tests/unit: Really build pbkdf test on macOS

Fix a typo to run the pbkdf crypto cipher tests on macOS.

 $ make check-unit
   ...
   87/102 qemu:unit / test-crypto-pbkdf      OK      2.35s   17 subtests passed

Fixes: ebe0302ac8 ("tests/unit: build pbkdf test on macOS")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/loongarch/virt: Add description for virt machine type

The description about virt machine type is removed by mistake, add
new description here. Here is output result with command
"./qemu-system-loongarch64 -M help"

Supported machines are:
none                 empty machine
virt                 QEMU LoongArch Virtual Machine (default)
x-remote             Experimental remote machine

Without the patch, it shows as follows:
Supported machines are:
none                 empty machine
virt                 (null) (default)
x-remote             Experimental remote machine

Fixes: ef2f11454c(hw/loongarch/virt: Replace Loongson IPI with LoongArch IPI)
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

hw/mips/jazz: fix typo in in-built NIC alias

Commit e104edbb9d ("hw/mips/jazz: use qemu_find_nic_info()") contained a typo
in the NIC alias which caused initialisation of the in-built dp83932 NIC to fail
when using the normal -nic user,model=dp83932 command line.

Fixes: e104edbb9d ("hw/mips/jazz: use qemu_find_nic_info()")
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

ppc: fix incorrect spelling of PowerMac

PowerMac is spelled as PowerMAC (Media Access Control) in some places.
This is misleading.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2297
Signed-off-by: Tejas Vipin <tejasvipin76@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

linux-user/syscall.c: eliminate other explicit LFS usages

Since we alwasy build with LFS enabled, and with -D_FILE_OFFSET_BITS=64
in particular, there is no need to use 64bit versions of various system
calls and constants, regular ones will do just fine.  Eliminate a few
last uses of the following constructs in linux-user/syscall.c:
  off64_t
  ftruncate64()
  lseek64()
  pread64()
  pwrite64()

This way it can be built on systems where the 64bit variants of
everything is not defined (since the system always uses 64bit
variants), such as on recent MUSL.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2215
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/syscall.c: drop 64 suffix from flock64 &Co

Since we are always building with LFS enabled, in particular
with -D_FILE_OFFSET_BITS=64, we should always have struct flock
mapped to the 64bit variant (with off64_t), and F_GETLK mapped
to F_GETLK64 etc, automatically.

So there should be no need to explicitly use the "64" suffix
for these things anymore.

Also fix a misleading comment near safe_fcntl telling us to
always use flock64 (since v2.6.0-1311-g435da5e7092a "linux-user:
Use safe_syscall wrapper for fcntl").

Reference: https://gitlab.com/qemu-project/qemu/-/issues/2215
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

mark <zlib.h> with for-crc32 in a consistent manner

in many cases, <zlib.h> is only included for crc32 function,
and in some of them, there's a comment saying that, but in
a different way.  In one place (hw/net/rtl8139.c), there was
another #include added between the comment and <zlib.h> include.

Make all such comments to be on the same line as #include, make
it consistent, and also add a few missing comments, including
hw/nvram/mac_nvram.c which uses adler32 instead.

There's no code changes.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

Merge tag 'pull-target-arm-20240919' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * target/arm: Correct ID_AA64ISAR1_EL1 value for neoverse-v1
 * target/arm: More conversions to decodetree of A64 SIMD insns
 * hw/char/stm32l4x5_usart.c: Enable USART ACK bit response
 * tests: update aarch64/sbsa-ref tests
 * kvm: minor Coverity nit fixes
 * docs/devel: Remove nested-papr.txt

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmbsIloZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3k96EACgUaTSEX1BNee0Xsk8wIHb
# KebGryNymj7LPpWdRxiyQYmZbjfelZPJW7F2tr3iGfiphz+N5TIdRDQlPrRePNg4
# 5Ure0ShRgn+RlkjFe8r9yjrr3HEAXLnVb5fgzPqGEQ+UXWRVzr72+q+wrGFVuXtn
# zfqxpc6F0TCxeyH88X6mpKkTeEjfuE++TIf885VVX6nB8qkkDUifRLjdrDcJoxp3
# BRrE0Ntob2W0NAHm/QTbATLDErsYXIzm6pX2hWy3DNEQrVHw2rJ1FAzsjt2J/8ZU
# PC7hwmkPBsrnq5wcpBtOwloHzrIYuwUBI7ABPGctCPziCSw7N55vkgUmGWZ+nYHc
# DwYGu3H84su0hBi/E9gxl8z/ATBvuAIVa1RLHvbYiwdd088DqxdBe1YLLRaZeKzP
# oldQBzVegaN1n5n8tHO43b/38V7uknu3fDXGw/OrsO5DouDAj9NoRil1caRx4ZYd
# dr4IiWKzmlW8wpWgoBnrRbycuNsi6b9HblOX1umjwubCGO+GFesBRAInUeg9gbuv
# xolfYOScUE/nkTaqulAiPGqGZV8P0fqVMbXmXuowm7iIdw3JihEUm+mU18CTPFBd
# P/6SH47lXTaQA0JJQmD4LKraZQFYzm5rlSvW/15/mnzutZXMUlWzvxK/E5fX3vhL
# VUguR6XO8Cjb0cQJWohB1w==
# =JklH
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 19 Sep 2024 14:08:42 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20240919' of https://git.linaro.org/people/pmaydell/qemu-arm: (38 commits)
  docs/devel: Remove nested-papr.txt
  target/arm: Correct ID_AA64ISAR1_EL1 value for neoverse-v1
  kvm: Remove unreachable code in kvm_dirty_ring_reaper_thread()
  kvm: Make 'mmap_size' be 'int' in kvm_init_vcpu(), do_kvm_destroy_vcpu()
  tests: drop OpenBSD tests for aarch64/sbsa-ref
  tests: expand timeout information for aarch64/sbsa-ref
  tests: add FreeBSD tests for aarch64/sbsa-ref
  tests: use default cpu for aarch64/sbsa-ref
  hw/char/stm32l4x5_usart.c: Enable USART ACK bit response
  target/arm: Convert scalar [US]QSHRN, [US]QRSHRN, SQSHRUN to decodetree
  target/arm: Convert vector [US]QSHRN, [US]QRSHRN, SQSHRUN to decodetree
  target/arm: Convert SQSHL, UQSHL, SQSHLU (immediate) to decodetree
  target/arm: Widen NeonGenNarrowEnvFn return to 64 bits
  target/arm: Convert VQSHL, VQSHLU to gvec
  target/arm: Convert handle_scalar_simd_shli to decodetree
  target/arm: Convert handle_scalar_simd_shri to decodetree
  target/arm: Convert SHRN, RSHRN to decodetree
  target/arm: Split out subroutines of handle_shri_with_rndacc
  target/arm: Push tcg_rnd into handle_shri_with_rndacc
  target/arm: Convert SSHLL, USHLL to decodetree
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

docs/devel: Remove nested-papr.txt

docs/devel/nested-papr.txt is entirely (apart from the initial
paragraph) a partial copy of the kernel documentation
https://docs.kernel.org/arch/powerpc/kvm-nested.html

There's no benefit to the QEMU docs to converting this to rST,
so instead delete it. Anybody needing to know the API and
protocol for the guest to communicate with the hypervisor
to created nested VMs should refer to the authoratitative
documentation in the kernel docs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-id: 20240816133318.3603114-1-peter.maydell@linaro.org

target/arm: Correct ID_AA64ISAR1_EL1 value for neoverse-v1

The Neoverse-V1 TRM is a bit confused about the layout of the
ID_AA64ISAR1_EL1 register, and so its table 3-6 has the wrong value
for this ID register.  Trust instead section 3.2.74's list of which
fields are set.

This means that we stop incorrectly reporting FEAT_XS as present, and
now report the presence of FEAT_BF16.

Cc: qemu-stable@nongnu.org
Reported-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240917161337.3012188-1-peter.maydell@linaro.org

kvm: Remove unreachable code in kvm_dirty_ring_reaper_thread()

The code at the tail end of the loop in kvm_dirty_ring_reaper_thread()
is unreachable, because there is no way for execution to leave the
loop. Replace it with a g_assert_not_reached().

(The code has always been unreachable, right from the start
when the function was added in commit b4420f198dd8.)

Resolves: Coverity CID 1547687
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240815131206.3231819-3-peter.maydell@linaro.org

kvm: Make 'mmap_size' be 'int' in kvm_init_vcpu(), do_kvm_destroy_vcpu()

In kvm_init_vcpu()and do_kvm_destroy_vcpu(), the return value from
  kvm_ioctl(..., KVM_GET_VCPU_MMAP_SIZE, ...)
is an 'int', but we put it into a 'long' logal variable mmap_size.
Coverity then complains that there might be a truncation when we copy
that value into the 'int ret' which we use for returning a value in
an error-exit codepath. This can't ever actually overflow because
the value was in an 'int' to start with, but it makes more sense
to use 'int' for mmap_size so we don't do the widen-then-narrow
sequence in the first place.

Resolves: Coverity CID 1547515
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240815131206.3231819-2-peter.maydell@linaro.org

tests: drop OpenBSD tests for aarch64/sbsa-ref

OpenBSD 7.3 we use is EoL. Both 7.4 and 7.5 releases do not work on
anything above Neoverse-N1 due to PAC emulation:

https://marc.info/?l=openbsd-arm&m=171050428327850&w=2

OpenBSD 7.6 is not yet released.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20240910-b4-move-to-freebsd-v5-4-0fb66d803c93@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests: expand timeout information for aarch64/sbsa-ref

'Test might timeout' means nothing. Replace it with useful information
that it is emulation of pointer authentication what makes this test run
too long.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20240910-b4-move-to-freebsd-v5-3-0fb66d803c93@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests: add FreeBSD tests for aarch64/sbsa-ref

FreeBSD has longer support cycle for stable release (14.x EoL in 2028)
than OpenBSD (7.3 we use is already EoL). Also bugfixes are backported
so we can stay on 14.x for longer.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20240910-b4-move-to-freebsd-v5-2-0fb66d803c93@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests: use default cpu for aarch64/sbsa-ref

We want to run tests using default cpu without having to remember which
Arm core is it.

Change Neoverse-N1 (old default) test to use default cpu (Neoverse-N2 at
the moment).

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20240910-b4-move-to-freebsd-v5-1-0fb66d803c93@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/char/stm32l4x5_usart.c: Enable USART ACK bit response

SW modifying USART_CR1 TE bit should cuase HW to respond by altering
USART_ISR TEACK bit, and likewise for RE and REACK bit.

This resolves some but not all issues necessary for the official STM USART
HAL driver to function as is.

Fixes: 87b77e6e01ca ("hw/char/stm32l4x5_usart: Enable serial read and write")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2540
Signed-off-by: Jacob Abrams <satur9nine@gmail.com>
Message-id: 20240911043255.51966-1-satur9nine@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert scalar [US]QSHRN, [US]QRSHRN, SQSHRUN to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-30-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert vector [US]QSHRN, [US]QRSHRN, SQSHRUN to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-29-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert SQSHL, UQSHL, SQSHLU (immediate) to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-28-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Widen NeonGenNarrowEnvFn return to 64 bits

While these functions really do return a 32-bit value,
widening the return type means that we need do less
marshalling between TCG types.

Remove NeonGenNarrowEnvFn typedef; add NeonGenOne64OpEnvFn.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240912024114.1097832-27-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert VQSHL, VQSHLU to gvec

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-26-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert handle_scalar_simd_shli to decodetree

This includes SHL and SLI.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-25-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert handle_scalar_simd_shri to decodetree

This includes SSHR, USHR, SSRA, USRA, SRSHR, URSHR,
SRSRA, URSRA, SRI.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert SHRN, RSHRN to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Split out subroutines of handle_shri_with_rndacc

There isn't a lot of commonality along the different paths of
handle_shri_with_rndacc.  Split them out to separate functions,
which will be usable during the decodetree conversion.

Simplify 64-bit rounding operations to not require double-word arithmetic.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Push tcg_rnd into handle_shri_with_rndacc

We always pass the same value for round; compute it
within common code.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert SSHLL, USHLL to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Use {, s}extract in handle_vec_simd_wshli

Combine the right shift with the extension via
the tcg extract operations.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert handle_vec_simd_shli to decodetree

This includes SHL and SLI.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert handle_vec_simd_shri to decodetree

This includes SSHR, USHR, SSRA, USRA, SRSHR, URSHR, SRSRA, URSRA, SRI.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Fix whitespace near gen_srshr64_i64

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Introduce gen_gvec_sshr, gen_gvec_ushr

Handle the two special cases within these new
functions instead of higher in the call stack.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert MOVI, FMOV, ORR, BIC (vector immediate) to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert FMOVI (scalar, immediate) to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert FMAXNMV, FMINNMV, FMAXV, FMINV to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert ADDV, *ADDLV, *MAXV, *MINV to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Simplify do_reduction_op

Use simple shift and add instead of ctpop, ctz, shift and mask.
Unlike SVE, there is no predicate to disable elements.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert UZP, TRN, ZIP to decodetree

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert TBL, TBX to decodetree

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Convert EXT to decodetree

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Use tcg_gen_extract2_i64 for EXT

The extract2 tcg op performs the same operation
as the do_ext64 function.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Use cmpsel in gen_sshl_vec

Instead of cmp+and or cmp+andc, use cmpsel.  This will
be better for hosts that use predicate registers for cmp.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Use cmpsel in gen_ushl_vec

Instead of cmp+and or cmp+andc, use cmpsel.  This will
be better for hosts that use predicate registers for cmp.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Replace tcg_gen_dupi_vec with constants in translate-sve.c

Instead of copying a constant into a temporary with dupi,
use a vector constant directly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

target/arm: Replace tcg_gen_dupi_vec with constants in gengvec.c

Instead of copying a constant into a temporary with dupi,
use a vector constant directly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240912024114.1097832-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'qemu-macppc-20240918' of https://github.com/mcayland/qemu into staging

DMA fix for macio IDE device

# -----BEGIN PGP SIGNATURE-----
#
# iQFSBAABCgA8FiEEzGIauY6CIA2RXMnEW8LFb64PMh8FAmbqoMoeHG1hcmsuY2F2
# ZS1heWxhbmRAaWxhbmRlLmNvLnVrAAoJEFvCxW+uDzIffLQH/jV4x2VOZq2EX2e1
# CZEww/xmMmWPpSsTlJLDxd2YBekPnoRv8UdXRd2MP19DhNPecu2vJXsIWbMuGbEy
# FDKoZ5pKLL7EQkFiaeKNpUKtiyCsXxybVYPMS9FZf8MhYECYu0V+5bpc/sicYv70
# B5qa2AzGc2TtY8mgKp0srR2mMV86P0P1UgMVG9E37OUE8c08GwLPDzi0TcNOQXkU
# RZFkwRW2h1482ydRrzq8FHwQXQzEvkxMWtwfPreYWXEYx0sEENBsGLf0bOoVaW3f
# +eqyFj3Y5SDJ6XTkdWcWdv1YsYZeBbTSjVQLCidac8dYIvcbig9G9HznTh8EajhA
# q40VVhc=
# =Qa5h
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 18 Sep 2024 10:43:38 BST
# gpg:                using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg:                issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" [full]
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* tag 'qemu-macppc-20240918' of https://github.com/mcayland/qemu:
  mac_dbdma: Remove leftover `dma_memory_unmap` calls

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'migration-20240917-pull-request' of https://gitlab.com/peterx/qemu into staging

Migration pull request for 9.2

- Fabiano's patch to move two tests to slow tests.
- Peter's patch to fix qatzip builds
- Stefan's multifd-zstd fix on unsigned diff comparisons
- Fea's bug fix to consistently use memattrs when map() address space
- Fabiano's bug fix on multifd race condition against receivedmap

# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCZuscdRIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wblcQD/amw/nw5LiL8/+QzJtjFTckouyHtCn++I
# x5yVJndm4M4BAOD+b6Pd5byAX1bH7eZ85368ivKLGIZep6qEvICQmw0G
# =wxVI
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 18 Sep 2024 19:31:17 BST
# gpg:                using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg:                issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [marginal]
# gpg:                 aka "Peter Xu <peterx@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D  D1A9 3B5F CCCD F3AB D706

* tag 'migration-20240917-pull-request' of https://gitlab.com/peterx/qemu:
  migration/multifd: Fix rb->receivedmap cleanup race
  migration/savevm: Remove extra load cleanup calls
  softmmu/physmem.c: Keep transaction attribute in address_space_map()
  migration/multifd: Fix loop conditions in multifd_zstd_send_prepare and multifd_zstd_recv
  migration/multifd: Fix build for qatzip
  tests/qtest/migration: Move a couple of slow tests under g_test_slow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/fp: Make mul and div tests have a longer timeout

At the moment we run all fp-test tests except for the muladd ones
with the default meson test timeout of 30s. This is plenty for
most of the test cases, but for multiplication and division we
can sometimes hit the timeout if the CI runner is going slow.

Add support to meson.build for a way to override the timeout on
a per test basis, and use it to set the timeout to 60s for
fp-test-rem, fp-test-div and fp-test-mul. We can use this new
generic mechanism also to set the timeout for mulAdd rather
than hardcoding it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240917141641.2836265-1-peter.maydell@linaro.org

migration/multifd: Fix rb->receivedmap cleanup race

Fix a segmentation fault in multifd when rb->receivedmap is cleared
too early.

After commit 5ef7e26bdb ("migration/multifd: solve zero page causing
multiple page faults"), multifd started using the rb->receivedmap
bitmap, which belongs to ram.c and is initialized and *freed* from the
ram SaveVMHandlers.

Multifd threads are live until migration_incoming_state_destroy(),
which is called after qemu_loadvm_state_cleanup(), leading to a crash
when accessing rb->receivedmap.

process_incoming_migration_co()        ...
  qemu_loadvm_state()                  multifd_nocomp_recv()
    qemu_loadvm_state_cleanup()          ramblock_recv_bitmap_set_offset()
      rb->receivedmap = NULL               set_bit_atomic(..., rb->receivedmap)
  ...
  migration_incoming_state_destroy()
    multifd_recv_cleanup()
      multifd_recv_terminate_threads(NULL)

Move the loadvm cleanup into migration_incoming_state_destroy(), after
multifd_recv_cleanup() to ensure multifd threads have already exited
when rb->receivedmap is cleared.

Adjust the postcopy listen thread comment to indicate that we still
want to skip the cpu synchronization.

CC: qemu-stable@nongnu.org
Fixes: 5ef7e26bdb ("migration/multifd: solve zero page causing multiple page faults")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240917185802.15619-3-farosas@suse.de
[peterx: added comment in migration_incoming_state_destroy()]
Signed-off-by: Peter Xu <peterx@redhat.com>

migration/savevm: Remove extra load cleanup calls

There are two qemu_loadvm_state_cleanup() calls that were introduced
when qemu_loadvm_state_setup() was still called before loading the
configuration section, so there was state to be cleaned up if the
header checks failed.

However, commit 9e14b84908 ("migration/savevm: load_header before
load_setup") has moved that configuration section part to
qemu_loadvm_state_header() which now happens before
qemu_loadvm_state_setup().

Remove the cleanup calls that are now misplaced.

Note that we didn't use Fixes because it's benign to cleanup() even if
setup() is not invoked.  So this patch is not needed for stable, as it
falls into cleanup category.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240917185802.15619-2-farosas@suse.de
[peterx: added last paragraph of commit message]
Signed-off-by: Peter Xu <peterx@redhat.com>

softmmu/physmem.c: Keep transaction attribute in address_space_map()

The follow-up transactions may use the data in the attribution, so keep
the value of attribution from the function parameter just as
flatview_translate() above.

Signed-off-by: Fea.Wang <fea.wang@sifive.com>
Cc: qemu-stable@nongnu.org
Fixes: f26404fbee ("Make address_space_map() take a MemTxAttrs argument")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20240912070404.2993976-2-fea.wang@sifive.com
Signed-off-by: Peter Xu <peterx@redhat.com>

migration/multifd: Fix loop conditions in multifd_zstd_send_prepare and multifd_zstd_recv

GitHub's CodeQL reports four critical errors which are fixed by this commit:

    Unsigned difference expression compared to zero

An expression (u - v > 0) with unsigned values u, v is only false if u == v,
so all changed expressions did not work as expected.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Link: https://lore.kernel.org/r/20240910054138.1458555-1-sw@weilnetz.de
[peterx: Fix mangled email for author]
Signed-off-by: Peter Xu <peterx@redhat.com>

mac_dbdma: Remove leftover `dma_memory_unmap` calls

These were passing a NULL buffer pointer unconditionally, which happens
to behave in a mostly benign way (except for the chance of an excess
memory region unref and a bounce buffer leak). Per the function comment,
this was never meant to be accepted though, and triggers an assertion
with the "softmmu: Support concurrent bounce buffers" change.

Given that the code in question never sets up any mappings, just remove
the unnecessary dma_memory_unmap calls along with the DBDMA_io struct
fields that are now entirely unused.

Signed-off-by: Mattias Nissler <mnissler@rivosinc.com>
Message-Id: <20240916175708.1829059-1-mnissler@rivosinc.com>
Fixes: be1e343995 ("macio: switch over to new byte-aligned DMA helpers")
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

migration/multifd: Fix build for qatzip

The qatzip series was based on an older commit, it applied cleanly even
though it has conflicts.  Neither CI nor myself found the build will break
as it's skipped by default when qatzip library was missing.

Fix the build issues.  No need to copy stable as it just landed 9.2.

Cc: Yichen Wang <yichen.wang@bytedance.com>
Cc: Bryan Zhang <bryan.zhang@bytedance.com>
Cc: Hao Xiang <hao.xiang@linux.dev>
Cc: Yuan Liu <yuan1.liu@intel.com>
Fixes: 80484f9459 ("migration: Introduce 'qatzip' compression method")
Link: https://lore.kernel.org/r/20240910210450.3835123-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>

tests/qtest/migration: Move a couple of slow tests under g_test_slow

The xbzrel and vcpu_dirty_limit are the two slowest tests from
migration-test. Move them under g_test_slow() to save about 40s per
run.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20240911145204.17692-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging

Pull request

An integer overflow fix for the last zone on a zoned block device whose
capacity is not a multiple of the zone size.

# -----BEGIN PGP SIGNATURE-----
#
# iQEzBAABCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmbpa0sACgkQnKSrs4Gr
# c8hdAwgAgp6AJVXHiPo43GbhdSsKJ2bq8DIPrsqgwAxD3rgxxRVwsWzENQgzF8O9
# qoXPmU0eqPp0zTsKTxNrlIgCpsJ3X4Oeg89u4N1xUOAJtADZGlbucUQEkAgIhWMl
# IFLjtFc7EbhWn57FmQGzANeOJOB+OumfQGeC7wbeAtUCn7g08rXtq+5I5GRKqkkP
# u1FlSassd7fyVnlVc+BT2aKANBITKhJGhYqwndvxXzMIi0L54/bQRrarLoy7oJuG
# 1k8zYLi6giUINNwYMtzn5ooXNnOSoxHKKfwcFT8hGZixwBBnCnYHjNkfs/QyvZQ7
# ZuR9mY6pqp/lg5127UlpOR7d6HADLQ==
# =709Z
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 17 Sep 2024 12:43:07 BST
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* tag 'block-pull-request' of https://gitlab.com/stefanha/qemu:
  hw/block: fix uint32 overflow

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-request-2024-09-17' of https://gitlab.com/thuth/qemu into staging

* Make all qtest targets work with "--without-default-devices"
* Replace assert(0) and assert(false) in qtests and s390x code
* Enable the device aliases for or1k
* Some other small test improvements

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmbpWwwRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbUj2A//VQwwbbuQa4FO/fu8mX0/iL43IZPLkVvC
# XPesidMwEsaNlfnUGLwjr9/F9sU7NXSkEdBWshU69ER9D4FPvRlZ6xOc0GB2HHEm
# 2zYBaQoMvB/g5/FMkp5/YqPc/FvYMxePTX0syJCUkdf9hbM3YJagUgSKaz/2ZJRu
# +wztsRMSGx9WBeabTWgbAtGlfEqtfSGdfFHbNtoEVmO/K3rvcAHJhPXZpSmdq4CV
# ymwYQ3Ul1Sdz/34TzshhkY9VvYU6n1zuB+kGrjPcQrOdBV/ukJuBiFkHfSZm/2ch
# zTqbdXvkds867vHMo9s3JeVKPa8ZytKn4ycXXgVS5AZtrnEnyHztlVHWbwbHSafF
# rVGXnE3FabzKL4sEKGzOjMegnwdWtpBNwMVKUZIgURqDXAVVR2m+lf2pW/Niz2WR
# m0LNIcg0NPvxPwuq1xLVHc3CLNSCszu4Ao5YRhKimf3hb+FvzHty3dxn+DDg4+Q4
# hHqQRcbWILhYJEwcAVkfaMTtCh/RESiNi0U7Teqvr+aqBsJP8kdCkE5rY7cqzrqn
# aDaompDZ8QG1QA1c3NaxtmNsvTvpm8gBySrqbMizo8UHQd85HDdXFkAZfI4HWKDi
# jhZAEyh1HLeXrgDT/D0WBWQdPLjDZewTvqgqT/A5XbdR1u4XYXcxwMCpIN1iKFoY
# 8qu0hIcsILM=
# =DXEK
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 17 Sep 2024 11:33:48 BST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2024-09-17' of https://gitlab.com/thuth/qemu:
  .gitlab-ci.d/crossbuilds.yml: Force 'make check' to -j2 for cross-i686-tci
  tests/functional: Move the mips64el fuloong2e test into the thorough category
  docs/fuzz: fix outdated mention to enable-sanitizers
  system: Enable the device aliases for or1k, too
  system: Sort QEMU_ARCH_VIRTIO_PCI definition
  tests/qtest: remove break after g_assert_not_reached()
  tests/qtest: replace assert(false) with g_assert_not_reached()
  include/hw/s390x: replace assert(false) with g_assert_not_reached()
  tests/unit: replace assert(0) with g_assert_not_reached()
  tests/qtest: replace assert(0) with g_assert_not_reached()
  gitlab: fix logic for changing docker tag on stable branches
  .gitlab-ci.d/buildtest: Build most targets in the build-without-defaults job
  tests/qtest: Disable numa-test if the default machine is not available
  tests/qtest/meson.build: Add more CONFIG switches checks for the x86 tests
  tests/qtest/hd-geo-test: Check for availability of "pc" machine before using it
  tests/qtest/boot-order-test: Make the machine name mandatory in this test
  tests/qtest/cdrom-test: Improve the machine detection in the cdrom test

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-vfio-20240917' of https://github.com/legoater/qemu into staging

vfio queue:

* Support for IGDs of gen 11 and later
* Coverity fixes

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmbpWl0ACgkQUaNDx8/7
# 7KFYJhAAu8Dyf96RUr4ucu/VaSlTi/rk/i5sivD4EXiCOf2qpQtyoo+C8DJmjAZg
# nC+4IpD2vu2C/xaZoQ4o6uQL7c45dOup59jcbKO+6NekF521Y6aq9OvE5v55CAwu
# R38UWI6ZX5qqyU/tA39/s7migIvCtK7VgTzEs2Lpzw8WetCFattvrEiKHt09fNdX
# kSPdFVV6FymOowAekQtI2JACr8C5nm8x9npzyL1SjauvWA70aOU9h1iHoIxHGKFF
# jlotd6v16c0Z260AUP/RDBwf8wqg2MtwBOI3qVGYD20Xd7tRQkLlFp8X5lNw4pHr
# eylqqxW3E4LJ4vSWpi4Jj2tZN5tZl8X927ew79D2gf69R8f1l+5CG/qqynMRbZ0b
# gE1E5UNfEkXYX9PMuf2uenoiahMxh7ZHwzJmtFcTLGyHGudSaUu3S7Yu5a1R0ZDf
# 8OyzE1E1X/8uCABvSgPphtSfYD9kXKiwNJSPrj3PZ1nXgNoA6BDi5sOeTPm0POBA
# IfB10VEXDd61KPFKGQqZ1Qqrvb0LsCTvFTwCHRHBEB/F/ykwTX9dzrTInkTBTiQU
# OyDjKZvR2ACjysuFxvpA2fhhF7KCmCwg7M/YsKyVLKq2r3TdBnDS1DHm7Z5ebNu4
# vgV4fsPCnjaQxOHEHZmh+rxG0E2dOGMiCieY9ooJ6jeomKQ+d60=
# =cIWS
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 17 Sep 2024 11:30:53 BST
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-vfio-20240917' of https://github.com/legoater/qemu:
  vfio/igd: correctly calculate stolen memory size for gen 9 and later
  vfio/igd: don't set stolen memory size to zero
  vfio/igd: add ID's for ElkhartLake and TigerLake
  vfio/igd: add new bar0 quirk to emulate BDSM mirror
  vfio/igd: use new BDSM register location and size for gen 11 and later
  vfio/igd: support legacy mode for all known generations
  vfio/igd: return an invalid generation for unknown devices
  hw/vfio/pci.c: Use correct type in trace_vfio_msix_early_setup()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'edk2-stable202408-20240917-pull-request' of https://gitlab.com/kraxel/qemu into staging

edk2: update to 2024-08 stable tag.
acpi: update test data (address changed due to firmware size change).

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmbpP4kACgkQTLbY7tPo
# cTjurg//WYI/pofJzsYaeYdMhFwuw1b64Hj0r50fjoOGEHiPQFLHGU9RpFmpEAKd
# lUfP+b3CztWDbK3gjRMt+1ah845SVG5VxdMPVL/F3eqKs2/eKD9ujcqIpNRGyX69
# x0e+FkohmrjCEyHNHBJjKOuqfkdqbQLtIvW1fLt8OzfsKGKvz9Kd4nZdIBX4PmDx
# sM7U44qnyLvM4AGf0QJY+v6vsqCSCy6LmgqF3vNdvnNeV09by4JvICXit486FqNK
# DrhFX16oJ/fSrJ03FSd/gps8o+YCSW7pm4Yo4GNAFX02XHCoO/lS+QraA9vs4raC
# 1FduQgV6pceR667SjuAiHsCyewVUlz7bdXgCCUtFFUzPmcBzYyOcwmEh4d15quD0
# kTiopy3Q52v2t688Se2iv08vs3sVLVCtti2UAntvhSTjVOOFUhMuNRuA4gbAk+2K
# 71sixGgbVv5+woLV1YHqJR3swSXUMD/4RglJMKjC829CWCHOOQ1lY6qgjFlj8U8+
# uSW4Kq9Mq2ORnH/8egr3ctV6uPZHq6uQt+zyzYVm5m2DmnJMFCrlMt7ABOzsVWKs
# N1Q3QEbUXqotzicCu9JHisKwp90kVp+rWgy+98xxk2P3JbiYrla31HeJPVRw4BM+
# uhphdzzUKGLrtWP8PCw+alSfW+Yt3olD87IBXOKlviah2fW9qWg=
# =4kSg
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 17 Sep 2024 09:36:25 BST
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* tag 'edk2-stable202408-20240917-pull-request' of https://gitlab.com/kraxel/qemu:
  tests/acpi: disallow acpi test data updates
  tests/acpi: update aarch64/virt/SSDT.memhp
  add loongarch binaries for edk2-stable202408
  roms: Support compile the efi bios for loongarch
  update binaries to edk2-stable202408
  update submodule and version file to edk2-stable202408
  tests/acpi: allow acpi test data updates

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-aspeed-20240916' of https://github.com/legoater/qemu into staging

aspeed queue:

* I2C support for AST2700
* Coverity fixes

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmbofzEACgkQUaNDx8/7
# 7KHo4g//RtzY1oM+5xbX7LA4Nb45EJtAs9+UvbvDF7++NF9Nd4VThdoyBSvzyqd8
# 9Z35Mfoh1xce7+Qz/QtobbRkPLKtq7rfmj4lCkXZRGR/0nbDteqyLOqDM/E/GSBc
# mEaMG9sT2L1t9SrKOYIhgoPSpS0kpJ0YHfMLt5DcTjLQ1g8OB7ByzOPoPSBzTPAf
# QLL/v0GTxdqQPRhcZJKGclkjeVwBtFpo1rbDe/tHfFKC51g3cROGyQEswuPxRqDB
# Y3CQ0WC7awqSg7WAUwTfyb6LNSmYoiycGKv/gi06kc/mxjpf2qQ2khX4diiPoOj0
# Ak1b/dv2DWKE8LDYw7ew44UdPyIhGhgFeYeJ1olz5oLUcdcd4PuBWBvLUgpJKEfk
# HRXcJyhat3rwWGYzrdCJbBPN6CPncWjyifg1X6jK6Eu4wnfdpB9m64xFg8TpALaz
# SRZGg0ahldBwU6jjDO3x/RMWzKCtzwAjDuLfxSlqDGPx5OL+0dDDEa+xj45VzzBZ
# aT5Kcy9ga9DgRUw4wds3NHz9uCxwXoktDkW3vKMeMdftAf6er+Inhe8FHer/JSh4
# wuCxUDYIUSate5QoVucHAAM3DqOCQ1ascugufluXAR4StJ/u2b3SXU881C7v4crP
# NDncQEsWgya+Ykv9lXgulDxZrc8qsSmj4aoRNtJHaGsxmb4RwSY=
# =NyK5
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 16 Sep 2024 19:55:45 BST
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@kaod.org>" [undefined]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-aspeed-20240916' of https://github.com/legoater/qemu:
  machine_aspeed.py: Update to test I2C for AST2700
  aspeed: Add tmp105 in i2c bus 0 for AST2700
  aspeed/soc: Support I2C for AST2700
  aspeed/soc: Introduce a new API to get the device irq
  hw/i2c/aspeed: Add support for 64 bit addresses
  hw/i2c/aspeed: Add support for Tx/Rx buffer 64 bit addresses
  hw/i2c/aspeed: Add AST2700 support
  hw/i2c/aspeed: Introduce a new dma_dram_offset attribute in AspeedI2Cbus
  hw/i2c/aspeed: Support discontinuous poll buffer memory region of I2C bus
  hw/i2c/aspeed: Introduce a new bus pool buffer attribute in AspeedI2Cbus
  hw/i2c/aspeed: Support discontinuous register memory region of I2C bus
  hw/gpio/aspeed_gpio: Avoid shift into sign bit

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

.gitlab-ci.d/crossbuilds.yml: Force 'make check' to -j2 for cross-i686-tci

In commit 1374ed49e1453c300 we forced the cross-i686-tci job to -j1 to
see if this helped with test timeouts. It seems to help with that but
on the other hand we now sometimes run into the overall 60 minute
job timeout. Try -j2 instead.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240916134913.2540486-1-peter.maydell@linaro.org

hw/block: fix uint32 overflow

The product bs->bl.zone_size * (bs->bl.nr_zones - 1) may overflow
uint32.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-id: 20240917080356.270576-2-frolov@swemel.ru
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

.gitlab-ci.d/crossbuilds.yml: Force 'make check' to -j2 for cross-i686-tci

In commit 1374ed49e1453c300 we forced the cross-i686-tci job to -j1 to
see if this helped with test timeouts. It seems to help with that but
on the other hand we now sometimes run into the overall 60 minute
job timeout. Try -j2 instead.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20240916134913.2540486-1-peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/functional: Move the mips64el fuloong2e test into the thorough category

Commit d2fce37597c2 added a test that downloads an asset from the
internet, so this test should not be run by default anymore and be
put into the thorough category instead.

Message-ID: <20240913175140.3329083-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

docs/fuzz: fix outdated mention to enable-sanitizers

This options has been removed at cb771ac1f5 (meson: Split
--enable-sanitizers to --enable-{asan, ubsan}, 2024-08-13), so let's
update its last standing mention in the docs.

Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Reviewed-by: Brian Cain <bcain@quicinc.com>
Message-ID: <0ecf4e1ab26771009d74a2ce61e7c17ddc586ef7.1726226316.git.quic_mathbern@quicinc.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

system: Enable the device aliases for or1k, too

Now that we've got a "virt" machine for or1k that supports PCI
too (commit 40fef82c4e "hw/openrisc: Add PCI bus support to virt")
we can also enable the virtio device aliases like we do on other
similar platforms. This will e.g. help to run the iotests with
qemu-system-or1k later.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240705090808.1305765-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240705124528.97471-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

system: Sort QEMU_ARCH_VIRTIO_PCI definition

Sort the QEMU_ARCH_VIRTIO_PCI to simplify adding/removing entries.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240705124528.97471-2-philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest: remove break after g_assert_not_reached()

This patch is part of a series that moves towards a consistent use of
g_assert_not_reached() rather than an ad hoc mix of different
assertion mechanisms.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20240912073921.453203-36-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest: replace assert(false) with g_assert_not_reached()

This patch is part of a series that moves towards a consistent use of
g_assert_not_reached() rather than an ad hoc mix of different
assertion mechanisms.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20240912073921.453203-24-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

include/hw/s390x: replace assert(false) with g_assert_not_reached()

This patch is part of a series that moves towards a consistent use of
g_assert_not_reached() rather than an ad hoc mix of different
assertion mechanisms.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20240912073921.453203-15-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/unit: replace assert(0) with g_assert_not_reached()

This patch is part of a series that moves towards a consistent use of
g_assert_not_reached() rather than an ad hoc mix of different
assertion mechanisms.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20240912073921.453203-14-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest: replace assert(0) with g_assert_not_reached()

This patch is part of a series that moves towards a consistent use of
g_assert_not_reached() rather than an ad hoc mix of different
assertion mechanisms.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20240912073921.453203-13-pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

gitlab: fix logic for changing docker tag on stable branches

This fixes:

  commit e28112d00703abd136e2411d23931f4f891c9244
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Thu Jun 8 17:40:16 2023 +0100

    gitlab: stable staging branches publish containers in a separate tag

Due to a copy+paste mistake, that commit included "QEMU_JOB_SKIPPED"
in the final rule that was meant to be a 'catch all' for staging
branches.

As a result stable branches are still splattering dockers from the
primary development branch.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20240906140958.84755-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

.gitlab-ci.d/buildtest: Build most targets in the build-without-defaults job

Now that all the qtests are able to deal with builds that use the
"--without-default-devices" configuration switch, we can add all
targets to the build-without-defaults job. But to avoid burning too
much CI cycles in this job, exclude some targets where we already
have similar test coverage by a related target.

Message-ID: <20240905191434.694440-9-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

vfio/igd: correctly calculate stolen memory size for gen 9 and later

We have to update the calculation of the stolen memory size because
we've seen devices using values of 0xf0 and above for the graphics mode
select field. The new calculation was taken from the linux kernel [1].

[1] https://github.com/torvalds/linux/blob/7c626ce4bae1ac14f60076d00eafe71af30450ba/arch/x86/kernel/early-quirks.c#L455-L460

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: don't set stolen memory size to zero

The stolen memory is required for the GOP (EFI) driver and the Windows
driver. While the GOP driver seems to work with any stolen memory size,
the Windows driver will crash if the size doesn't match the size
allocated by the host BIOS. For that reason, it doesn't make sense to
overwrite the stolen memory size. It's true that this wastes some VM
memory. In the worst case, the stolen memory can take up more than a GB.
However, that's uncommon. Additionally, it's likely that a bunch of RAM
is assigned to VMs making use of GPU passthrough.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: add ID's for ElkhartLake and TigerLake

ElkhartLake and TigerLake devices were tested in legacy mode with Linux
and Windows VMs. Both are working properly. It's likely that other Intel
GPUs of gen 11 and 12 like IceLake device are working too. However,
we're only adding known good devices for now.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: add new bar0 quirk to emulate BDSM mirror

The BDSM register is mirrored into MMIO space at least for gen 11 and
later devices. Unfortunately, the Windows driver reads the register
value from MMIO space instead of PCI config space for those devices [1].
Therefore, we either have to keep a 1:1 mapping for the host and guest
address or we have to emulate the MMIO register too. Using the igd in
legacy mode is already hard due to it's many constraints. Keeping a 1:1
mapping may not work in all cases and makes it even harder to use. An
MMIO emulation has to trap the whole MMIO page. This makes accesses to
this page slower compared to using second level address translation.
Nevertheless, it doesn't have any constraints and I haven't noticed any
performance degradation yet making it a better solution.

[1] https://github.com/projectacrn/acrn-hypervisor/blob/5c351bee0f6ae46250eefc07f44b4a31e770f3cf/devicemodel/hw/pci/passthrough.c#L650-L653

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: use new BDSM register location and size for gen 11 and later

Intel changed the location and size of the BDSM register for gen 11
devices and later. We have to adjust our emulation for these devices to
properly support them.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: support legacy mode for all known generations

We're soon going to add support for legacy mode to ElkhartLake and
TigerLake devices. Those are gen 11 and 12 devices. At the moment, all
devices identified by our igd_gen function do support legacy mode. This
won't change when adding our new devices of gen 11 and 12. Therefore, it
makes more sense to accept legacy mode for all known devices instead of
maintaining a long list of known good generations. If we add a new
generation to igd_gen which doesn't support legacy mode for some reason,
it'll be easy to advance the check to reject legacy mode for this
specific generation.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

vfio/igd: return an invalid generation for unknown devices

Intel changes it's specification quite often e.g. the location and size
of the BDSM register has change for gen 11 devices and later. This
causes our emulation to fail on those devices. So, it's impossible for
us to use a suitable default value for unknown devices. Instead of
returning a random generation value and hoping that everthing works
fine, we should verify that different devices are working and add them
to our list of known devices.

Signed-off-by: Corvin Köhne <c.koehne@beckhoff.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>

hw/vfio/pci.c: Use correct type in trace_vfio_msix_early_setup()

The tracepoint trace_vfio_msix_early_setup() uses "int" for the type
of the table_bar argument, but we use this to print a uint32_t.
Coverity warns that this means that we could end up treating it as a
negative number.

We only use this in printing the value in the tracepoint, so
mishandling it as a negative number would be harmless, but it's
better to use the right type in the tracepoint.  Use uint64_t to
match how we print the table_offset in the vfio_msix_relo()
tracepoint.

Resolves: Coverity CID 1547690
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>

tests/acpi: disallow acpi test data updates

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

tests/acpi: update aarch64/virt/SSDT.memhp

Address (and checksum) change due to firmware image size change.

 DefinitionBlock ("", "SSDT", 1, "BOCHS ", "NVDIMM", 0x00000001)
 [ ... ]
-    Name (MEMA, 0x43C80000)
+    Name (MEMA, 0x43DA0000)

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

add loongarch binaries for edk2-stable202408

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

roms: Support compile the efi bios for loongarch

Added loongarch UEFI BIOS support to compiled scripts.

  UEFI code images require 16M alignment, flash images require
16M alignment, under the loongarch architecture.This is agreed
upon when the firmware is loaded in QEMU under Loongarch.

  The naming of UEFI under loongarch refers to the x86 and arm naming methods,
and the UEFI image names in x86 and arm are:
edk2-i386-code.fd
edk2-i386-vars.fd
edk2-arm-code.fd
edk2-arm-vars.fd
So on loongarch, we named it:
edk2-loongarch64-code.fd
edk2-loongarch64-vars.fd

Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Message-ID: <20240724022245.1317884-1-lixianglai@loongson.cn>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

update binaries to edk2-stable202408

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

update submodule and version file to edk2-stable202408

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

tests/acpi: allow acpi test data updates

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

tests/qtest: Disable numa-test if the default machine is not available

The numa-test needs a default machine in the target binary to work
successfully, so don't try to run this test if the corresponding
machine has not been enabled, e.g. when QEMU has been configured with
"--without-default-devices".

Message-ID: <20240905191434.694440-7-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest/meson.build: Add more CONFIG switches checks for the x86 tests

When configuring QEMU with "--without-default-devices", currently a lot
of the x86 qtests are failing since they silently assume that a certain
device or the i440fx pc machine is available. Add more checks for CONFIG
switches here to not run those tests in case the corresponding device is
not available.

Message-ID: <20240905191434.694440-6-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest/hd-geo-test: Check for availability of "pc" machine before using it

In case QEMU has been configured with "--without-default-devices", the
"pc" machine type might be missing in the binary. We should check for
its availability before using it.

Message-ID: <20240905191434.694440-5-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest/boot-order-test: Make the machine name mandatory in this test

Let's make sure that we always pass a machine name to the test_boot_orders()
function, so we can check whether the machine is available in the binary
and skip the test in case it is not included in the build.

Message-ID: <20240905191434.694440-4-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

tests/qtest/cdrom-test: Improve the machine detection in the cdrom test

When configuring QEMU with the --without-default-devices switch, these
tests are currently failing since they assume that the "pc" and "q35"
machines are always available. Add some proper checks to make the test
work without these machines, too.

Message-ID: <20240905191434.694440-3-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

machine_aspeed.py: Update to test I2C for AST2700

Update test case to test lm75 temperature sensor.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>

aspeed: Add tmp105 in i2c bus 0 for AST2700

ASPEED SDK add lm75 in i2c bus 0 for AST2700.
LM75 is compatible with TMP105 driver.

Introduce a new i2c init function and
add tmp105 device model in i2c bus 0.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>

aspeed/soc: Support I2C for AST2700

Add I2C model for AST2700 I2C support.
The I2C controller registers base address is start at
0x14C0_F000 and its address space is 0x2000.

The AST2700 I2C controller has one source INTC per bus.
I2C buses interrupt are connected to GICINT130_INTC
from bit 0 to bit 15.
I2C bus 0 is connected to GICINT130_INTC at bit 0.
I2C bus 15 is connected to GICINT130_INTC at bit 15.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>

aspeed/soc: Introduce a new API to get the device irq

Currently, users can set the INTC mapping table with
enumerated device id and device irq to get the INTC orgate
input pins. However, some devices use the continuous source numbers in the
same INTC orgate. To reduce the enumerated device id definition,
create a new API to get the INTC orgate input pin
if users only provide the device id with its bus number index.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>

hw/i2c/aspeed: Add support for 64 bit addresses

ASPEED AST2700 SOC is a 64 bits quad core CPUs (Cortex-a35)
and the base address of dram is "0x4 00000000" which
is 64bits address.

The AST2700 support the maximum DRAM size is 8 GB.
The DRAM physical address range is from "0x4_0000_0000" to
"0x5_FFFF_FFFF".

The DRAM offset range is from "0x0_0000_0000" to
"0x1_FFFF_FFFF" and it is enough to use bits [33:0]
saving the dram offset.

Therefore, save the high part physical address bit[1:0]
of Tx/Rx buffer address as dma_dram_offset bit[33:32].
It does not need to decrease the dram physical
high part address for DMA operation.
(high part physical address bit[7:0] – 4)

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>