev_new();

+ * [...]

+ * qdev_realize_and_unref(dev, bus, errp);

+ *

+ * Now @dev can go away without further ado.

+ *

+ * If you are embedding the device into some other QOM device and

+ * initialized it via some variant on object_initialize_child() then

+ * do not use this function, because that family of functions arrange

+ * for the only reference to the child device to be held by the parent

+ * via the child<> property, and so the reference-count-drop done here

+ * would be incorrect. For that use case you want qdev_realize().

+ */

bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp);

void qdev_unrealize(DeviceState *dev);

void qdev_set_legacy_instance_id(DeviceState *dev, int alias_id,

diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h

--- a/include/hw/qdev-properties.h

+++ b/include/hw/qdev-properties.h

@@ -XXX,XX +XXX,XX @@ void error_set_from_qdev_prop_error(Error **errp, int ret, DeviceState *dev,

*/

void qdev_property_add_static(DeviceState *dev, Property *prop);

+/**

+ * qdev_alias_all_properties: Create aliases on source for all target properties

+ * @target: Device which has properties to be aliased

+ * @source: Object to add alias properties to

+ *

+ * Add alias properties to the @source object for all qdev properties on

+ * the @target DeviceState.

+ *

+ * This is useful when @target is an internal implementation object

+ * owned by @source, and you want to expose all the properties of that

+ * implementation object as properties on the @source object so that users

+ * of @source can set them.

+ */

void qdev_alias_all_properties(DeviceState *target, Object *source);

/**

diff --git a/hw/core/qdev.c b/hw/core/qdev.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/core/qdev.c

+++ b/hw/core/qdev.c

@@ -XXX,XX +XXX,XX @@ void qdev_set_parent_bus(DeviceState *dev, BusState *bus)

}

}

-/*

- * Create a device on the heap.

- * A type @name must exist.

- * This only initializes the device state structure and allows

- * properties to be set. The device still needs to be realized. See

- * qdev-core.h.

- */

DeviceState *qdev_new(const char *name)

if (!object_class_by_name(name)) {

@@ -XXX,XX +XXX,XX @@ DeviceState *qdev_new(const char *name)

return DEVICE(object_new(name));

}

-/*

- * Try to create a device on the heap.

- * This is like qdev_new(), except it returns %NULL when type @name

- * does not exist.

- */

DeviceState *qdev_try_new(const char *name)

if (!module_object_class_by_name(name)) {

@@ -XXX,XX +XXX,XX @@ void qdev_simple_device_unplug_cb(HotplugHandler *hotplug_dev,

qdev_unrealize(dev);

-/*

- * Realize @dev.

- * @dev must not be plugged into a bus.

- * If @bus, plug @dev into @bus. This takes a reference to @dev.

- * If @dev has no QOM parent, make one up, taking another reference.

- * On success, return true.

- * On failure, store an error through @errp and return false.

- */

bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp)

{

assert(!dev->realized && !dev->parent_bus);

@@ -XXX,XX +XXX,XX @@ bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp)

return object_property_set_bool(OBJECT(dev), "realized", true, errp);

-/*

- * Realize @dev and drop a reference.

- * This is like qdev_realize(), except the caller must hold a

- * (private) reference, which is dropped on return regardless of

- * success or failure. Intended use:

- * dev = qdev_new();

- * [...]

- * qdev_realize_and_unref(dev, bus, errp);

- * Now @dev can go away without further ado.

- */

bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp)

{

bool ret;

@@ -XXX,XX +XXX,XX @@ static void qdev_class_add_property(DeviceClass *klass, Property *prop)

prop->info->description);

-/* @qdev_alias_all_properties - Add alias properties to the source object for

- * all qdev properties on the target DeviceState.

- */

void qdev_alias_all_properties(DeviceState *target, Object *source)

{

ObjectClass *class;

2.20.1

Add a doc comment for qdev_unrealize(), to go with the new

documentation for the realize part of the qdev lifecycle.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200711142425.16283-3-peter.maydell@linaro.org

include/hw/qdev-core.h | 19 +++++++++++++++++++

1 file changed, 19 insertions(+)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h

--- a/include/hw/qdev-core.h

+++ b/include/hw/qdev-core.h

@@ -XXX,XX +XXX,XX @@ bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);

* would be incorrect. For that use case you want qdev_realize().

*/

bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp);

+/**

+ * qdev_unrealize: Unrealize a device

+ * @dev: device to unrealize

+ *

+ * This function will "unrealize" a device, which is the first phase

+ * of correctly destroying a device that has been realized. It will:

+ *

+ * - unrealize any child buses by calling qbus_unrealize()

+ * (this will recursively unrealize any devices on those buses)

+ * - call the the unrealize method of @dev

+ *

+ * The device can then be freed by causing its reference count to go

+ * to zero.

+ *

+ * Warning: most devices in QEMU do not expect to be unrealized. Only

+ * devices which are hot-unpluggable should be unrealized (as part of

+ * the unplugging process); all other devices are expected to last for

+ * the life of the simulation and should not be unrealized and freed.

+ */

void qdev_unrealize(DeviceState *dev);

void qdev_set_legacy_instance_id(DeviceState *dev, int alias_id,

int required_for_version);

2.20.1

Add documentation comments for the various qdev functions

related to creating and connecting GPIO lines.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200711142425.16283-4-peter.maydell@linaro.org

include/hw/qdev-core.h | 191 ++++++++++++++++++++++++++++++++++++++++-

1 file changed, 189 insertions(+), 2 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h

--- a/include/hw/qdev-core.h

+++ b/include/hw/qdev-core.h

@@ -XXX,XX +XXX,XX @@ void qdev_simple_device_unplug_cb(HotplugHandler *hotplug_dev,

void qdev_machine_creation_done(void);

bool qdev_machine_modified(void);

+/**

+ * qdev_get_gpio_in: Get one of a device's anonymous input GPIO lines

+ * @dev: Device whose GPIO we want

+ * @n: Number of the anonymous GPIO line (which must be in range)

+ *

+ * Returns the qemu_irq corresponding to an anonymous input GPIO line

+ * (which the device has set up with qdev_init_gpio_in()). The index

+ * @n of the GPIO line must be valid (i.e. be at least 0 and less than

+ * the total number of anonymous input GPIOs the device has); this

+ * function will assert() if passed an invalid index.

+ *

+ * This function is intended to be used by board code or SoC "container"

+ * device models to wire up the GPIO lines; usually the return value

+ * will be passed to qdev_connect_gpio_out() or a similar function to

+ * connect another device's output GPIO line to this input.

+ *

+ * For named input GPIO lines, use qdev_get_gpio_in_named().

+ */

qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);

+/**

+ * qdev_get_gpio_in_named: Get one of a device's named input GPIO lines

+ * @dev: Device whose GPIO we want

+ * @name: Name of the input GPIO array

+ * @n: Number of the GPIO line in that array (which must be in range)

+ *

+ * Returns the qemu_irq corresponding to a named input GPIO line

+ * (which the device has set up with qdev_init_gpio_in_named()).

+ * The @name string must correspond to an input GPIO array which exists on

+ * the device, and the index @n of the GPIO line must be valid (i.e.

+ * be at least 0 and less than the total number of input GPIOs in that

+ * array); this function will assert() if passed an invalid name or index.

+ *

+ * For anonymous input GPIO lines, use qdev_get_gpio_in().

+ */

qemu_irq qdev_get_gpio_in_named(DeviceState *dev, const char *name, int n);

+/**

+ * qdev_connect_gpio_out: Connect one of a device's anonymous output GPIO lines

+ * @dev: Device whose GPIO to connect

+ * @n: Number of the anonymous output GPIO line (which must be in range)

+ * @pin: qemu_irq to connect the output line to

+ *

+ * This function connects an anonymous output GPIO line on a device

+ * up to an arbitrary qemu_irq, so that when the device asserts that

+ * output GPIO line, the qemu_irq's callback is invoked.

+ * The index @n of the GPIO line must be valid (i.e. be at least 0 and

+ * less than the total number of anonymous output GPIOs the device has

+ * created with qdev_init_gpio_out()); otherwise this function will assert().

+ *

+ * Outbound GPIO lines can be connected to any qemu_irq, but the common

+ * case is connecting them to another device's inbound GPIO line, using

+ * the qemu_irq returned by qdev_get_gpio_in() or qdev_get_gpio_in_named().

+ *

+ * It is not valid to try to connect one outbound GPIO to multiple

+ * qemu_irqs at once, or to connect multiple outbound GPIOs to the

+ * same qemu_irq. (Warning: there is no assertion or other guard to

+ * catch this error: the model will just not do the right thing.)

+ * Instead, for fan-out you can use the TYPE_IRQ_SPLIT device: connect

+ * a device's outbound GPIO to the splitter's input, and connect each

+ * of the splitter's outputs to a different device. For fan-in you

+ * can use the TYPE_OR_IRQ device, which is a model of a logical OR

+ * gate with multiple inputs and one output.

+ *

+ * For named output GPIO lines, use qdev_connect_gpio_out_named().

+ */

void qdev_connect_gpio_out(DeviceState *dev, int n, qemu_irq pin);

+/**

+ * qdev_connect_gpio_out: Connect one of a device's anonymous output GPIO lines

+ * @dev: Device whose GPIO to connect

+ * @name: Name of the output GPIO array

+ * @n: Number of the anonymous output GPIO line (which must be in range)

+ * @pin: qemu_irq to connect the output line to

+ *

+ * This function connects an anonymous output GPIO line on a device

+ * up to an arbitrary qemu_irq, so that when the device asserts that

+ * output GPIO line, the qemu_irq's callback is invoked.

+ * The @name string must correspond to an output GPIO array which exists on

+ * the device, and the index @n of the GPIO line must be valid (i.e.

+ * be at least 0 and less than the total number of input GPIOs in that

+ * array); this function will assert() if passed an invalid name or index.

+ *

+ * Outbound GPIO lines can be connected to any qemu_irq, but the common

+ * case is connecting them to another device's inbound GPIO line, using

+ * the qemu_irq returned by qdev_get_gpio_in() or qdev_get_gpio_in_named().

+ *

+ * It is not valid to try to connect one outbound GPIO to multiple

+ * qemu_irqs at once, or to connect multiple outbound GPIOs to the

+ * same qemu_irq; see qdev_connect_gpio_out() for details.

+ *

+ * For named output GPIO lines, use qdev_connect_gpio_out_named().

+ */

void qdev_connect_gpio_out_named(DeviceState *dev, const char *name, int n,

qemu_irq pin);

+/**

+ * qdev_get_gpio_out_connector: Get the qemu_irq connected to an output GPIO

+ * @dev: Device whose output GPIO we are interested in

+ * @name: Name of the output GPIO array

+ * @n: Number of the output GPIO line within that array

+ *

+ * Returns whatever qemu_irq is currently connected to the specified

+ * output GPIO line of @dev. This will be NULL if the output GPIO line

+ * has never been wired up to the anything. Note that the qemu_irq

+ * returned does not belong to @dev -- it will be the input GPIO or

+ * IRQ of whichever device the board code has connected up to @dev's

+ * output GPIO.

+ *

+ * You probably don't need to use this function -- it is used only

+ * by the platform-bus subsystem.

+ */

qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int n);

+/**

+ * qdev_intercept_gpio_out: Intercept an existing GPIO connection

+ * @dev: Device to intercept the outbound GPIO line from

+ * @icpt: New qemu_irq to connect instead

+ * @name: Name of the output GPIO array

+ * @n: Number of the GPIO line in the array

+ *

+ * This function is provided only for use by the qtest testing framework

+ * and is not suitable for use in non-testing parts of QEMU.

+ *

+ * This function breaks an existing connection of an outbound GPIO

+ * line from @dev, and replaces it with the new qemu_irq @icpt, as if

+ * ``qdev_connect_gpio_out_named(dev, icpt, name, n)`` had been called.

+ * The previously connected qemu_irq is returned, so it can be restored

+ * by a second call to qdev_intercept_gpio_out() if desired.

+ */

qemu_irq qdev_intercept_gpio_out(DeviceState *dev, qemu_irq icpt,

const char *name, int n);

@@ -XXX,XX +XXX,XX @@ BusState *qdev_get_child_bus(DeviceState *dev, const char *name);

/*** Device API. ***/

-/* Register device properties. */

-/* GPIO inputs also double as IRQ sinks. */

+/**

+ * qdev_init_gpio_in: create an array of anonymous input GPIO lines

+ * @dev: Device to create input GPIOs for

+ * @handler: Function to call when GPIO line value is set

+ * @n: Number of GPIO lines to create

+ *

+ * Devices should use functions in the qdev_init_gpio_in* family in

+ * their instance_init or realize methods to create any input GPIO

+ * lines they need. There is no functional difference between

+ * anonymous and named GPIO lines. Stylistically, named GPIOs are

+ * preferable (easier to understand at callsites) unless a device

+ * has exactly one uniform kind of GPIO input whose purpose is obvious.

+ * Note that input GPIO lines can serve as 'sinks' for IRQ lines.

+ *

+ * See qdev_get_gpio_in() for how code that uses such a device can get

+ * hold of an input GPIO line to manipulate it.

+ */

void qdev_init_gpio_in(DeviceState *dev, qemu_irq_handler handler, int n);

+/**

+ * qdev_init_gpio_out: create an array of anonymous output GPIO lines

+ * @dev: Device to create output GPIOs for

+ * @pins: Pointer to qemu_irq or qemu_irq array for the GPIO lines

+ * @n: Number of GPIO lines to create

+ *

+ * Devices should use functions in the qdev_init_gpio_out* family

+ * in their instance_init or realize methods to create any output

+ * GPIO lines they need. There is no functional difference between

+ * anonymous and named GPIO lines. Stylistically, named GPIOs are

+ * preferable (easier to understand at callsites) unless a device

+ * has exactly one uniform kind of GPIO output whose purpose is obvious.

+ *

+ * The @pins argument should be a pointer to either a "qemu_irq"

+ * (if @n == 1) or a "qemu_irq []" array (if @n > 1) in the device's

+ * state structure. The device implementation can then raise and

+ * lower the GPIO line by calling qemu_set_irq(). (If anything is

+ * connected to the other end of the GPIO this will cause the handler

+ * function for that input GPIO to be called.)

+ *

+ * See qdev_connect_gpio_out() for how code that uses such a device

+ * can connect to one of its output GPIO lines.

+ */

void qdev_init_gpio_out(DeviceState *dev, qemu_irq *pins, int n);

+/**

+ * qdev_init_gpio_out: create an array of named output GPIO lines

+ * @dev: Device to create output GPIOs for

+ * @pins: Pointer to qemu_irq or qemu_irq array for the GPIO lines

+ * @name: Name to give this array of GPIO lines

+ * @n: Number of GPIO lines to create

+ *

+ * Like qdev_init_gpio_out(), but creates an array of GPIO output lines

+ * with a name. Code using the device can then connect these GPIO lines

+ * using qdev_connect_gpio_out_named().

+ */

void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,

const char *name, int n);

/**

@@ -XXX,XX +XXX,XX @@ static inline void qdev_init_gpio_in_named(DeviceState *dev,

qdev_init_gpio_in_named_with_opaque(dev, handler, dev, name, n);

+/**

+ * qdev_pass_gpios: create GPIO lines on container which pass through to device

+ * @dev: Device which has GPIO lines

+ * @container: Container device which needs to expose them

+ * @name: Name of GPIO array to pass through (NULL for the anonymous GPIO array)

+ *

+ * In QEMU, complicated devices like SoCs are often modelled with a

+ * "container" QOM device which itself contains other QOM devices and

+ * which wires them up appropriately. This function allows the container

+ * to create GPIO arrays on itself which simply pass through to a GPIO

+ * array of one of its internal devices.

+ *

+ * If @dev has both input and output GPIOs named @name then both will

+ * be passed through. It is not possible to pass a subset of the array

+ * with this function.

+ *

+ * To users of the container device, the GPIO array created on @container

+ * behaves exactly like any other.

+ */

void qdev_pass_gpios(DeviceState *dev, DeviceState *container,

const char *name);

2.20.1

In armsse_realize() we have a loop over [0, info->num_cpus), which

indexes into various fixed-size arrays in the ARMSSE struct. This

confuses Coverity, which warns that we might overrun those arrays

(CID 1430326, 1430337, 1430371, 1430414, 1430430). This can't

actually happen, because the info struct is always one of the entries

in the armsse_variants[] array and num_cpus is either 1 or 2; we also

already assert in armsse_init() that num_cpus is not too large.

However, adding an assert to armsse_realize() like the one in

armsse_init() should help Coverity figure out that these code paths

aren't possible.

Message-id: 20200713143716.9881-1-peter.maydell@linaro.org

hw/arm/armsse.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c

--- a/hw/arm/armsse.c

+++ b/hw/arm/armsse.c

@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)

return;

}