The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201008

for you to fetch changes up to ba118c26e16a97e6ff6de8184057d3420ce16a23:

target/arm: Make '-cpu max' have a 48-bit PA (2020-10-08 15:24:32 +0100)

* hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer

* hw/arm/fsl-imx25: Fix a typo

* hw/arm/sbsa-ref : Fix SMMUv3 Initialisation

* hw/arm/sbsa-ref : allocate IRQs for SMMUv3

* hw/char/bcm2835_aux: Allow less than 32-bit accesses

* hw/arm/virt: Implement kvm-steal-time

* target/arm: Make '-cpu max' have a 48-bit PA

Andrew Jones (6):

linux headers: sync to 5.9-rc7

target/arm/kvm: Make uncalled stubs explicitly unreachable

hw/arm/virt: Move post cpu realize check into its own function

hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init

tests/qtest: Restore aarch64 arm-cpu-features test

hw/arm/virt: Implement kvm-steal-time

Graeme Gregory (2):

hw/arm/sbsa-ref : Fix SMMUv3 Initialisation

hw/arm/sbsa-ref : allocate IRQs for SMMUv3

Peter Maydell (1):

target/arm: Make '-cpu max' have a 48-bit PA

Philippe Mathieu-Daudé (3):

hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer

hw/arm/fsl-imx25: Fix a typo

hw/char/bcm2835_aux: Allow less than 32-bit accesses

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()

>>> CID 1432730: Integer handling issues (NEGATIVE_RETURNS)

>>> "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.

162 npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()

218 cs_id = npcm7xx_fiu_cs_index(fiu, f);

219 trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,

220 size, v);

>>> CID 1432729: Integer handling issues (NEGATIVE_RETURNS)

>>> "cs_id" is passed to a parameter that cannot be negative.

221 npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an

unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>

Message-id: 20200919132435.310527-1-f4bug@amsat.org

hw/ssi/npcm7xx_fiu.c | 12 ++++++------

hw/ssi/trace-events | 2 +-

2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/npcm7xx_fiu.c

+++ b/hw/ssi/npcm7xx_fiu.c

@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {

* Returns the index of flash in the fiu->flash array. This corresponds to the

* chip select ID of the flash.

*/

-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,

+ NPCM7xxFIUFlash *flash)

{

int index = flash - fiu->flash;

@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)

}

/* Assert the chip select specified in the UMA Control/Status Register. */

-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)

+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)

{

trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);

if (cs_id < s->cs_count) {

qemu_irq_lower(s->cs_lines[cs_id]);

+ s->active_cs = cs_id;

} else {

qemu_log_mask(LOG_GUEST_ERROR,

"%s: UMA to CS%d; this module has only %d chip selects",

DEVICE(s)->canonical_path, cs_id, s->cs_count);

- cs_id = -1;

+ s->active_cs = -1;

}

- s->active_cs = cs_id;

}

/* Deassert the currently active chip select. */

@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,

NPCM7xxFIUFlash *f = opaque;

NPCM7xxFIUState *fiu = f->fiu;

uint32_t dwr_cfg;

- int cs_id;

+ unsigned cs_id;

int i;

if (fiu->active_cs != -1) {

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

--- a/hw/ssi/trace-events

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"

npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32

npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002080935.1660005-1-f4bug@amsat.org

include/hw/arm/fsl-imx25.h | 2 +-

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h

--- a/include/hw/arm/fsl-imx25.h

+++ b/include/hw/arm/fsl-imx25.h

@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {

* 0xBB00_0000 0xBB00_0FFF 4 Kbytes NAND flash main area buffer

* 0xBB00_1000 0xBB00_11FF 512 B NAND flash spare area buffer

* 0xBB00_1200 0xBB00_1DFF 3 Kbytes Reserved

- * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control regisers

+ * 0xBB00_1E00 0xBB00_1FFF 512 B NAND flash control registers

* 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved

* 0xC000_0000 0xFFFF_FFFF 1024 Mbytes Reserved

*/

From: Graeme Gregory <graeme@nuviainc.com>

SMMUv3 has an error in a previous patch where an i was transposed to a 1

meaning interrupts would not have been correctly assigned to the SMMUv3

instance.

Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")

Signed-off-by: Graeme Gregory <graeme@nuviainc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20201007100732.4103790-2-graeme@nuviainc.com

hw/arm/sbsa-ref.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);

for (i = 0; i < NUM_SMMU_IRQS; i++) {

sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,

- qdev_get_gpio_in(sms->gic, irq + 1));

+ qdev_get_gpio_in(sms->gic, irq + i));

}

From: Graeme Gregory <graeme@nuviainc.com>

Original commit did not allocate IRQs for the SMMUv3 in the irqmap

effectively using irq 0->3 (shared with other devices). Assuming

original intent was to allocate unique IRQs then add an allocation

to the irqmap.

Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Graeme Gregory <graeme@nuviainc.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20201007100732.4103790-3-graeme@nuviainc.com

hw/arm/sbsa-ref.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c

--- a/hw/arm/sbsa-ref.c

+++ b/hw/arm/sbsa-ref.c

@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {

[SBSA_SECURE_UART_MM] = 9,

[SBSA_AHCI] = 10,

[SBSA_EHCI] = 11,

+ [SBSA_SMMU] = 12, /* ... to 15 */

static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The "BCM2835 ARM Peripherals" datasheet [*] chapter 2

("Auxiliaries: UART1 & SPI1, SPI2"), list the register

sizes as 3/8/16/32 bits. We assume this means this

peripheral allows 8-bit accesses.

This was not an issue until commit 5d971f9e67 which reverted

("memory: accept mismatching sizes in memory_region_access_valid").

The model is implemented as 32-bit accesses (see commit 97398d900c,

all registers are 32-bit) so replace MemoryRegionOps.valid as

MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid

with a 8/32-bit range.

[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201002181032.1899463-1-f4bug@amsat.org

hw/char/bcm2835_aux.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c

--- a/hw/char/bcm2835_aux.c

+++ b/hw/char/bcm2835_aux.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {

.read = bcm2835_aux_read,

.write = bcm2835_aux_write,

.endianness = DEVICE_NATIVE_ENDIAN,

- .valid.min_access_size = 4,

+ .impl.min_access_size = 4,

+ .impl.max_access_size = 4,

+ .valid.min_access_size = 1,

.valid.max_access_size = 4,

From: Andrew Jones <drjones@redhat.com>

Update against Linux 5.9-rc7.

Cc: Paolo Bonzini <pbonzini@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Message-id: 20201001061718.101915-2-drjones@redhat.com

linux-headers/linux/kvm.h | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h

--- a/linux-headers/linux/kvm.h

+++ b/linux-headers/linux/kvm.h

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_VM_PPC_HV 1

#define KVM_VM_PPC_PR 2

-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */

-#define KVM_VM_MIPS_TE        0

+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */

+#define KVM_VM_MIPS_AUTO    0

#define KVM_VM_MIPS_VZ        1

+#define KVM_VM_MIPS_TE        2

#define KVM_S390_SIE_PAGE_OFFSET 1

@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {

#define KVM_CAP_LAST_CPU 184

#define KVM_CAP_SMALLER_MAXPHYADDR 185

#define KVM_CAP_S390_DIAG318 186

+#define KVM_CAP_STEAL_TIME 187

#ifdef KVM_CAP_IRQ_ROUTING