hw/block/m25p80: Check SPI mode before running some Numonyx commands

Some Numonyx flash commands cannot be executed in DIO and QIO mode, such as
trying to do DPP or DOR when in QIO mode.

Signed-off-by: Joe Komlodi <[email protected]>
Reviewed-by: Francisco Iglesias <[email protected]>
Message-id: 1605568264[email protected]
Signed-off-by: Peter Maydell <[email protected]>

hw/block/m25p80: Fix when VCFG XIP bit is set for Numonyx

VCFG XIP is set (disabled) when the NVCFG XIP bits are all set (disabled).

Signed-off-by: Joe Komlodi <[email protected]>
Reviewed-by: Francisco Iglesias <[email protected]>
Message-id: 1605568264[email protected]
Signed-off-by: Peter Maydell <[email protected]>

hw/block/m25p80: Make Numonyx config field names more accurate

The previous naming of the configuration registers made it sound like that if
the bits were set the settings would be enabled, while the opposite is true.

Signed-off-by: Joe Komlodi <[email protected]>
Reviewed-by: Francisco Iglesias <[email protected]>
Message-id: 1605568264[email protected]
Signed-off-by: Peter Maydell <[email protected]>

hw/misc/zynq_slcr: Avoid #DIV/0! error

Malicious user can set the feedback divisor for the PLLs
to zero, triggering a floating-point exception (SIGFPE).

As the datasheet [*] is not clear how hardware behaves
when these bits are zeroes, use the maximum divisor
possible (128) to avoid the software FPE.

[*] Zynq-7000 TRM, UG585 (v1.12.2)
    B.28 System Level Control Registers (slcr)
    -> "Register (slcr) ARM_PLL_CTRL"
    25.10.4 PLLs
    -> "Software-Controlled PLL Update"

Fixes: 38867cb7ec9 ("hw/misc/zynq_slcr: add clock generation for uarts")
Reported-by: Gaoning Pan <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Damien Hedde <[email protected]>
Message-id: 20201210141610[email protected]
Signed-off-by: Peter Maydell <[email protected]>

arm: xlnx-versal: Connect usb to virt-versal

Connect VersalUsb2 subsystem to xlnx-versal SOC, its placed
in iou of lpd domain and configure it as dual port host controller.
Add the respective guest dts nodes for "xlnx-versal-virt" machine.

Signed-off-by: Vikram Garhwal <[email protected]>
Signed-off-by: Sai Pavan Boddu <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 1607023357[email protected]
Signed-off-by: Peter Maydell <[email protected]>

usb: xlnx-usb-subsystem: Add xilinx usb subsystem

This model is a top level integration wrapper for hcd-dwc3 and
versal-usb2-ctrl-regs modules, this is used by xilinx versal soc's and
future xilinx usb subsystems would also be part of it.

Signed-off-by: Sai Pavan Boddu <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1607023357[email protected]
Signed-off-by: Peter Maydell <[email protected]>

usb: Add DWC3 model

This patch adds skeleton model of dwc3 usb controller attached to
xhci-sysbus device. It defines global register space of DWC3 controller,
global registers control the AXI/AHB interfaces properties, external FIFO
support and event count support. All of which are unimplemented at
present,we are only supporting core reset and read of ID register.

Signed-off-by: Vikram Garhwal <[email protected]>
Signed-off-by: Sai Pavan Boddu <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Message-id: 1607023357[email protected]
Signed-off-by: Peter Maydell <[email protected]>

usb: Add versal-usb2-ctrl-regs module

This module emulates control registers of versal usb2 controller, this is added
just to make guest happy. In general this module would control the phy-reset
signal from usb controller, data coherency of the transactions, signals
the host system errors received from controller.

Signed-off-by: Sai Pavan Boddu <[email protected]>
Signed-off-by: Vikram Garhwal <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: 1607023357[email protected]
Signed-off-by: Peter Maydell <[email protected]>

elf_ops.h: Be more verbose with ROM blob names

Instead of making the ROM blob name something like:
  phdr #0: /home/petmay01/linaro/qemu-misc-tests/ldmia-fault.axf
make it a little more self-explanatory for people who don't know
ELF format details:
  /home/petmay01/linaro/qemu-misc-tests/ldmia-fault.axf ELF program header segment 0

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20201129203923[email protected]

elf_ops.h: Don't truncate name of the ROM blobs we create

Currently the load_elf code assembles the ROM blob name into a
local 128 byte fixed-size array. Use g_strdup_printf() instead so
that we don't truncate the pathname if it happens to be long.
(This matters mostly for monitor 'info roms' output and for the
error messages if ROM blobs overlap.)

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20201129203923[email protected]

hw/core/loader.c: Improve reporting of ROM overlap errors

In rom_check_and_register_reset() we report to the user if there is
a "ROM region overlap". This has a couple of problems:
 * the reported information is not very easy to intepret
 * the function just prints the overlap to stderr (and relies on
   its single callsite in vl.c to do an error_report() and exit)
 * only the first overlap encountered is diagnosed

Make this function use error_report() and error_printf() and
report a more user-friendly report with all the overlaps
diagnosed.

Sample old output:

rom: requested regions overlap (rom dtb. free=0x0000000000008000, addr=0x0000000000000000)
qemu-system-aarch64: rom check and register reset failed

Sample new output:

qemu-system-aarch64: Some ROM regions are overlapping
These ROM regions might have been loaded by direct user request or by default.
They could be BIOS/firmware images, a guest kernel, initrd or some other file loaded into guest memory.
Check whether you intended to load all this guest code, and whether it has been built to load to the correct addresses.

The following two regions overlap (in the cpu-memory-0 address space):
  phdr #0: /home/petmay01/linaro/qemu-misc-tests/ldmia-fault.axf (addresses 0x0000000000000000 - 0x0000000000008000)
  dtb (addresses 0x0000000000000000 - 0x0000000000100000)

The following two regions overlap (in the cpu-memory-0 address space):
  phdr #1: /home/petmay01/linaro/qemu-misc-tests/bad-psci-call.axf (addresses 0x0000000040000000 - 0x0000000040000010)
  phdr #0: /home/petmay01/linaro/qemu-misc-tests/bp-test.elf (addresses 0x0000000040000000 - 0x0000000040000020)

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20201129203923[email protected]

hw/core/loader.c: Track last-seen ROM in rom_check_and_register_reset()

In rom_check_and_register_reset() we detect overlaps by looking at
whether the ROM blob we're currently examining is in the same address
space and starts before the previous ROM blob ends.  (This works
because the ROM list is kept sorted in order by AddressSpace and then
by address.)

Instead of keeping the AddressSpace and last address of the previous ROM
blob in local variables, just keep a pointer to it.

This will allow us to print more useful information when we do detect
an overlap.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20201129203923[email protected]

target/nios2: Use deposit32() to update ipending register

In nios2_cpu_set_irq(), use deposit32() rather than raw shift-and-mask
operations to set the appropriate bit in the ipending register.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20201129174022[email protected]

target/nios2: Move nios2_check_interrupts() into target/nios2

The function nios2_check_interrupts)() looks only at CPU-internal
state; it belongs in target/nios2, not hw/nios2.  Move it into the
same file as its only caller, so it can just be local to that file.

This removes the only remaining code from cpu_pic.c, so we can delete
that file entirely.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20201129174022[email protected]
Reviewed-by: Wentong Wu <[email protected]>
Tested-by: Wentong Wu <[email protected]>

target/nios2: Move IIC code into CPU object proper

The Nios2 architecture supports two different interrupt controller
options:

 * The IIC (Internal Interrupt Controller) is part of the CPU itself;
   it has 32 IRQ input lines and no NMI support.  Interrupt status is
   queried and controlled via the CPU's ipending and istatus
   registers.

 * The EIC (External Interrupt Controller) interface allows the CPU
   to connect to an external interrupt controller.  The interface
   allows the interrupt controller to present a packet of information
   containing:
    - handler address
    - interrupt level
    - register set
    - NMI mode

QEMU does not model an EIC currently.  We do model the IIC, but its
implementation is split across code in hw/nios2/cpu_pic.c and
hw/intc/nios2_iic.c.  The code in those two files has no state of its
own -- the IIC state is in the Nios2CPU state struct.

Because CPU objects now inherit (indirectly) from TYPE_DEVICE, they
can have GPIO input lines themselves, so we can implement the IIC
directly in the CPU object the same way that real hardware does.

Create named "IRQ" GPIO inputs to the Nios2 CPU object, and make the
only user of the IIC wire up directly to those instead.

Note that the old code had an "NMI" concept which was entirely unused
and also as far as I can see not architecturally correct, since only
the EIC has a concept of an NMI.

This fixes a Coverity-reported trivial memory leak of the IRQ array
allocated in nios2_cpu_pic_init().

Fixes: Coverity CID 1421916
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20201129174022[email protected]
Reviewed-by: Wentong Wu <[email protected]>
Tested-by: Wentong Wu <[email protected]>

target/openrisc: Move pic_cpu code into CPU object proper

The openrisc code uses an old style of interrupt handling, where a
separate standalone set of qemu_irqs invoke a function
openrisc_pic_cpu_handler() which signals the interrupt to the CPU
proper by directly calling cpu_interrupt() and cpu_reset_interrupt().
Because CPU objects now inherit (indirectly) from TYPE_DEVICE, they
can have GPIO input lines themselves, and the neater modern way to
implement this is to simply have the CPU object itself provide the
input IRQ lines.

Create GPIO inputs to the OpenRISC CPU object, and make the only user
of cpu_openrisc_pic_init() wire up directly to those instead.

This allows us to delete the hw/openrisc/pic_cpu.c file entirely.

This fixes a trivial memory leak reported by Coverity of the IRQs
allocated in cpu_openrisc_pic_init().

Fixes: Coverity CID 1421934
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Stafford Horne <[email protected]>
Message-id: 20201127225127[email protected]

hw/openrisc/openrisc_sim: Abstract out "get IRQ x of CPU y"

We're about to refactor the OpenRISC pic_cpu code in a way that means
that just grabbing the whole qemu_irq[] array of inbound IRQs for a
CPU won't be possible any more.  Abstract out a function for "return
the qemu_irq for IRQ x input of CPU y" so we can more easily replace
the implementation.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Stafford Horne <[email protected]>
Message-id: 20201127225127[email protected]

hw/openrisc/openrisc_sim: Use IRQ splitter when connecting IRQ to multiple CPUs

openrisc_sim_net_init() attempts to connect the IRQ line from the
ethernet device to both CPUs in an SMP configuration by simply caling
sysbus_connect_irq() for it twice.  This doesn't work, because the
second connection simply overrides the first.

Fix this by creating a TYPE_SPLIT_IRQ to split the IRQ in the SMP
case.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Stafford Horne <[email protected]>
Message-id: 20201127225127[email protected]

gdbstub: Correct misparsing of vCont C/S requests

In the vCont packet, two of the command actions (C and S) take an
argument specifying the signal to be sent to the process/thread, which is
sent as an ASCII string of two hex digits which immediately follow the
'C' or 'S' character.

Our code for parsing this packet accidentally skipped the first of the
two bytes of the signal value, because it started parsing the hex string
at 'p + 1' when the preceding code had already moved past the 'C' or
'S' with "cur_action = *p++".

This meant that we would only do the right thing for signals below
10, and would misinterpret the rest.  For instance, when the debugger
wants to send the process a SIGPROF (27 on x86-64) we mangle this into
a SIGSEGV (11).

Remove the accidental double increment.

Fixes: https://bugs.launchpad.net/qemu/+bug/1773743
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Alex Bennée <[email protected]>
Message-id: 20201121210342[email protected]

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.0-pull-request' into staging

Pull request trivial-patches 20201214

# gpg: Signature made Mon 14 Dec 2020 15:52:07 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "[email protected]"
# gpg: Good signature from "Laurent Vivier <[email protected]>" [full]
# gpg:                 aka "Laurent Vivier <[email protected]>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <[email protected]>" [full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/trivial-branch-for-6.0-pull-request:
  configure / meson: Move check for linux/btrfs.h to meson.build
  configure / meson: Move check for sys/kcov.h to meson.build
  configure / meson: Move check for sys/signal.h to meson.build
  configure / meson: Move check for drm.h to meson.build
  configure / meson: Move check for pty.h to meson.build
  configure: Remove the obsolete check for ifaddrs.h
  blockdev: Fix a memleak in drive_backup_prepare()
  block/file-posix: fix a possible undefined behavior
  elf2dmp/pdb: Plug memleak in pdb_init_from_file
  elf2dmp/qemu_elf: Plug memleak in QEMU_Elf_init
  configure: Test if $make actually exists
  ads7846: moves from the hw/display folder to the hw/input folder.
  CODING_STYLE.rst: Be less strict about 80 character limit
  fsdev: open brace '{' following struct go on the same line
  hw/pci-host/pam: Replace magic number by PAM_REGIONS_COUNT definition
  hw/xen: Don't use '#' flag of printf format
  MAINTAINERS: update my email address
  qemu-options.hx: Fix minor issues in icount documentation
  target/i386: tracing: format length values as hex

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/philmd-gitlab/tags/mips-20201213' into staging

MIPS patches queue

. Allow executing MSA instructions on Loongson-3A4000
. Update Huacai Chen email address
. Various cleanups:
  - unused headers removal
  - use definitions instead of magic values
  - remove dead code
  - avoid calling unused code
. Various code movements

CI jobs results:
  https://gitlab.com/philmd/qemu/-/pipelines/229120169
  https://cirrus-ci.com/build/4857731557359616

# gpg: Signature made Sun 13 Dec 2020 20:18:52 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <[email protected]>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd-gitlab/tags/mips-20201213: (26 commits)
  target/mips: Use FloatRoundMode enum for FCR31 modes conversion
  target/mips: Remove unused headers from fpu_helper.c
  target/mips: Inline cpu_mips_realize_env() in mips_cpu_realizefn()
  target/mips: Move cpu definitions, reset() and realize() to cpu.c
  target/mips: Move mips_cpu_add_definition() from helper.c to cpu.c
  target/mips: Extract cpu_supports*/cpu_set* translate.c
  hw/mips/malta: Rewrite CP0_MVPConf0 access using deposit()
  hw/mips/malta: Do not initialize MT registers if MT ASE absent
  target/mips: Do not initialize MT registers if MT ASE absent
  target/mips: Introduce ase_mt_available() helper
  target/mips: Remove mips_def_t unused argument from mvp_init()
  target/mips: Remove unused headers from op_helper.c
  target/mips: Remove unused headers from translate.c
  hw/mips: Move address translation helpers to target/mips/
  target/mips: Introduce cpu_supports_isa() taking CPUMIPSState argument
  target/mips: Rename cpu_supports_FEAT() as cpu_type_supports_FEAT()
  target/mips: Explicit Release 6 MMU types
  target/mips: Allow executing MSA instructions on Loongson-3A4000
  target/mips: Also display exception names in user-mode
  target/mips: Remove unused headers from cp0_helper.c
  ...

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.0-20201214' into staging

ppc patch queue 2020-12-14

Here's my first pull request for qemu-6.0, with a bunch of things
queued over the freeze.  Highlights are:
 * A bunch of cleanups to hotplug error paths from Greg Kurz
 * A number of TCG fixes from new contributor Giuseppe Musacchio
 * Added Greg Kurz as co-maintainer
 * Assorted other bugfixes and cleanups

This supersedes ppc-for-6.0-20201211, the only change are some patch
authors to better match qemu conventions.

# gpg: Signature made Mon 14 Dec 2020 04:57:09 GMT
# gpg:                using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392
# gpg: Good signature from "David Gibson <[email protected]>" [full]
# gpg:                 aka "David Gibson (Red Hat) <[email protected]>" [full]
# gpg:                 aka "David Gibson (ozlabs.org) <[email protected]>" [full]
# gpg:                 aka "David Gibson (kernel.org) <[email protected]>" [unknown]
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dg-gitlab/tags/ppc-for-6.0-20201214: (30 commits)
  spapr.c: set a 'kvm-type' default value instead of relying on NULL
  spapr: Pass sPAPR machine state to some RTAS events handling functions
  spapr: Don't use qdev_get_machine() in spapr_msi_write()
  spapr: Pass sPAPR machine state down to spapr_pci_switch_vga()
  target/ppc: Introduce an mmu_is_64bit() helper
  ppc/translate: Use POWERPC_MMU_64 to detect 64-bit MMU models
  ppc/e500: Free irqs array to avoid memleak
  MAINTAINERS: Add Greg Kurz as co-maintainer for ppc
  hw/ppc: Do not re-read the clock on pre_save if doing savevm
  target/ppc: Remove "compat" property of server class POWER CPUs
  spapr: spapr_drc_attach() cannot fail
  spapr: Simplify error path of spapr_core_plug()
  spapr: Abort if ppc_set_compat() fails for hot-plugged CPUs
  spapr: Fix pre-2.10 dummy ICP hack
  xive: Add trace events
  hw/ppc/spapr_tpm_proxy: Fix hexadecimal format string specifier
  ppc/translate: Rewrite gen_lxvdsx to use gvec primitives
  ppc/translate: Raise exceptions after setting the cc
  ppc/translate: Delay NaN checking after comparison
  ppc/translate: Turn the helper macros into functions
  ...

Signed-off-by: Peter Maydell <[email protected]>

tests/tcg/multiarch/Makefile.target: Disable run-gdbstub-sha1 test

Disable the run-gdbstub-sha1 test: it provokes an internal error
assertion failure in Ubuntu gdb 8.1.1-0ubuntu1 (Ubuntu gdb
8.1-0ubuntu3.2 also has this assert but we were previously skipping
this test because it doesn't support connection over local domain
sockets) :

timeout 60  /home/petmay01/linaro/qemu-for-merges/tests/guest-debug/run-test.py --gdb /usr/bin/gdb-multiar
/build/gdb-veKdC1/gdb-8.1.1/gdb/regcache.c:122: internal-error: void* init_regcache_descr(gdbarch*): Asser
A problem internal to GDB has been detected,
further debugging may prove unreliable.

This is a bug, please report it.  For instructions, see:
<http://www.gnu.org/software/gdb/bugs/>.

Aborted (core dumped)
/home/petmay01/linaro/qemu-for-merges/tests/tcg/multiarch/Makefile.target:51: recipe for target 'run-gdbst

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20201214133702[email protected]

spapr.c: set a 'kvm-type' default value instead of relying on NULL

spapr_kvm_type() is considering 'vm_type=NULL' as a valid input, where
the function returns 0. This is relying on the current QEMU machine
options handling logic, where the absence of the 'kvm-type' option
will be reflected as 'vm_type=NULL' in this function.

This is not robust, and will break if QEMU options code decides to propagate
something else in the case mentioned above (e.g. an empty string instead
of NULL).

Let's avoid this entirely by setting a non-NULL default value in case of
no user input for 'kvm-type'. spapr_kvm_type() was changed to handle 3 fixed
values of kvm-type: "auto", "hv", and "pr", with "auto" being the default
if no kvm-type was set by the user. This allows us to always be predictable
regardless of any enhancements/changes made in QEMU options mechanics.

While we're at it, let's also document in 'kvm-type' description the
already existing default mode, now named 'auto'. The information provided
about it is based on how the pseries kernel handles the KVM_CREATE_VM
ioctl(), where the default value '0' makes the kernel choose an available
KVM module to use, giving precedence to kvm_hv. This logic is described in
the kernel source file arch/powerpc/kvm/powerpc.c, function kvm_arch_init_vm().

Signed-off-by: Daniel Henrique Barboza <[email protected]>
Message-Id: <20201210145517.1532269[email protected]>
Signed-off-by: David Gibson <[email protected]>
Reviewed-by: Greg Kurz <[email protected]>

spapr: Pass sPAPR machine state to some RTAS events handling functions

Some functions in hw/ppc/spapr_events.c get a pointer to the machine
state using qdev_get_machine(). Convert them to get it from their
caller when possible.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201209170052.1431440[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Don't use qdev_get_machine() in spapr_msi_write()

spapr_phb_realize() passes the sPAPR machine state as opaque data
for the I/O callbacks:

memory_region_init_io(&sphb->msiwindow, OBJECT(sphb), &spapr_msi_ops, spapr,
                                                                      ^^^^^
                      "msi", msi_window_size);

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201209170052.1431440[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Pass sPAPR machine state down to spapr_pci_switch_vga()

This allows to drop a user of qdev_get_machine().

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201209170052.1431440[email protected]>
Signed-off-by: David Gibson <[email protected]>

target/ppc: Introduce an mmu_is_64bit() helper

Callers don't really need to know how 64-bit MMU model enums are
computed. Hide this in a helper.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201209173536.1437351[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Use POWERPC_MMU_64 to detect 64-bit MMU models

The ppc_tr_init_disas_context() function currently checks whether the
MMU is 64-bit by ANDing its model type with POWERPC_MMU_64B. This is
wrong : POWERPC_MMU_64B isn't a mask, it is the generic MMU model for
pre-PowerISA-2.03 64-bit CPUs (ie. PowerPC 970 in QEMU).

Use POWERPC_MMU_64 instead of POWERPC_MMU_64B. This should fix a
potential bug with some 32-bit CPUs for which 'need_access_type'
was mis-computed because (POWERPC_MMU_32B & POWERPC_MMU_64B)
happens to be equal to 1. The end result being a crash in
ppc_hash32_direct_store() because the access type isn't set:

        cpu_abort(cs, "ERROR: instruction should not need "
                 "address translation\n");

This doesn't change anything for 'lazy_tlb_flush' since POWERPC_MMU_32B
is checked first.

Fixes: 5f2a6254522b ("ppc: Don't set access_type on all load/stores on hash64")
Signed-off-by: Stephane Duverger <[email protected]>
[groug: - extended patch to address another misuse of POWERPC_MMU_64B
        - updated title and changelog accordingly]
Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201209173536.1437351[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/e500: Free irqs array to avoid memleak

When running qom-test, a memory leak occurred in the ppce500_init function,
this patch free irqs array to fix it.

ASAN shows memory leak stack:

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0xfffc5ceee1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)
    #1 0xfffc5c806800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)
    #2 0xaaacf9999244 in ppce500_init qemu/hw/ppc/e500.c:859
    #3 0xaaacf97434e8 in machine_run_board_init qemu/hw/core/machine.c:1134
    #4 0xaaacf9c9475c in qemu_init qemu/softmmu/vl.c:4369
    #5 0xaaacf94785a0 in main qemu/softmmu/main.c:49

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Gan Qixin <[email protected]>
Message-Id: <20201204075822[email protected]>
Signed-off-by: David Gibson <[email protected]>

MAINTAINERS: Add Greg Kurz as co-maintainer for ppc

Greg has agreed to be co-maintainer of the ppc target and machines.
This should avoid repeats of the problem we had in qemu-5.2 where a
last minute fix was needed while I was on holiday.

Signed-off-by: David Gibson <[email protected]>
Acked-by: Greg Kurz <[email protected]>

hw/ppc: Do not re-read the clock on pre_save if doing savevm

A guest with enough RAM, eg. 128G, is likely to detect savevm downtime
and to complain about stalled CPUs. This happens because we re-read
the timebase just before migrating it and we thus don't account for
all the time between VM stop and pre-save.

A very similar situation was already addressed for live migration of
paused guests (commit d14f33976282). Extend the logic to do the same
with savevm.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1893787
Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <160693010619.1111945.632640981169395440[email protected]>
Signed-off-by: David Gibson <[email protected]>

target/ppc: Remove "compat" property of server class POWER CPUs

This property has been deprecated since QEMU 5.0 by commit 22062e54bb68.
We only kept a legacy hack that internally converts "compat" into the
official "max-cpu-compat" property of the pseries machine type.

According to our deprecation policy, we could have removed it for QEMU 5.2
already. Do it now ; since ppc_cpu_parse_featurestr() now just calls the
generic parent_parse_features handler, drop it as well.

Users are supposed to use the "max-cpu-compat" property of the pseries
machine type instead.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201201131103[email protected]>
Reviewed-by: Ján Tomko <[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: spapr_drc_attach() cannot fail

All users are passing &error_abort already. Document the fact
that spapr_drc_attach() should only be passed a free DRC, which
is supposedly the case if appropriate checking is done earlier.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201201113728[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Simplify error path of spapr_core_plug()

spapr_core_pre_plug() already guarantees that the slot for the given core
ID is available. It is thus safe to assume that spapr_find_cpu_slot()
returns a slot during plug. Turn the error path into an assertion.
It is also safe to assume that no device is attached to the corresponding
DRC and that spapr_drc_attach() shouldn't fail.

Pass &error_abort to spapr_drc_attach() and simplify error handling.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201201113728[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Abort if ppc_set_compat() fails for hot-plugged CPUs

When a CPU is hot-plugged, we set its compat mode to match the boot
CPU, which was either set by machine reset or by CAS. This is currently
handled in the plug handler after the core got realized. Potential errors
of ppc_set_compat() are propagated to the hot-plug logic.

Handling errors this late in the hot-plug sequence is generally frown
upon. Ideally, we should do sanity checks in a pre-plug handler and pass
&error_abort to ppc_set_compat() in the plug handler.

We can filter out some error cases of ppc_set_compat() by calling
ppc_check_compat() at pre-plug. But ppc_set_compat() also sets the
compat register in KVM, and KVM doesn't provide any API that would
allow to check valid compat mode settings beforehand.

However, at this point we know that the compat mode was already
successfully set for the boot CPU. Since this all boils down to
setting a register with the very same value that was valid
for the boot CPU, it should definitely not fail for hot-plugged
CPUS.

Pass &error_abort to ppc_set_compat().

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201201113728[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Fix pre-2.10 dummy ICP hack

This hack registers dummy VMState entries of ICPs in order to
support migration of old pseries machine types that used to
create all smp.max_cpus possible ICPs at machine init.

Part of the work is to unregister the dummy entries when plugging
an actual vCPU core, and to register them back when unplugging the
core. The code that unregisters the dummy ICPs in spapr_core_plug()
is misplaced: if ppc_set_compat() fails afterwards, the hotplug
operation will be cancelled and the dummy ICPs won't be registered
back since the unplug handler isn't called.

Unregister the dummy ICPs at the end of spapr_core_plug().

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201201113728[email protected]>
Signed-off-by: David Gibson <[email protected]>

xive: Add trace events

I have been keeping those logging messages in an ugly form for
while. Make them clean !

Beware not to activate all of them, this is really verbose.

Signed-off-by: Cédric Le Goater <[email protected]>
Message-Id: <20201123163717.1368450[email protected]>
Signed-off-by: David Gibson <[email protected]>

hw/ppc/spapr_tpm_proxy: Fix hexadecimal format string specifier

The '%u' conversion specifier is for decimal notation.
When prefixing a format with '0x', we want the hexadecimal
specifier ('%x').

Inspired-by: Dov Murik <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <20201103112558.2554390[email protected]>
Reviewed-by: Greg Kurz <[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Rewrite gen_lxvdsx to use gvec primitives

Make the implementation match the lxvwsx one.
The code is now shorter smaller and potentially faster as the
translation will use the host SIMD capabilities if available.

No functional change.

Signed-off-by: Giuseppe Musacchio <[email protected]>
Message-Id: <a463dea379da4cb3a22de49c678932f74fb15dd7.1604912739[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Raise exceptions after setting the cc

The PowerISA reference states that the comparison operators update the
FPCC, CR and FPSCR and, if VE=1, jump to the exception handler.

Moving the exception-triggering code after the CC update sequence solves
the problem.

Signed-off-by: Giuseppe Musacchio <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201112230130[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Delay NaN checking after comparison

Since we always perform a comparison between the two operands avoid
checking for NaN unless the result states they're unordered.

Suggested-by: Richard Henderson <[email protected]>
Signed-off-by: Giuseppe Musacchio <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201112230130[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Turn the helper macros into functions

Suggested-by: Richard Henderson <[email protected]>
Signed-off-by: Giuseppe Musacchio <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201112230130[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc/translate: Fix unordered f64/f128 comparisons

According to the PowerISA v3.1 reference, Table 68 "Actions for xscmpudp
- Part 1: Compare Unordered", whenever one of the two operands is a NaN
the SO bit is set while the other three bits are cleared.

Apply the same change to xscmpuqp.

The respective ordered counterparts are unaffected.

Signed-off-by: Giuseppe Musacchio <[email protected]>
Message-Id: <20201112230130[email protected]>
Signed-off-by: David Gibson <[email protected]>

ppc: Add a missing break for PPC6xx_INPUT_TBEN

When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning:
hw/ppc/ppc.c: In function ‘ppc6xx_set_irq’:
hw/ppc/ppc.c:118:16: warning: this statement may fall through [-Wimplicit-fallthrough=]
  118 |             if (level) {
      |                ^
hw/ppc/ppc.c:123:9: note: here
  123 |         case PPC6xx_INPUT_INT:
      |         ^~~~

According to the discussion, a break statement needs to be added here.

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Acked-by: David Gibson <[email protected]>
Message-Id: <20201116024810.2415819[email protected]>
Signed-off-by: David Gibson <[email protected]>

target/ppc: replaced the TODO with LOG_UNIMP and add break for silence warnings

When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning:
target/ppc/mmu_helper.c: In function ‘dump_mmu’:
target/ppc/mmu_helper.c:1351:12: warning: this statement may fall through [-Wimplicit-fallthrough=]
 1351 |         if (ppc64_v3_radix(env_archcpu(env))) {
      |            ^
target/ppc/mmu_helper.c:1358:5: note: here
 1358 |     default:
      |     ^~~~~~~

Use "qemu_log_mask(LOG_UNIMP**)" instead of the TODO comment.
And add the break statement to fix it.

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Acked-by: David Gibson <[email protected]>
Message-Id: <20201116024810.2415819[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Do TPM proxy hotplug sanity checks at pre-plug

There can be only one TPM proxy at a time. This is currently
checked at plug time. But this can be detected at pre-plug in
order to error out earlier.

This allows to get rid of error handling in the plug handler.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120234208[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Do PHB hoplug sanity check at pre-plug

We currently detect that a PHB index is already in use at plug time.
But this can be decteted at pre-plug in order to error out earlier.

This allows to pass &error_abort to spapr_drc_attach() and to end
up with a plug handler that doesn't need to report errors anymore.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120234208[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Make PHB placement functions and spapr_pre_plug_phb() return status

Read documentation in "qapi/error.h" and changelog of commit
e3fe3988d785 ("error: Document Error API usage rules") for
rationale.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120234208[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Do NVDIMM/PC-DIMM device hotplug sanity checks at pre-plug only

Pre-plug of a memory device, be it an NVDIMM or a PC-DIMM, ensures
that the memory slot is available and that addresses don't overlap
with existing memory regions. The corresponding DRCs in the LMB
and PMEM namespaces are thus necessarily attachable at plug time.

Pass &error_abort to spapr_drc_attach() in spapr_add_lmbs() and
spapr_add_nvdimm(). This allows to greatly simplify error handling
on the plug path.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120234208[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr: Do PCI device hotplug sanity checks at pre-plug only

The PHB acts as the hotplug handler for PCI devices. It does some
sanity checks on DR enablement, PCI bridge chassis numbers and
multifunction. These checks are currently performed at plug time,
but they would best sit in a pre-plug handler in order to error
out as early as possible.

Create a spapr_pci_pre_plug() handler and move all the checking
there. Add a check that the associated DRC doesn't already have
an attached device. This is equivalent to the slot availability
check performed by do_pci_register_device() upon realization of
the PCI device.

This allows to pass &error_abort to spapr_drc_attach() and to end
up with a plug handler that doesn't need to report errors anymore.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120234208[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr/xics: Drop unused argument to xics_kvm_has_broken_disconnect()

Never used from the start.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120174646[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Signed-off-by: David Gibson <[email protected]>

spapr/xive: Turn some sanity checks into assertions

The sPAPR XIVE device is created by the machine in spapr_irq_init().
The latter overrides any value provided by the user with -global for
the "nr-irqs" and "nr-ends" properties with strictly positive values.

It seems reasonable to assume these properties should never be 0,
which wouldn't make much sense by the way.

Signed-off-by: Greg Kurz <[email protected]>
Message-Id: <20201120174646[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Signed-off-by: David Gibson <[email protected]>

configure / meson: Move check for linux/btrfs.h to meson.build

This check can be done in a much shorter way in meson.build. And while
we're at it, rename the #define to HAVE_BTRFS_H to match the other
HAVE_someheader_H symbols that we already have.

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

configure / meson: Move check for sys/kcov.h to meson.build

This check can be done in a much shorter way in meson.build. And while
we're at it, rename the #define to HAVE_SYS_KCOV_H to match the other
HAVE_someheader_H symbols that we already have.

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
[lv: s/signal/kcov/]
Signed-off-by: Laurent Vivier <[email protected]>

configure / meson: Move check for sys/signal.h to meson.build

This check can be done in a much shorter way in meson.build

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

configure / meson: Move check for drm.h to meson.build

This check can be done in a much shorter way in meson.build

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

configure / meson: Move check for pty.h to meson.build

This check can be done in a much shorter way in meson.build

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

configure: Remove the obsolete check for ifaddrs.h

The code that used HAVE_IFADDRS_H has been removed in commit
0a27af918b ("io: use bind() to check for IPv4/6 availability"),
so we don't need this check in the configure script anymore.

Signed-off-by: Thomas Huth <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201118171052[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

blockdev: Fix a memleak in drive_backup_prepare()

'local_err' seems forgot to propagate in error path, it'll cause
a memleak. Fix it.

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Pan Nengyuan <[email protected]>
Reviewed-by: Kevin Wolf <[email protected]>
Reviewed-by: Li Qiang <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Message-Id: <20201023061218.2080844[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

block/file-posix: fix a possible undefined behavior

local_err is not initialized to NULL, it will cause a assert error as below:
qemu/util/error.c:59: error_setv: Assertion `*errp == NULL' failed.

Fixes: c6447510690
Reported-by: Euler Robot <[email protected]>
Signed-off-by: Pan Nengyuan <[email protected]>
Reviewed-by: Stefano Garzarella <[email protected]>
Reviewed-by: Kevin Wolf <[email protected]>
Reviewed-by: Li Qiang <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Message-Id: <20201023061218.2080844[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

elf2dmp/pdb: Plug memleak in pdb_init_from_file

Missing g_error_free in pdb_init_from_file() error path. Fix that.

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Pan Nengyuan <[email protected]>
Reviewed-by: Viktor Prutyanov <[email protected]>
Reviewed-by: Li Qiang <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <20201023061218.2080844[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

elf2dmp/qemu_elf: Plug memleak in QEMU_Elf_init

Missing g_error_free in QEMU_Elf_init() error path. Fix that.

Reported-by: Euler Robot <[email protected]>
Signed-off-by: Pan Nengyuan <[email protected]>
Reviewed-by: Viktor Prutyanov <[email protected]>
Reviewed-by: Li Qiang <[email protected]>
Signed-off-by: Chen Qun <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <20201023061218.2080844[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

configure: Test if $make actually exists

configure doesn't detect if $make is installed on the build host.
This is also helpful for hosts where an alias for make is used, i.e.
configure would fail if gmake is not present on macOS.

Reviewed-by: Daniel P. Berrangé <[email protected]>
Signed-off-by: Roman Bolshakov <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <20200825202755[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

target/mips: Use FloatRoundMode enum for FCR31 modes conversion

Use the FloatRoundMode enum type introduced in commit 3dede407cc6
("softfloat: Name rounding mode enum") instead of 'unsigned int'.

Suggested-by: Richard Henderson <[email protected]>
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201123204448.3260804[email protected]>

target/mips: Remove unused headers from fpu_helper.c

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Inline cpu_mips_realize_env() in mips_cpu_realizefn()

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Move cpu definitions, reset() and realize() to cpu.c

Nothing TCG specific there, move to common cpu code.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Move mips_cpu_add_definition() from helper.c to cpu.c

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Extract cpu_supports*/cpu_set* translate.c

Move cpu_supports*() and cpu_set_exception_base() from
translate.c to cpu.c.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

hw/mips/malta: Rewrite CP0_MVPConf0 access using deposit()

PTC field has 8 bits, PVPE has 4. We plan to use the
"hw/registerfields.h" API with MIPS CPU definitions
(target/mips/cpu.h). Meanwhile we use magic 8 and 4.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201204222622.2743175[email protected]>

hw/mips/malta: Do not initialize MT registers if MT ASE absent

Do not initialize MT-related config register if the MT ASE
is not present.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201204222622.2743175[email protected]>

target/mips: Do not initialize MT registers if MT ASE absent

Do not initialize MT-related config registers if the MT ASE
is not present. As some functions access the 'mvp' structure,
we still zero-allocate it.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201204222622.2743175[email protected]>

target/mips: Introduce ase_mt_available() helper

Instead of accessing CP0_Config3 directly and checking
the 'Multi-Threading Present' bit, introduce an helper
to simplify code review.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201204222622.2743175[email protected]>

target/mips: Remove mips_def_t unused argument from mvp_init()

mvp_init() doesn't require any CPU definition (beside the
information accessible via CPUMIPSState). Remove the unused
argument.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201204222622.2743175[email protected]>

target/mips: Remove unused headers from op_helper.c

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Remove unused headers from translate.c

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

hw/mips: Move address translation helpers to target/mips/

Address translation is an architectural thing (not hardware
related). Move the helpers from hw/ to target/.

As physical address and KVM are specific to system mode
emulation, restrict this file to softmmu, so it doesn't
get compiled for user-mode emulation.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Introduce cpu_supports_isa() taking CPUMIPSState argument

Introduce cpu_supports_isa() which takes a CPUMIPSState
argument, more useful at runtime when the CPU is created
(no need to call the extensive object_class_by_name()).

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201207215257.4004222[email protected]>

target/mips: Rename cpu_supports_FEAT() as cpu_type_supports_FEAT()

As cpu_supports_isa() / cpu_supports_cps_smp() take a 'cpu_type'
name argument, rename them cpu_type_supports_FEAT().

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201207215257.4004222[email protected]>

target/mips: Explicit Release 6 MMU types

As of Release 6, MMU type 4 is assigned to "Dual Variable-Page-Size
and Fixed-Page-Size TLBs" and type 2 to "Block Address Translation.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201201132817.2863301[email protected]>

target/mips: Allow executing MSA instructions on Loongson-3A4000

The Loongson-3A4000 is a GS464V-based processor with MIPS MSA ASE:
https://www.mail-archive.com/[email protected]/msg763059.html

Commit af868995e1b correctly set the 'MSA present' bit of Config3
register, but forgot to allow the MSA instructions decoding in
insn_flags, so executing them triggers a 'Reserved Instruction'.

Fix by adding the ASE_MSA mask to insn_flags.

Fixes: af868995e1b ("target/mips: Add Loongson-3 CPU definition")
Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Huacai Chen <[email protected]>
Message-Id: <20201130102228.2395100[email protected]>

target/mips: Also display exception names in user-mode

Currently MIPS exceptions are displayed as string in system-mode
emulation, but as number in user-mode.
Unify by extracting the current system-mode code as excp_name()
and use that in user-mode.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201119160536.1980329[email protected]>

target/mips: Remove unused headers from cp0_helper.c

Remove unused headers and add missing "qemu/log.h" since
qemu_log() is called.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips: Do not include CP0 helpers in user-mode emulation

CP0 helpers are restricted to system-mode emulation.
Do not intent do build cp0_helper.c in user-mode (this
allows to simplify some #ifdef'ry).

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Huacai Chen <[email protected]>
Message-Id: <20201109090422.2445166[email protected]>

target/mips: Replace magic values by CP0PM_MASK or TARGET_PAGE_BITS_MIN

Replace magic values related to page size:

  12 -> TARGET_PAGE_BITS_MIN
  13 -> CP0PM_MASK

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Huacai Chen <[email protected]>
Message-Id: <20201109090422.2445166[email protected]>

target/mips: Include "exec/memattrs.h" in 'internal.h'

mips_cpu_do_transaction_failed() requires MemTxAttrs
and MemTxResult declarations.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

target/mips/kvm: Remove unused headers

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201206233949.3783184[email protected]>

ads7846: moves from the hw/display folder to the hw/input folder.

ads7846 is a touch-screen controller that is an input device rather
than a display device, so move it to the hw/input folder.

Signed-off-by: Gan Qixin <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-Id: <20201115123503.1110665[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

CODING_STYLE.rst: Be less strict about 80 character limit

Relax the wording about line lengths a little bit; this goes with the
checkpatch changes to warn at 100 characters rather than 80.

(Compare the Linux kernel commit bdc48fa11e46f8; our coding style is
not theirs, but the rationale is good and applies to us too.)

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Markus Armbruster <[email protected]>
Reviewed-by: Michael S. Tsirkin <[email protected]>
Message-Id: <20201106112940[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

fsdev: open brace '{' following struct go on the same line

I found some style problems while check the code using checkpatch.pl.
This commit fixs the issue below:
ERROR: open brace '{' following struct go on the same line

Signed-off-by: zhouyang <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <20201209060735.2760943[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

hw/pci-host/pam: Replace magic number by PAM_REGIONS_COUNT definition

While this change helps triskaidekaphobic developers, it
is a good practice to avoid magic values and using constant
definitions instead.

Introduce the PAM_REGIONS_COUNT and use it. No logical change.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Julia Suvorova <[email protected]>
Message-Id: <20201202132038.1276404[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

hw/xen: Don't use '#' flag of printf format

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <[email protected]>
Signed-off-by: Kai Deng <[email protected]>
Message-Id: <20201104133709.3326630[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

MAINTAINERS: update my email address

I've recently switched employers and the current email address is out
of date.

Signed-off-by: Michael Roth <[email protected]>
Reviewed-by: Thomas Huth <[email protected]>
Message-Id: <20201027060253[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

qemu-options.hx: Fix minor issues in icount documentation

The documentation for the icount documentation has some minor issues:
 * in a couple of places it says "sleep=on|off" when in the context of the
   sentence it means specifically "sleep=on"
 * the synopsis line for the documentation has drifted out of sync
   with the synopsis line in the DEF() macro (used for "-help" output)
 * the synopsis line in the DEF() macro is missing a "][" between
   the sleep= part and the rr= part
 * the synopsis line doesn't indicate that rrsnapshot is an optional
   part of the rr=mode,rrfile=filename subgrouping
 * we don't document that sleep=on can't be used with shift=auto
   or align=on
 * the rr option description had some minor grammar and formatting
   errors and was a bit terse
 * in commit f1f4b57e88ff in 2015 the documentation of the sleep=
   suboption got added between the two paragraphs defining general
   behaviour of the icount option. This meant that the second
   paragraph talking about the behaviour of "this option" reads as
   if it's talking about sleep=on, when it's really describing -icount
   as a whole. The paragraph is better moved back up to above the
   sleep= section.
 * the summary text displayed in "-help" output didn't mention
   the record-and-replay part

Fix these errors.

Fixes: https://bugs.launchpad.net/qemu/+bug/1774412
Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-Id: <20201121213506[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

target/i386: tracing: format length values as hex

Three trace events had a literal "0x" prefix but the 'len' values were
formatted in decimal base.  Keep the prefix and format the numbers as
hex, as is usually the case for length of memory regions.

Signed-off-by: Dov Murik <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <20201103100745[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>

target/mips/kvm: Assert unreachable code is not used

This code must not be used outside of KVM. Abort if it is.

Signed-off-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Huacai Chen <[email protected]>
Acked-by: Paolo Bonzini <[email protected]>
Message-Id: <20200429082916[email protected]>

MAINTAINERS: [email protected] -> [email protected]

Use @kernel.org address as the main communications end point. Update the
corresponding M-entries and .mailmap (for git shortlog translation).

Signed-off-by: Huacai Chen <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Tested-by: Philippe Mathieu-Daudé <[email protected]>
Message-Id: <1607160121[email protected]>

Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-6.0-pull-request' into staging

m68k pull request 20201212

Fix for Coverity CID 1421883
Fix some comment spelling errors
Add m68k vmstate

# gpg: Signature made Sat 12 Dec 2020 17:54:28 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "[email protected]"
# gpg: Good signature from "Laurent Vivier <[email protected]>" [full]
# gpg:                 aka "Laurent Vivier <[email protected]>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <[email protected]>" [full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier/tags/m68k-for-6.0-pull-request:
  m68k: fix some comment spelling errors
  target/m68k: Add vmstate definition for M68kCPU
  target/m68k: remove useless qregs array
  hw/m68k/q800.c: Make the GLUE chip an actual QOM device
  hw/m68k/q800: Don't connect two qemu_irqs directly to the same input

Signed-off-by: Peter Maydell <[email protected]>

m68k: fix some comment spelling errors

I found that there are many spelling errors in the comments of qemu/target/m68k.
I used spellcheck to check the spelling errors and found some errors in the folder.

Signed-off-by: zhaolichang <[email protected]>
Reviewed-by: David Edmondson <[email protected]>
Reviewed-by: Philippe Mathieu-Daude<[email protected]>
Reviewed-by: Laurent Vivier<[email protected]>
Message-Id: <20201009064449[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>