I might squeeze in another pullreq before softfreeze, but the

queue was already big enough that I wanted to send this lot out now.

The following changes since commit 4abf70a661a5df3886ac9d7c19c3617fa92b922a:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-06-24' into staging (2020-07-03 15:34:45 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200703

for you to fetch changes up to 0f10bf84a9d489259a5b11c6aa1b05c1175b76ea:

Deprecate TileGX port (2020-07-03 16:59:46 +0100)

* i.MX6UL EVK board: put PHYs in the correct places

* hw/arm/virt: Let the virtio-iommu bypass MSIs

* target/arm: kvm: Handle DABT with no valid ISS

* hw/arm/virt-acpi-build: Only expose flash on older machine types

* target/arm: Fix temp double-free in sve ldr/str

* hw/display/bcm2835_fb.c: Initialize all fields of struct

* hw/arm/spitz: Code cleanup to fix Coverity-detected memory leak

* Deprecate TileGX port

Andrew Jones (4):

tests/acpi: remove stale allowed tables

tests/acpi: virt: allow DSDT acpi table changes

hw/arm/virt-acpi-build: Only expose flash on older machine types

tests/acpi: virt: update golden masters for DSDT

Beata Michalska (2):

target/arm: kvm: Handle DABT with no valid ISS

target/arm: kvm: Handle misconfigured dabt injection

Eric Auger (5):

qdev: Introduce DEFINE_PROP_RESERVED_REGION

virtio-iommu: Implement RESV_MEM probe request

virtio-iommu: Handle reserved regions in the translation process

virtio-iommu-pci: Add array of Interval properties

hw/arm/virt: Let the virtio-iommu bypass MSIs

Jean-Christophe Dubois (3):

Add a phy-num property to the i.MX FEC emulator

Add the ability to select a different PHY for each i.MX6UL FEC interface

Select MDIO device 2 and 1 as PHY devices for i.MX6UL EVK board.

Peter Maydell (19):

hw/display/bcm2835_fb.c: Initialize all fields of struct

hw/arm/spitz: Detabify

hw/arm/spitz: Create SpitzMachineClass abstract base class

hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineState

hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineState

hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signals

hw/misc/max111x: provide QOM properties for setting initial values

hw/misc/max111x: Don't use vmstate_register()

ssi: Add ssi_realize_and_unref()

hw/arm/spitz: Use max111x properties to set initial values

hw/misc/max111x: Use GPIO lines rather than max111x_set_input()

hw/misc/max111x: Create header file for documentation, TYPE_ macros

hw/arm/spitz: Encapsulate misc GPIO handling in a device

hw/gpio/zaurus.c: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/pxa2xx_pic: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Provide usual QOM macros for corgi-ssp and spitz-lcdtg

Replace uses of FROM_SSI_SLAVE() macro with QOM casts

Deprecate TileGX port

From: Beata Michalska <beata.michalska@linaro.org>

Injecting external data abort through KVM might trigger

an issue on kernels that do not get updated to include the KVM fix.

For those and aarch32 guests, the injected abort gets misconfigured

to be an implementation defined exception. This leads to the guest

repeatedly re-running the faulting instruction.

target/arm/cpu.h | 2 ++

target/arm/kvm_arm.h | 10 +++++++++

target/arm/kvm.c | 30 ++++++++++++++++++++++++++-

target/arm/kvm32.c | 34 ++++++++++++++++++++++++++++++

target/arm/kvm64.c | 49 ++++++++++++++++++++++++++++++++++++++++++++

5 files changed, 124 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint64_t esr;

} serror;

+ uint8_t ext_dabt_raised; /* Tracking/verifying injection of ext DABT */

/* State of our input IRQ/FIQ/VIRQ/VFIQ lines */

uint32_t irq_line_state;

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm_arm.h

+++ b/target/arm/kvm_arm.h

@@ -XXX,XX +XXX,XX @@ bool kvm_arm_hw_debug_active(CPUState *cs);

struct kvm_guest_debug_arch;

void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr);

+/**

+ * kvm_arm_verify_ext_dabt_pending:

+ * @cs: CPUState

+ *

+ * Verify the fault status code wrt the Ext DABT injection

+ *

+ * Returns: true if the fault status code is as expected, false otherwise

+ */

+bool kvm_arm_verify_ext_dabt_pending(CPUState *cs);

+

/**

* its_class_name:

*

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ int kvm_get_vcpu_events(ARMCPU *cpu)

void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)

{

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

+

+ if (unlikely(env->ext_dabt_raised)) {

+ /*

+ * Verifying that the ext DABT has been properly injected,

+ * otherwise risking indefinitely re-running the faulting instruction

+ * Covering a very narrow case for kernels 5.5..5.5.4

+ * when injected abort was misconfigured to be

+ * an IMPLEMENTATION DEFINED exception (for 32-bit EL1)

+ */

+ if (!arm_feature(env, ARM_FEATURE_AARCH64) &&

+ unlikely(!kvm_arm_verify_ext_dabt_pending(cs))) {

+

+ error_report("Data abort exception with no valid ISS generated by "

+ "guest memory access. KVM unable to emulate faulting "

+ "instruction. Failed to inject an external data abort "

+ "into the guest.");

+ abort();

+ }

+ /* Clear the status */

+ env->ext_dabt_raised = 0;

+ }

}

MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)

@@ -XXX,XX +XXX,XX @@ void kvm_arm_vm_state_change(void *opaque, int running, RunState state)

static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

uint64_t fault_ipa)

{

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

/*

* Request KVM to inject the external data abort into the guest

*/

@@ -XXX,XX +XXX,XX @@ static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

*/

events.exception.ext_dabt_pending = 1;

/* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */

- return kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events);

+ if (!kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events)) {

+ env->ext_dabt_raised = 1;

+ return 0;

+ }

} else {

error_report("Data abort exception triggered by guest memory access "

"at physical address: 0x" TARGET_FMT_lx,

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm32.c

+++ b/target/arm/kvm32.c

@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)

{

qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);

}

+

+#define ARM_REG_DFSR ARM_CP15_REG32(0, 5, 0, 0)

+#define ARM_REG_TTBCR ARM_CP15_REG32(0, 2, 0, 2)

+/*

+ *DFSR:

+ * TTBCR.EAE == 0

+ * FS[4] - DFSR[10]

+ * FS[3:0] - DFSR[3:0]

+ * TTBCR.EAE == 1

+ * FS, bits [5:0]

+ */

+#define DFSR_FSC(lpae, v) \

+ ((lpae) ? ((v) & 0x3F) : (((v) >> 6) | ((v) & 0x1F)))

+

+#define DFSC_EXTABT(lpae) ((lpae) ? 0x10 : 0x08)

+

+bool kvm_arm_verify_ext_dabt_pending(CPUState *cs)

+{

+ uint32_t dfsr_val;

+

+ if (!kvm_get_one_reg(cs, ARM_REG_DFSR, &dfsr_val)) {

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

+ uint32_t ttbcr;

+ int lpae = 0;

+

+ if (!kvm_get_one_reg(cs, ARM_REG_TTBCR, &ttbcr)) {

+ lpae = arm_feature(env, ARM_FEATURE_LPAE) && (ttbcr & TTBCR_EAE);

+ }

+ /* The verification is based on FS filed of the DFSR reg only*/

+ return (DFSR_FSC(lpae, dfsr_val) == DFSC_EXTABT(lpae));

+ }

+ return false;

+}

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm64.c

+++ b/target/arm/kvm64.c

@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)

return false;

}

+

+#define ARM64_REG_ESR_EL1 ARM64_SYS_REG(3, 0, 5, 2, 0)

+#define ARM64_REG_TCR_EL1 ARM64_SYS_REG(3, 0, 2, 0, 2)

+

+/*

+ * ESR_EL1

+ * ISS encoding

+ * AARCH64: DFSC, bits [5:0]

+ * AARCH32:

+ * TTBCR.EAE == 0

+ * FS[4] - DFSR[10]

+ * FS[3:0] - DFSR[3:0]

+ * TTBCR.EAE == 1

+ * FS, bits [5:0]

+ */

+#define ESR_DFSC(aarch64, lpae, v) \

+ ((aarch64 || (lpae)) ? ((v) & 0x3F) \

+ : (((v) >> 6) | ((v) & 0x1F)))

+

+#define ESR_DFSC_EXTABT(aarch64, lpae) \

+ ((aarch64) ? 0x10 : (lpae) ? 0x10 : 0x8)

+

+bool kvm_arm_verify_ext_dabt_pending(CPUState *cs)

+{

+ uint64_t dfsr_val;

+

+ if (!kvm_get_one_reg(cs, ARM64_REG_ESR_EL1, &dfsr_val)) {

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

+ int aarch64_mode = arm_feature(env, ARM_FEATURE_AARCH64);

+ int lpae = 0;

+

+ if (!aarch64_mode) {

+ uint64_t ttbcr;

+

+ if (!kvm_get_one_reg(cs, ARM64_REG_TCR_EL1, &ttbcr)) {

+ lpae = arm_feature(env, ARM_FEATURE_LPAE)

+ && (ttbcr & TTBCR_EAE);

+ }

+ }

+ /*

+ * The verification here is based on the DFSC bits

+ * of the ESR_EL1 reg only

+ */

+ return (ESR_DFSC(aarch64_mode, lpae, dfsr_val) ==

+ ESR_DFSC_EXTABT(aarch64_mode, lpae));

+ }

+ return false;

+}

2.20.1

The temp that gets assigned to clean_addr has been allocated with

new_tmp_a64, which means that it will be freed at the end of the

instruction. Freeing it earlier leads to assertion failure.

The loop creates a complication, in which we allocate a new local

temp, which does need freeing, and the final code path is shared

between the loop and non-loop.

Fix this complication by adding new_tmp_a64_local so that the new

local temp is freed at the end, and can be treated exactly like

the non-loop path.

Fixes: bba87d0a0f4

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20200702175605.1987125-1-richard.henderson@linaro.org

target/arm/translate-a64.h | 1 +

target/arm/translate-a64.c | 6 ++++++

target/arm/translate-sve.c | 8 ++------

3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.h

+++ b/target/arm/translate-a64.h

@@ -XXX,XX +XXX,XX @@ void unallocated_encoding(DisasContext *s);

} while (0)

TCGv_i64 new_tmp_a64(DisasContext *s);

+TCGv_i64 new_tmp_a64_local(DisasContext *s);

TCGv_i64 new_tmp_a64_zero(DisasContext *s);

TCGv_i64 cpu_reg(DisasContext *s, int reg);

TCGv_i64 cpu_reg_sp(DisasContext *s, int reg);

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ TCGv_i64 new_tmp_a64(DisasContext *s)

return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_new_i64();

+TCGv_i64 new_tmp_a64_local(DisasContext *s)

+{

+ assert(s->tmp_a64_count < TMP_A64_MAX);

+ return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_local_new_i64();

+}

+

TCGv_i64 new_tmp_a64_zero(DisasContext *s)

TCGv_i64 t = new_tmp_a64(s);

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)

/* Copy the clean address into a local temp, live across the loop. */

t0 = clean_addr;

- clean_addr = tcg_temp_local_new_i64();

+ clean_addr = new_tmp_a64_local(s);

tcg_gen_mov_i64(clean_addr, t0);

- tcg_temp_free_i64(t0);

gen_set_label(loop);

@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)

tcg_gen_st_i64(t0, cpu_env, vofs + len_align);

tcg_temp_free_i64(t0);

- tcg_temp_free_i64(clean_addr);

/* Similarly for stores. */

@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)

/* Copy the clean address into a local temp, live across the loop. */

t0 = clean_addr;

- clean_addr = tcg_temp_local_new_i64();

+ clean_addr = new_tmp_a64_local(s);

tcg_gen_mov_i64(clean_addr, t0);

- tcg_temp_free_i64(t0);

gen_set_label(loop);

@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)

}

tcg_temp_free_i64(t0);

- tcg_temp_free_i64(clean_addr);

static bool trans_LDR_zri(DisasContext *s, arg_rri *a)

2.20.1

From: Beata Michalska <beata.michalska@linaro.org>

On ARMv7 & ARMv8 some load/store instructions might trigger a data abort

exception with no valid ISS info to be decoded. The lack of decode info

makes it at least tricky to emulate those instruction which is one of the

(many) reasons why KVM will not even try to do so.

Add support for handling those by requesting KVM to inject external

dabt into the quest.

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20200629114110.30723-2-beata.michalska@linaro.org

target/arm/kvm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 52 insertions(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {

static bool cap_has_mp_state;

static bool cap_has_inject_serror_esr;

+static bool cap_has_inject_ext_dabt;

static ARMHostCPUFeatures arm_host_cpu_features;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)

ret = -EINVAL;

+ if (kvm_check_extension(s, KVM_CAP_ARM_NISV_TO_USER)) {

+ if (kvm_vm_enable_cap(s, KVM_CAP_ARM_NISV_TO_USER, 0)) {

+ error_report("Failed to enable KVM_CAP_ARM_NISV_TO_USER cap");

+ } else {

+ /* Set status for supporting the external dabt injection */

+ cap_has_inject_ext_dabt = kvm_check_extension(s,

+ KVM_CAP_ARM_INJECT_EXT_DABT);

+

return ret;

@@ -XXX,XX +XXX,XX @@ void kvm_arm_vm_state_change(void *opaque, int running, RunState state)

}

+/**

+ * kvm_arm_handle_dabt_nisv:

+ * @cs: CPUState

+ * @esr_iss: ISS encoding (limited) for the exception from Data Abort

+ * ISV bit set to '0b0' -> no valid instruction syndrome

+ * @fault_ipa: faulting address for the synchronous data abort

+ *

+ * Returns: 0 if the exception has been handled, < 0 otherwise

+ */

+static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

+ uint64_t fault_ipa)

+{

+ /*

+ * Request KVM to inject the external data abort into the guest

+ */

+ if (cap_has_inject_ext_dabt) {

+ struct kvm_vcpu_events events = { };

+ /*

+ * The external data abort event will be handled immediately by KVM

+ * using the address fault that triggered the exit on given VCPU.

+ * Requesting injection of the external data abort does not rely

+ * on any other VCPU state. Therefore, in this particular case, the VCPU

+ * synchronization can be exceptionally skipped.

+ */

+ events.exception.ext_dabt_pending = 1;

+ /* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */

+ return kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events);

+ } else {

+ error_report("Data abort exception triggered by guest memory access "

+ "at physical address: 0x" TARGET_FMT_lx,

+ (target_ulong)fault_ipa);

+ error_printf("KVM unable to emulate faulting instruction.\n");

+ }

+ return -1;

+}

+

int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

{

int ret = 0;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

ret = EXCP_DEBUG;

} /* otherwise return to guest */

qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",

__func__, run->exit_reason);

2.20.1

Deprecate our TileGX target support:

* we have no active maintainer for it

* it has had essentially no contributions (other than tree-wide cleanups

and similar) since it was first added

* the Linux kernel dropped support in 2018, as has glibc

Note the deprecation in the manual, but don't try to print a warning

when QEMU runs -- printing unsuppressable messages is more obtrusive

for linux-user mode than it would be for system-emulation mode, and

it doesn't seem worth trying to invent a new suppressible-error

system for linux-user just for this.

docs/system/deprecated.rst | 11 +++++++++++

1 file changed, 11 insertions(+)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst

--- a/docs/system/deprecated.rst

+++ b/docs/system/deprecated.rst

@@ -XXX,XX +XXX,XX @@ The above, converted to the current supported format::

json:{"file.driver":"rbd", "file.pool":"rbd", "file.image":"name"}

+linux-user mode CPUs

+--------------------

+

+``tilegx`` CPUs (since 5.1.0)

+'''''''''''''''''''''''''''''

+

+The ``tilegx`` guest CPU support (which was only implemented in

+linux-user mode) is deprecated and will be removed in a future version

+of QEMU. Support for this CPU was removed from the upstream Linux

+kernel in 2018, and has also been dropped from glibc.

+

Related binaries

----------------

2.20.1

From: Eric Auger <eric.auger@redhat.com>

This patch implements the PROBE request. At the moment,

only THE RESV_MEM property is handled. The first goal is

to report iommu wide reserved regions such as the MSI regions

set by the machine code. On x86 this will be the IOAPIC MSI

region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS

doorbell.

In the future we may introduce per device reserved regions.

This will be useful when protecting host assigned devices

which may expose their own reserved regions

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-3-eric.auger@redhat.com

include/hw/virtio/virtio-iommu.h | 2 +

hw/virtio/virtio-iommu.c | 94 ++++++++++++++++++++++++++++++--

hw/virtio/trace-events | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h

--- a/include/hw/virtio/virtio-iommu.h

+++ b/include/hw/virtio/virtio-iommu.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOIOMMU {

GHashTable *as_by_busptr;

IOMMUPciBus *iommu_pcibus_by_bus_num[PCI_BUS_MAX];

PCIBus *primary_bus;

+ ReservedRegion *reserved_regions;

+ uint32_t nb_reserved_regions;

GTree *domains;

QemuMutex mutex;

GTree *endpoints;

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

/* Max size */

#define VIOMMU_DEFAULT_QUEUE_SIZE 256

+#define VIOMMU_PROBE_SIZE 512

typedef struct VirtIOIOMMUDomain {

uint32_t id;

@@ -XXX,XX +XXX,XX @@ static int virtio_iommu_unmap(VirtIOIOMMU *s,

return ret;

}

+static ssize_t virtio_iommu_fill_resv_mem_prop(VirtIOIOMMU *s, uint32_t ep,

+ uint8_t *buf, size_t free)

+ struct virtio_iommu_probe_resv_mem prop = {};

+ size_t size = sizeof(prop), length = size - sizeof(prop.head), total;

+ int i;

+ total = size * s->nb_reserved_regions;

+ if (total > free) {

+ return -ENOSPC;

+ }

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ unsigned subtype = s->reserved_regions[i].type;

+

+ assert(subtype == VIRTIO_IOMMU_RESV_MEM_T_RESERVED ||

+ subtype == VIRTIO_IOMMU_RESV_MEM_T_MSI);

+ prop.head.type = cpu_to_le16(VIRTIO_IOMMU_PROBE_T_RESV_MEM);

+ prop.head.length = cpu_to_le16(length);

+ prop.subtype = subtype;

+ prop.start = cpu_to_le64(s->reserved_regions[i].low);

+ prop.end = cpu_to_le64(s->reserved_regions[i].high);

+

+ memcpy(buf, &prop, size);

+

+ trace_virtio_iommu_fill_resv_property(ep, prop.subtype,

+ prop.start, prop.end);

+ buf += size;

+ }

+ return total;

+/**

+ * virtio_iommu_probe - Fill the probe request buffer with

+ * the properties the device is able to return

+ */

+static int virtio_iommu_probe(VirtIOIOMMU *s,

+ struct virtio_iommu_req_probe *req,

+ uint8_t *buf)

+{

+ uint32_t ep_id = le32_to_cpu(req->endpoint);

+ size_t free = VIOMMU_PROBE_SIZE;

+ ssize_t count;

+

+ if (!virtio_iommu_mr(s, ep_id)) {

+ return VIRTIO_IOMMU_S_NOENT;

+ }

+

+ count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free);

+ if (count < 0) {

+ return VIRTIO_IOMMU_S_INVAL;

+ }

+ buf += count;

+ free -= count;

+

+ return VIRTIO_IOMMU_S_OK;

+}

+

static int virtio_iommu_iov_to_req(struct iovec *iov,

unsigned int iov_cnt,

void *req, size_t req_sz)

@@ -XXX,XX +XXX,XX @@ virtio_iommu_handle_req(detach)

virtio_iommu_handle_req(map)

virtio_iommu_handle_req(unmap)

+static int virtio_iommu_handle_probe(VirtIOIOMMU *s,

+ struct iovec *iov,

+ unsigned int iov_cnt,

+ uint8_t *buf)

+{

+ struct virtio_iommu_req_probe req;

+ int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req));

+

+ return ret ? ret : virtio_iommu_probe(s, &req, buf);

+}

+

static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

struct virtio_iommu_req_head head;

struct virtio_iommu_req_tail tail = {};

+ size_t output_size = sizeof(tail), sz;

VirtQueueElement *elem;

unsigned int iov_cnt;

struct iovec *iov;

- size_t sz;

+ void *buf = NULL;

for (;;) {

elem = virtqueue_pop(vq, sizeof(VirtQueueElement));

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

case VIRTIO_IOMMU_T_UNMAP:

tail.status = virtio_iommu_handle_unmap(s, iov, iov_cnt);

break;

+ case VIRTIO_IOMMU_T_PROBE:

+ {

+ struct virtio_iommu_req_tail *ptail;

+

+ output_size = s->config.probe_size + sizeof(tail);

+ buf = g_malloc0(output_size);

+

+ ptail = (struct virtio_iommu_req_tail *)

+ (buf + s->config.probe_size);

+ ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);

+ }

default:

tail.status = VIRTIO_IOMMU_S_UNSUPP;

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

out:

sz = iov_from_buf(elem->in_sg, elem->in_num, 0,

- &tail, sizeof(tail));

- assert(sz == sizeof(tail));

+ buf ? buf : &tail, output_size);

+ assert(sz == output_size);

- virtqueue_push(vq, elem, sizeof(tail));

+ virtqueue_push(vq, elem, sz);

virtio_notify(vdev, vq);

g_free(elem);

+ g_free(buf);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

s->config.page_size_mask = TARGET_PAGE_MASK;

s->config.input_range.end = -1UL;

s->config.domain_range.end = 32;

+ s->config.probe_size = VIOMMU_PROBE_SIZE;

virtio_add_feature(&s->features, VIRTIO_RING_F_EVENT_IDX);

virtio_add_feature(&s->features, VIRTIO_RING_F_INDIRECT_DESC);

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MAP_UNMAP);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_BYPASS);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MMIO);

+ virtio_add_feature(&s->features, VIRTIO_IOMMU_F_PROBE);

qemu_mutex_init(&s->mutex);

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/trace-events

+++ b/hw/virtio/trace-events

@@ -XXX,XX +XXX,XX @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"

virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"

virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"

virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64

+virtio_iommu_fill_resv_property(uint32_t devid, uint8_t subtype, uint64_t start, uint64_t end) "dev= %d, type=%d start=0x%"PRIx64" end=0x%"PRIx64

2.20.1

From: Eric Auger <eric.auger@redhat.com>

At the moment the virtio-iommu translates MSI transactions.

This behavior is inherited from ARM SMMU. The virt machine

code knows where the guest MSI doorbells are so we can easily

declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that

setting the guest will not map MSIs through the IOMMU and those

transactions will be simply bypassed.

Depending on which MSI controller is in use (ITS or GICV2M),

we declare either:

- the ITS interrupt translation space (ITS_base + 0x10000),

containing the GITS_TRANSLATOR or

- The GICV2M single frame, containing the MSI_SETSP_NS register.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20200629070404.10969-6-eric.auger@redhat.com

include/hw/arm/virt.h | 7 +++++++

hw/arm/virt.c | 30 ++++++++++++++++++++++++++++++

2 files changed, 37 insertions(+)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {

VIRT_IOMMU_VIRTIO,

} VirtIOMMUType;

+typedef enum VirtMSIControllerType {

+ VIRT_MSI_CTRL_NONE,

+ VIRT_MSI_CTRL_GICV2M,

+ VIRT_MSI_CTRL_ITS,

+} VirtMSIControllerType;

typedef enum VirtGICType {

VIRT_GIC_VERSION_MAX,

VIRT_GIC_VERSION_HOST,

@@ -XXX,XX +XXX,XX @@ typedef struct {

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

+ VirtMSIControllerType msi_controller;

uint16_t virtio_iommu_bdf;

struct arm_boot_info bootinfo;

MemMapEntry *memmap;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_ITS].base);

fdt_add_its_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_ITS;

static void create_v2m(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)

}

fdt_add_v2m_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_GICV2M;

static void create_gic(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ out:

static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,

DeviceState *dev, Error **errp)

{

+ VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);

if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {

virt_memory_pre_plug(hotplug_dev, dev, errp);

+ } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {

+ hwaddr db_start = 0, db_end = 0;

+ char *resv_prop_str;

+ switch (vms->msi_controller) {

+ case VIRT_MSI_CTRL_NONE:

+ return;

+ case VIRT_MSI_CTRL_ITS:

+ /* GITS_TRANSLATER page */

+ db_start = base_memmap[VIRT_GIC_ITS].base + 0x10000;

+ db_end = base_memmap[VIRT_GIC_ITS].base +

+ base_memmap[VIRT_GIC_ITS].size - 1;

+ break;

+ case VIRT_MSI_CTRL_GICV2M:

+ /* MSI_SETSPI_NS page */

+ db_start = base_memmap[VIRT_GIC_V2M].base;

+ db_end = db_start + base_memmap[VIRT_GIC_V2M].size - 1;

+ break;

+ }

+ resv_prop_str = g_strdup_printf("0x%"PRIx64":0x%"PRIx64":%u",

+ db_start, db_end,

+ VIRTIO_IOMMU_RESV_MEM_T_MSI);

+

+ qdev_prop_set_uint32(dev, "len-reserved-regions", 1);

+ qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);

+ g_free(resv_prop_str);

}

}