I might squeeze in another pullreq before softfreeze, but the

queue was already big enough that I wanted to send this lot out now.

The following changes since commit 4abf70a661a5df3886ac9d7c19c3617fa92b922a:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-06-24' into staging (2020-07-03 15:34:45 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200703

for you to fetch changes up to 0f10bf84a9d489259a5b11c6aa1b05c1175b76ea:

Deprecate TileGX port (2020-07-03 16:59:46 +0100)

* i.MX6UL EVK board: put PHYs in the correct places

* hw/arm/virt: Let the virtio-iommu bypass MSIs

* target/arm: kvm: Handle DABT with no valid ISS

* hw/arm/virt-acpi-build: Only expose flash on older machine types

* target/arm: Fix temp double-free in sve ldr/str

* hw/display/bcm2835_fb.c: Initialize all fields of struct

* hw/arm/spitz: Code cleanup to fix Coverity-detected memory leak

* Deprecate TileGX port

Andrew Jones (4):

tests/acpi: remove stale allowed tables

tests/acpi: virt: allow DSDT acpi table changes

hw/arm/virt-acpi-build: Only expose flash on older machine types

tests/acpi: virt: update golden masters for DSDT

Beata Michalska (2):

target/arm: kvm: Handle DABT with no valid ISS

target/arm: kvm: Handle misconfigured dabt injection

Eric Auger (5):

qdev: Introduce DEFINE_PROP_RESERVED_REGION

virtio-iommu: Implement RESV_MEM probe request

virtio-iommu: Handle reserved regions in the translation process

virtio-iommu-pci: Add array of Interval properties

hw/arm/virt: Let the virtio-iommu bypass MSIs

Jean-Christophe Dubois (3):

Add a phy-num property to the i.MX FEC emulator

Add the ability to select a different PHY for each i.MX6UL FEC interface

Select MDIO device 2 and 1 as PHY devices for i.MX6UL EVK board.

Peter Maydell (19):

hw/display/bcm2835_fb.c: Initialize all fields of struct

hw/arm/spitz: Detabify

hw/arm/spitz: Create SpitzMachineClass abstract base class

hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineState

hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineState

hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signals

hw/misc/max111x: provide QOM properties for setting initial values

hw/misc/max111x: Don't use vmstate_register()

ssi: Add ssi_realize_and_unref()

hw/arm/spitz: Use max111x properties to set initial values

hw/misc/max111x: Use GPIO lines rather than max111x_set_input()

hw/misc/max111x: Create header file for documentation, TYPE_ macros

hw/arm/spitz: Encapsulate misc GPIO handling in a device

hw/gpio/zaurus.c: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/pxa2xx_pic: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Provide usual QOM macros for corgi-ssp and spitz-lcdtg

Replace uses of FROM_SSI_SLAVE() macro with QOM casts

Deprecate TileGX port

Richard Henderson (1):

target/arm: Fix temp double-free in sve ldr/str

From: Eric Auger <eric.auger@redhat.com>

This patch implements the PROBE request. At the moment,

only THE RESV_MEM property is handled. The first goal is

to report iommu wide reserved regions such as the MSI regions

set by the machine code. On x86 this will be the IOAPIC MSI

region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS

doorbell.

In the future we may introduce per device reserved regions.

This will be useful when protecting host assigned devices

which may expose their own reserved regions

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-3-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/virtio/virtio-iommu.h | 2 +

hw/virtio/virtio-iommu.c | 94 ++++++++++++++++++++++++++++++--

hw/virtio/trace-events | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/virtio/virtio-iommu.h

+++ b/include/hw/virtio/virtio-iommu.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOIOMMU {

GHashTable *as_by_busptr;

IOMMUPciBus *iommu_pcibus_by_bus_num[PCI_BUS_MAX];

PCIBus *primary_bus;

+ ReservedRegion *reserved_regions;

+ uint32_t nb_reserved_regions;

GTree *domains;

QemuMutex mutex;

GTree *endpoints;

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@

/* Max size */

#define VIOMMU_DEFAULT_QUEUE_SIZE 256

+#define VIOMMU_PROBE_SIZE 512

typedef struct VirtIOIOMMUDomain {

uint32_t id;

@@ -XXX,XX +XXX,XX @@ static int virtio_iommu_unmap(VirtIOIOMMU *s,

return ret;

}

+static ssize_t virtio_iommu_fill_resv_mem_prop(VirtIOIOMMU *s, uint32_t ep,

+ uint8_t *buf, size_t free)

+{

+ struct virtio_iommu_probe_resv_mem prop = {};

+ size_t size = sizeof(prop), length = size - sizeof(prop.head), total;

+ int i;

+

+ total = size * s->nb_reserved_regions;

+

+ if (total > free) {

+ return -ENOSPC;

+ }

+

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ unsigned subtype = s->reserved_regions[i].type;

+

+ assert(subtype == VIRTIO_IOMMU_RESV_MEM_T_RESERVED ||

+ subtype == VIRTIO_IOMMU_RESV_MEM_T_MSI);

+ prop.head.type = cpu_to_le16(VIRTIO_IOMMU_PROBE_T_RESV_MEM);

+ prop.head.length = cpu_to_le16(length);

+ prop.subtype = subtype;

+ prop.start = cpu_to_le64(s->reserved_regions[i].low);

+ prop.end = cpu_to_le64(s->reserved_regions[i].high);

+

+ memcpy(buf, &prop, size);

+

+ trace_virtio_iommu_fill_resv_property(ep, prop.subtype,

+ prop.start, prop.end);

+ buf += size;

+ }

+ return total;

+}

+

+/**

+ * virtio_iommu_probe - Fill the probe request buffer with

+ * the properties the device is able to return

+ */

+static int virtio_iommu_probe(VirtIOIOMMU *s,

+ struct virtio_iommu_req_probe *req,

+ uint8_t *buf)

+{

+ uint32_t ep_id = le32_to_cpu(req->endpoint);

+ size_t free = VIOMMU_PROBE_SIZE;

+ ssize_t count;

+

+ if (!virtio_iommu_mr(s, ep_id)) {

+ return VIRTIO_IOMMU_S_NOENT;

+ }

+

+ count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free);

+ if (count < 0) {

+ return VIRTIO_IOMMU_S_INVAL;

+ }

+ buf += count;

+ free -= count;

+

+ return VIRTIO_IOMMU_S_OK;

+}

+

static int virtio_iommu_iov_to_req(struct iovec *iov,

unsigned int iov_cnt,

void *req, size_t req_sz)

@@ -XXX,XX +XXX,XX @@ virtio_iommu_handle_req(detach)

virtio_iommu_handle_req(map)

virtio_iommu_handle_req(unmap)

+static int virtio_iommu_handle_probe(VirtIOIOMMU *s,

+ struct iovec *iov,

+ unsigned int iov_cnt,

+ uint8_t *buf)

+{

+ struct virtio_iommu_req_probe req;

+ int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req));

+

+ return ret ? ret : virtio_iommu_probe(s, &req, buf);

+}

+

static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

{

VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

struct virtio_iommu_req_head head;

struct virtio_iommu_req_tail tail = {};

+ size_t output_size = sizeof(tail), sz;

VirtQueueElement *elem;

unsigned int iov_cnt;

struct iovec *iov;

- size_t sz;

+ void *buf = NULL;

for (;;) {

elem = virtqueue_pop(vq, sizeof(VirtQueueElement));

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

case VIRTIO_IOMMU_T_UNMAP:

tail.status = virtio_iommu_handle_unmap(s, iov, iov_cnt);

break;

+ case VIRTIO_IOMMU_T_PROBE:

+ {

+ struct virtio_iommu_req_tail *ptail;

+

+ output_size = s->config.probe_size + sizeof(tail);

+ buf = g_malloc0(output_size);

+

+ ptail = (struct virtio_iommu_req_tail *)

+ (buf + s->config.probe_size);

+ ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);

+ }

default:

tail.status = VIRTIO_IOMMU_S_UNSUPP;

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

out:

sz = iov_from_buf(elem->in_sg, elem->in_num, 0,

- &tail, sizeof(tail));

- assert(sz == sizeof(tail));

+ buf ? buf : &tail, output_size);

+ assert(sz == output_size);

- virtqueue_push(vq, elem, sizeof(tail));

+ virtqueue_push(vq, elem, sz);

virtio_notify(vdev, vq);

g_free(elem);

+ g_free(buf);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

s->config.page_size_mask = TARGET_PAGE_MASK;

s->config.input_range.end = -1UL;

s->config.domain_range.end = 32;

+ s->config.probe_size = VIOMMU_PROBE_SIZE;

virtio_add_feature(&s->features, VIRTIO_RING_F_EVENT_IDX);

virtio_add_feature(&s->features, VIRTIO_RING_F_INDIRECT_DESC);

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MAP_UNMAP);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_BYPASS);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MMIO);

+ virtio_add_feature(&s->features, VIRTIO_IOMMU_F_PROBE);

qemu_mutex_init(&s->mutex);

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/trace-events

+++ b/hw/virtio/trace-events

@@ -XXX,XX +XXX,XX @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"

virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"

virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"

virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64

+virtio_iommu_fill_resv_property(uint32_t devid, uint8_t subtype, uint64_t start, uint64_t end) "dev= %d, type=%d start=0x%"PRIx64" end=0x%"PRIx64

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

When translating an address we need to check if it belongs to

a reserved virtual address range. If it does, there are 2 cases:

- it belongs to a RESERVED region: the guest should neither use

this address in a MAP not instruct the end-point to DMA on

them. We report an error

- It belongs to an MSI region: we bypass the translation.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Xu <peterx@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-4-eric.auger@redhat.com

hw/virtio/virtio-iommu.c | 20 ++++++++++++++++++++

1 file changed, 20 insertions(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr,

uint32_t sid, flags;

bool bypass_allowed;

bool found;

+ int i;

interval.low = addr;

interval.high = addr + 1;

@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr,

goto unlock;

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ ReservedRegion *reg = &s->reserved_regions[i];

+

+ if (addr >= reg->low && addr <= reg->high) {

+ switch (reg->type) {

+ case VIRTIO_IOMMU_RESV_MEM_T_MSI:

+ entry.perm = flag;

+ break;

+ case VIRTIO_IOMMU_RESV_MEM_T_RESERVED:

+ default:

+ virtio_iommu_report_fault(s, VIRTIO_IOMMU_FAULT_R_MAPPING,

+ VIRTIO_IOMMU_FAULT_F_ADDRESS,

+ sid, addr);

+ break;

+ }

+ goto unlock;

+ }

+ }

+

if (!ep->domain) {

if (!bypass_allowed) {

error_report_once("%s %02x:%02x.%01x not attached to any domain",

From: Eric Auger <eric.auger@redhat.com>

At the moment the virtio-iommu translates MSI transactions.

This behavior is inherited from ARM SMMU. The virt machine

code knows where the guest MSI doorbells are so we can easily

declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that

setting the guest will not map MSIs through the IOMMU and those

transactions will be simply bypassed.

Depending on which MSI controller is in use (ITS or GICV2M),

we declare either:

- the ITS interrupt translation space (ITS_base + 0x10000),

containing the GITS_TRANSLATOR or

- The GICV2M single frame, containing the MSI_SETSP_NS register.

include/hw/arm/virt.h | 7 +++++++

hw/arm/virt.c | 30 ++++++++++++++++++++++++++++++

2 files changed, 37 insertions(+)

@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {

VIRT_IOMMU_VIRTIO,

} VirtIOMMUType;

+typedef enum VirtMSIControllerType {

+ VIRT_MSI_CTRL_NONE,

+ VIRT_MSI_CTRL_GICV2M,

+ VIRT_MSI_CTRL_ITS,

+} VirtMSIControllerType;

+

typedef enum VirtGICType {

VIRT_GIC_VERSION_MAX,

VIRT_GIC_VERSION_HOST,

@@ -XXX,XX +XXX,XX @@ typedef struct {

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

+ VirtMSIControllerType msi_controller;

uint16_t virtio_iommu_bdf;

struct arm_boot_info bootinfo;

MemMapEntry *memmap;