I might squeeze in another pullreq before softfreeze, but the

queue was already big enough that I wanted to send this lot out now.

The following changes since commit 4abf70a661a5df3886ac9d7c19c3617fa92b922a:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-06-24' into staging (2020-07-03 15:34:45 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200703

for you to fetch changes up to 0f10bf84a9d489259a5b11c6aa1b05c1175b76ea:

Deprecate TileGX port (2020-07-03 16:59:46 +0100)

* i.MX6UL EVK board: put PHYs in the correct places

* hw/arm/virt: Let the virtio-iommu bypass MSIs

* target/arm: kvm: Handle DABT with no valid ISS

* hw/arm/virt-acpi-build: Only expose flash on older machine types

* target/arm: Fix temp double-free in sve ldr/str

* hw/display/bcm2835_fb.c: Initialize all fields of struct

* hw/arm/spitz: Code cleanup to fix Coverity-detected memory leak

* Deprecate TileGX port

Andrew Jones (4):

tests/acpi: remove stale allowed tables

tests/acpi: virt: allow DSDT acpi table changes

hw/arm/virt-acpi-build: Only expose flash on older machine types

tests/acpi: virt: update golden masters for DSDT

Beata Michalska (2):

target/arm: kvm: Handle DABT with no valid ISS

target/arm: kvm: Handle misconfigured dabt injection

Eric Auger (5):

qdev: Introduce DEFINE_PROP_RESERVED_REGION

virtio-iommu: Implement RESV_MEM probe request

virtio-iommu: Handle reserved regions in the translation process

virtio-iommu-pci: Add array of Interval properties

hw/arm/virt: Let the virtio-iommu bypass MSIs

Jean-Christophe Dubois (3):

Add a phy-num property to the i.MX FEC emulator

Add the ability to select a different PHY for each i.MX6UL FEC interface

Select MDIO device 2 and 1 as PHY devices for i.MX6UL EVK board.

Peter Maydell (19):

hw/display/bcm2835_fb.c: Initialize all fields of struct

hw/arm/spitz: Detabify

hw/arm/spitz: Create SpitzMachineClass abstract base class

hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineState

hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineState

hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signals

hw/misc/max111x: provide QOM properties for setting initial values

hw/misc/max111x: Don't use vmstate_register()

ssi: Add ssi_realize_and_unref()

hw/arm/spitz: Use max111x properties to set initial values

hw/misc/max111x: Use GPIO lines rather than max111x_set_input()

hw/misc/max111x: Create header file for documentation, TYPE_ macros

hw/arm/spitz: Encapsulate misc GPIO handling in a device

hw/gpio/zaurus.c: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/pxa2xx_pic: Use LOG_GUEST_ERROR for bad guest register accesses

hw/arm/spitz: Provide usual QOM macros for corgi-ssp and spitz-lcdtg

Replace uses of FROM_SSI_SLAVE() macro with QOM casts

Deprecate TileGX port

target/arm: Fix temp double-free in sve ldr/str

docs/system/deprecated.rst | 11 +

include/exec/memory.h | 6 +

include/hw/arm/fsl-imx6ul.h | 2 +

include/hw/arm/pxa.h | 1 -

include/hw/arm/sharpsl.h | 3 -

include/hw/arm/virt.h | 8 +

include/hw/misc/max111x.h | 56 +++

include/hw/net/imx_fec.h | 1 +

include/hw/qdev-properties.h | 3 +

include/hw/ssi/ssi.h | 31 +-

include/hw/virtio/virtio-iommu.h | 2 +

include/qemu/typedefs.h | 1 +

target/arm/cpu.h | 2 +

target/arm/kvm_arm.h | 10 +

target/arm/translate-a64.h | 1 +

tests/qtest/bios-tables-test-allowed-diff.h | 18 -

hw/arm/fsl-imx6ul.c | 10 +

hw/arm/mcimx6ul-evk.c | 2 +

hw/arm/pxa2xx_pic.c | 9 +-

hw/arm/spitz.c | 507 ++++++++++++++++------------

hw/arm/virt-acpi-build.c | 5 +-

hw/arm/virt.c | 33 ++

hw/arm/z2.c | 11 +-

hw/core/qdev-properties.c | 89 +++++

hw/display/ads7846.c | 9 +-

hw/display/bcm2835_fb.c | 4 +

hw/display/ssd0323.c | 10 +-

hw/gpio/zaurus.c | 12 +-

hw/misc/max111x.c | 86 +++--

hw/net/imx_fec.c | 24 +-

hw/sd/ssi-sd.c | 4 +-

hw/ssi/ssi.c | 7 +-

hw/virtio/virtio-iommu-pci.c | 11 +

hw/virtio/virtio-iommu.c | 114 ++++++-

target/arm/kvm.c | 80 +++++

target/arm/kvm32.c | 34 ++

target/arm/kvm64.c | 49 +++

target/arm/translate-a64.c | 6 +

target/arm/translate-sve.c | 8 +-

MAINTAINERS | 1 +

hw/net/trace-events | 4 +-

hw/virtio/trace-events | 1 +

tests/data/acpi/virt/DSDT | Bin 5307 -> 5205 bytes

tests/data/acpi/virt/DSDT.memhp | Bin 6668 -> 6566 bytes

tests/data/acpi/virt/DSDT.numamem | Bin 5307 -> 5205 bytes

45 files changed, 974 insertions(+), 312 deletions(-)

create mode 100644 include/hw/misc/max111x.h

From: Jean-Christophe Dubois <jcd@tribudubois.net>

We need a solution to use an Ethernet PHY that is not the first device

on the MDIO bus (device 0 on MDIO bus).

As an example with the i.MX6UL the NXP SOC has 2 Ethernet devices but

only one MDIO bus on which the 2 related PHY are connected but at unique

addresses.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: a1a5c0e139d1c763194b8020573dcb6025daeefa.1593296112.git.jcd@tribudubois.net

include/hw/net/imx_fec.h | 1 +

hw/net/imx_fec.c | 24 +++++++++++++++++-------

hw/net/trace-events | 4 ++--

3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h

--- a/include/hw/net/imx_fec.h

+++ b/include/hw/net/imx_fec.h

@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {

uint32_t phy_advertise;

uint32_t phy_int;

uint32_t phy_int_mask;

+ uint32_t phy_num;

bool is_fec;

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static void imx_phy_reset(IMXFECState *s)

static uint32_t imx_phy_read(IMXFECState *s, int reg)

{

uint32_t val;

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return 0;

}

+ reg %= 32;

+

switch (reg) {

case 0: /* Basic Control */

val = s->phy_control;

@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)

break;

}

- trace_imx_phy_read(val, reg);

+ trace_imx_phy_read(val, phy, reg);

return val;

static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)

{

- trace_imx_phy_write(val, reg);

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return;

}

+ reg %= 32;

+ trace_imx_phy_write(val, phy, reg);

switch (reg) {

case 0: /* Basic Control */

if (val & 0x8000) {

@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,

extract32(value,

18, 10)));

} else {

- /* This a write operation */

+ /* This is a write operation */

imx_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));

}

/* raise the interrupt as the PHY operation is done */

@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)

static Property imx_eth_properties[] = {

DEFINE_NIC_PROPERTIES(IMXFECState, conf),

DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),

+ DEFINE_PROP_UINT32("phy-num", IMXFECState, phy_num, 0),

DEFINE_PROP_END_OF_LIST(),

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Add properties to the i.MX6UL processor to be able to select a

particular PHY on the MDIO bus for each FEC device.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: ea1d604198b6b73ea6521676e45bacfc597aba53.1593296112.git.jcd@tribudubois.net

include/hw/arm/fsl-imx6ul.h | 2 ++

hw/arm/fsl-imx6ul.c | 10 ++++++++++

2 files changed, 12 insertions(+)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h

--- a/include/hw/arm/fsl-imx6ul.h

+++ b/include/hw/arm/fsl-imx6ul.h

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {

MemoryRegion caam;

MemoryRegion ocram;

MemoryRegion ocram_alias;

+

+ uint32_t phy_num[FSL_IMX6UL_NUM_ETHS];

} FslIMX6ULState;

enum FslIMX6ULMemoryMap {

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx6ul.c

+++ b/hw/arm/fsl-imx6ul.c

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)

FSL_IMX6UL_ENET2_TIMER_IRQ,

};

+ object_property_set_uint(OBJECT(&s->eth[i]),

+ s->phy_num[i],

+ "phy-num", &error_abort);

object_property_set_uint(OBJECT(&s->eth[i]),

FSL_IMX6UL_ETH_NUM_TX_RINGS,

"tx-ring-num", &error_abort);

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)

FSL_IMX6UL_OCRAM_ALIAS_ADDR, &s->ocram_alias);

+static Property fsl_imx6ul_properties[] = {

+ DEFINE_PROP_UINT32("fec1-phy-num", FslIMX6ULState, phy_num[0], 0),

+ DEFINE_PROP_UINT32("fec2-phy-num", FslIMX6ULState, phy_num[1], 1),

+ DEFINE_PROP_END_OF_LIST(),

+};

static void fsl_imx6ul_class_init(ObjectClass *oc, void *data)

DeviceClass *dc = DEVICE_CLASS(oc);

+ device_class_set_props(dc, fsl_imx6ul_properties);

dc->realize = fsl_imx6ul_realize;

dc->desc = "i.MX6UL SOC";

/* Reason: Uses serial_hds and nd_table in realize() directly */

From: Jean-Christophe Dubois <jcd@tribudubois.net>

The i.MX6UL EVK 14x14 board uses:

- PHY 2 for FEC 1

- PHY 1 for FEC 2

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: fb41992126c091a71d76ab3d1898959091f60583.1593296112.git.jcd@tribudubois.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/mcimx6ul-evk.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/mcimx6ul-evk.c b/hw/arm/mcimx6ul-evk.c

--- a/hw/arm/mcimx6ul-evk.c

+++ b/hw/arm/mcimx6ul-evk.c

@@ -XXX,XX +XXX,XX @@ static void mcimx6ul_evk_init(MachineState *machine)

s = FSL_IMX6UL(object_new(TYPE_FSL_IMX6UL));

+ object_property_set_uint(OBJECT(s), 2, "fec1-phy-num", &error_fatal);

+ object_property_set_uint(OBJECT(s), 1, "fec2-phy-num", &error_fatal);

memory_region_add_subregion(get_system_memory(), FSL_IMX6UL_MMDC_ADDR,

From: Eric Auger <eric.auger@redhat.com>

This patch implements the PROBE request. At the moment,

only THE RESV_MEM property is handled. The first goal is

to report iommu wide reserved regions such as the MSI regions

set by the machine code. On x86 this will be the IOAPIC MSI

region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS

doorbell.

In the future we may introduce per device reserved regions.

This will be useful when protecting host assigned devices

which may expose their own reserved regions

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-3-eric.auger@redhat.com

include/hw/virtio/virtio-iommu.h | 2 +

hw/virtio/virtio-iommu.c | 94 ++++++++++++++++++++++++++++++--

hw/virtio/trace-events | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h

--- a/include/hw/virtio/virtio-iommu.h

+++ b/include/hw/virtio/virtio-iommu.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOIOMMU {

GHashTable *as_by_busptr;

IOMMUPciBus *iommu_pcibus_by_bus_num[PCI_BUS_MAX];

PCIBus *primary_bus;

+ ReservedRegion *reserved_regions;

+ uint32_t nb_reserved_regions;

GTree *domains;

QemuMutex mutex;

GTree *endpoints;

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@

/* Max size */

#define VIOMMU_DEFAULT_QUEUE_SIZE 256

+#define VIOMMU_PROBE_SIZE 512

typedef struct VirtIOIOMMUDomain {

uint32_t id;

@@ -XXX,XX +XXX,XX @@ static int virtio_iommu_unmap(VirtIOIOMMU *s,

return ret;

+static ssize_t virtio_iommu_fill_resv_mem_prop(VirtIOIOMMU *s, uint32_t ep,

+ uint8_t *buf, size_t free)

+ struct virtio_iommu_probe_resv_mem prop = {};

+ size_t size = sizeof(prop), length = size - sizeof(prop.head), total;

+ total = size * s->nb_reserved_regions;

+

+ if (total > free) {

+ return -ENOSPC;

+ }

+

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ unsigned subtype = s->reserved_regions[i].type;

+

+ assert(subtype == VIRTIO_IOMMU_RESV_MEM_T_RESERVED ||

+ subtype == VIRTIO_IOMMU_RESV_MEM_T_MSI);

+ prop.head.type = cpu_to_le16(VIRTIO_IOMMU_PROBE_T_RESV_MEM);

+ prop.head.length = cpu_to_le16(length);

+ prop.subtype = subtype;

+ prop.start = cpu_to_le64(s->reserved_regions[i].low);

+ prop.end = cpu_to_le64(s->reserved_regions[i].high);

+

+ memcpy(buf, &prop, size);

+

+ trace_virtio_iommu_fill_resv_property(ep, prop.subtype,

+ prop.start, prop.end);

+ buf += size;

+ }

+ return total;

+/**

+ * virtio_iommu_probe - Fill the probe request buffer with

+ * the properties the device is able to return

+ */

+static int virtio_iommu_probe(VirtIOIOMMU *s,

+ struct virtio_iommu_req_probe *req,

+ uint8_t *buf)

+{

+ uint32_t ep_id = le32_to_cpu(req->endpoint);

+ size_t free = VIOMMU_PROBE_SIZE;

+ ssize_t count;

+

+ if (!virtio_iommu_mr(s, ep_id)) {

+ return VIRTIO_IOMMU_S_NOENT;

+ }

+

+ count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free);

+ if (count < 0) {

+ return VIRTIO_IOMMU_S_INVAL;

+ }

+ buf += count;

+ free -= count;

+

+ return VIRTIO_IOMMU_S_OK;

+}

+

static int virtio_iommu_iov_to_req(struct iovec *iov,

unsigned int iov_cnt,

void *req, size_t req_sz)

@@ -XXX,XX +XXX,XX @@ virtio_iommu_handle_req(detach)

virtio_iommu_handle_req(map)

virtio_iommu_handle_req(unmap)

+static int virtio_iommu_handle_probe(VirtIOIOMMU *s,

+ struct iovec *iov,

+ unsigned int iov_cnt,

+ uint8_t *buf)

+{

+ struct virtio_iommu_req_probe req;

+ int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req));

+

+ return ret ? ret : virtio_iommu_probe(s, &req, buf);

+}

+

static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

{

VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

struct virtio_iommu_req_head head;

struct virtio_iommu_req_tail tail = {};

+ size_t output_size = sizeof(tail), sz;

VirtQueueElement *elem;

unsigned int iov_cnt;

struct iovec *iov;

- size_t sz;

+ void *buf = NULL;

for (;;) {

elem = virtqueue_pop(vq, sizeof(VirtQueueElement));

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

case VIRTIO_IOMMU_T_UNMAP:

tail.status = virtio_iommu_handle_unmap(s, iov, iov_cnt);

break;

+ case VIRTIO_IOMMU_T_PROBE:

+ {

+ struct virtio_iommu_req_tail *ptail;

+

+ output_size = s->config.probe_size + sizeof(tail);

+ buf = g_malloc0(output_size);

+

+ ptail = (struct virtio_iommu_req_tail *)

+ (buf + s->config.probe_size);

+ ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);

+ }

default:

tail.status = VIRTIO_IOMMU_S_UNSUPP;

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

out:

sz = iov_from_buf(elem->in_sg, elem->in_num, 0,

- &tail, sizeof(tail));

- assert(sz == sizeof(tail));

+ buf ? buf : &tail, output_size);

+ assert(sz == output_size);

- virtqueue_push(vq, elem, sizeof(tail));

+ virtqueue_push(vq, elem, sz);

virtio_notify(vdev, vq);

g_free(elem);

+ g_free(buf);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

s->config.page_size_mask = TARGET_PAGE_MASK;

s->config.input_range.end = -1UL;

s->config.domain_range.end = 32;

+ s->config.probe_size = VIOMMU_PROBE_SIZE;

virtio_add_feature(&s->features, VIRTIO_RING_F_EVENT_IDX);

virtio_add_feature(&s->features, VIRTIO_RING_F_INDIRECT_DESC);

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MAP_UNMAP);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_BYPASS);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MMIO);

+ virtio_add_feature(&s->features, VIRTIO_IOMMU_F_PROBE);

qemu_mutex_init(&s->mutex);

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/trace-events

+++ b/hw/virtio/trace-events

@@ -XXX,XX +XXX,XX @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"

virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"

virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"

virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64

+virtio_iommu_fill_resv_property(uint32_t devid, uint8_t subtype, uint64_t start, uint64_t end) "dev= %d, type=%d start=0x%"PRIx64" end=0x%"PRIx64

From: Eric Auger <eric.auger@redhat.com>

At the moment the virtio-iommu translates MSI transactions.

This behavior is inherited from ARM SMMU. The virt machine

code knows where the guest MSI doorbells are so we can easily

declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that

setting the guest will not map MSIs through the IOMMU and those

transactions will be simply bypassed.

Depending on which MSI controller is in use (ITS or GICV2M),

we declare either:

- the ITS interrupt translation space (ITS_base + 0x10000),

containing the GITS_TRANSLATOR or

- The GICV2M single frame, containing the MSI_SETSP_NS register.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20200629070404.10969-6-eric.auger@redhat.com

include/hw/arm/virt.h | 7 +++++++

hw/arm/virt.c | 30 ++++++++++++++++++++++++++++++

2 files changed, 37 insertions(+)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {

VIRT_IOMMU_VIRTIO,

} VirtIOMMUType;

+typedef enum VirtMSIControllerType {

+ VIRT_MSI_CTRL_NONE,

+ VIRT_MSI_CTRL_GICV2M,

+ VIRT_MSI_CTRL_ITS,

+} VirtMSIControllerType;

+

typedef enum VirtGICType {

VIRT_GIC_VERSION_MAX,

VIRT_GIC_VERSION_HOST,

@@ -XXX,XX +XXX,XX @@ typedef struct {

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

+ VirtMSIControllerType msi_controller;

uint16_t virtio_iommu_bdf;

struct arm_boot_info bootinfo;

MemMapEntry *memmap;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_ITS].base);

fdt_add_its_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_ITS;

static void create_v2m(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)

}

fdt_add_v2m_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_GICV2M;

}

static void create_gic(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ out:

static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,

DeviceState *dev, Error **errp)

{

+ VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);

if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {

virt_memory_pre_plug(hotplug_dev, dev, errp);

+ } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {

+ hwaddr db_start = 0, db_end = 0;

+ char *resv_prop_str;

+ switch (vms->msi_controller) {

+ case VIRT_MSI_CTRL_NONE:

+ return;

+ case VIRT_MSI_CTRL_ITS:

+ /* GITS_TRANSLATER page */

+ db_start = base_memmap[VIRT_GIC_ITS].base + 0x10000;

+ db_end = base_memmap[VIRT_GIC_ITS].base +

+ base_memmap[VIRT_GIC_ITS].size - 1;

+ break;

+ case VIRT_MSI_CTRL_GICV2M:

+ /* MSI_SETSPI_NS page */

+ db_start = base_memmap[VIRT_GIC_V2M].base;

+ db_end = db_start + base_memmap[VIRT_GIC_V2M].size - 1;

+ break;

+ }

+ resv_prop_str = g_strdup_printf("0x%"PRIx64":0x%"PRIx64":%u",

+ db_start, db_end,

+ VIRTIO_IOMMU_RESV_MEM_T_MSI);

+

+ qdev_prop_set_uint32(dev, "len-reserved-regions", 1);

+ qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);

+ g_free(resv_prop_str);

}

}

From: Beata Michalska <beata.michalska@linaro.org>

On ARMv7 & ARMv8 some load/store instructions might trigger a data abort

exception with no valid ISS info to be decoded. The lack of decode info

makes it at least tricky to emulate those instruction which is one of the

(many) reasons why KVM will not even try to do so.

Add support for handling those by requesting KVM to inject external

dabt into the quest.

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20200629114110.30723-2-beata.michalska@linaro.org

target/arm/kvm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 52 insertions(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {

static bool cap_has_mp_state;

static bool cap_has_inject_serror_esr;

+static bool cap_has_inject_ext_dabt;

static ARMHostCPUFeatures arm_host_cpu_features;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)

ret = -EINVAL;

}

+ if (kvm_check_extension(s, KVM_CAP_ARM_NISV_TO_USER)) {

+ if (kvm_vm_enable_cap(s, KVM_CAP_ARM_NISV_TO_USER, 0)) {

+ error_report("Failed to enable KVM_CAP_ARM_NISV_TO_USER cap");

+ } else {

+ /* Set status for supporting the external dabt injection */

+ cap_has_inject_ext_dabt = kvm_check_extension(s,

+ KVM_CAP_ARM_INJECT_EXT_DABT);

+ }

+ }

+

return ret;

}

@@ -XXX,XX +XXX,XX @@ void kvm_arm_vm_state_change(void *opaque, int running, RunState state)

+/**

+ * kvm_arm_handle_dabt_nisv:

+ * @cs: CPUState

+ * @esr_iss: ISS encoding (limited) for the exception from Data Abort

+ * ISV bit set to '0b0' -> no valid instruction syndrome

+ * @fault_ipa: faulting address for the synchronous data abort

+ *

+ * Returns: 0 if the exception has been handled, < 0 otherwise

+ */

+static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

+ uint64_t fault_ipa)

+ /*

+ * Request KVM to inject the external data abort into the guest

+ */

+ if (cap_has_inject_ext_dabt) {

+ struct kvm_vcpu_events events = { };

+ /*

+ * The external data abort event will be handled immediately by KVM

+ * using the address fault that triggered the exit on given VCPU.

+ * Requesting injection of the external data abort does not rely

+ * on any other VCPU state. Therefore, in this particular case, the VCPU

+ * synchronization can be exceptionally skipped.

+ */

+ events.exception.ext_dabt_pending = 1;

+ /* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */

+ return kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events);

+ } else {

+ error_report("Data abort exception triggered by guest memory access "

+ "at physical address: 0x" TARGET_FMT_lx,

+ (target_ulong)fault_ipa);

+ error_printf("KVM unable to emulate faulting instruction.\n");

int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

int ret = 0;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

ret = EXCP_DEBUG;

} /* otherwise return to guest */

break;

+ case KVM_EXIT_ARM_NISV:

+ /* External DABT with no valid iss to decode */

+ ret = kvm_arm_handle_dabt_nisv(cs, run->arm_nisv.esr_iss,

+ run->arm_nisv.fault_ipa);

+ break;

default:

qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",

__func__, run->exit_reason);

From: Beata Michalska <beata.michalska@linaro.org>

Injecting external data abort through KVM might trigger

an issue on kernels that do not get updated to include the KVM fix.