Merge tag 'pull-qapi-2024-10-02' of https://repo.or.cz/qemu/armbru into staging

QAPI patches patches for 2024-10-02

# -----BEGIN PGP SIGNATURE-----
#
# iQJGBAABCAAwFiEENUvIs9frKmtoZ05fOHC0AOuRhlMFAmb88k4SHGFybWJydUBy
# ZWRoYXQuY29tAAoJEDhwtADrkYZTr3sP/iT8x2pSy6MMOLnuzo/jsMp238U5kb88
# LjDPkUkYhg9m9Z05Odm8g2X3ZjAM0ZrxnSjCZ+yb3HcvaaVN29156ebueJetYSLY
# 4lN1IMBdQcVJuRWAaURd42ADPEaVn3+xk9eZtaakxP3a9PnoqDIvc+WbEVFgWkPs
# l2CgEqsoEaX8Ui1lDDJIEiZhjCVd4Gj3rT9BuchAtljmiO59c91O+H+OSg1I8YF4
# 46xa0rulmYQSv18fEt7OVfwVTJMiiXXXX4cE1zEneGzkvAnv1NRjAH3E4O9Wf97Q
# cNFOEXrhJvXTAh5sVF+1Mp4JktYsKBgUADwqPJJ26SXeuum+15HXt038cNqJlzyl
# yr+fg2vubI5iVQyMFP+Rlvx54d94C2NAqa/JudfL3iu7uJKKNxzjFdJqhwNFPvaL
# WVzBX66+ZV97D/ujqige99As58RZXFlR2ccLELsg7B6T307MFI/XhfFeG2WFViZi
# fFadS9OfNfhzpo/HfOPtJXnU7cBviwormIY7tKuo7jhyXV8YvKvvVpMMYxKJk68o
# wVUC6OBEQ+NqSCjUW+LNzIdpEDk6qL01rIgD48ywv0aV8FhUiVURVLBu6loEo/ib
# pBR/W6k2AudnJ+mLfkIGCXSSu3RWNx5yayS3LcEE1dKQJquyn8qJk8GMEwhRM8tF
# /NO4P74VmUUJ
# =f3Zh
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 02 Oct 2024 08:12:14 BST
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* tag 'pull-qapi-2024-10-02' of https://repo.or.cz/qemu/armbru:
  qapi/block-core: Drop drive-backup's "Any other error" documentation
  qapi: Drop "with an explanation" from error descriptions
  qapi: Document QCryptodevBackendServiceType
  qapi/cxl: Supply missing member documentation
  qapi/rocker: Supply missing member documentation
  qapi/pci: Supply missing member documentation
  qapi/introspect: Supply missing member documentation
  qapi/crypto: Supply missing member documentation
  qapi/common: Supply missing member documentation
  qapi/char: Supply missing member documentation

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-riscv-to-apply-20241002' of https://github.com/alistair23/qemu into staging

RISC-V PR for 9.2

* Add a property to set vl to ceil(AVL/2)
* Enable numamem testing for RISC-V
* Consider MISA bit choice in implied rule
* Fix the za64rs priv spec requirements
* Enable Bit Manip for OpenTitan Ibex CPU
* Fix the group bit setting of AIA with KVM
* Stop timer with infinite timecmp
* Add 'fcsr' register to QEMU log as a part of F extension
* Fix riscv64 build on musl libc
* Add preliminary textra trigger CSR functions
* RISC-V bsd-user support
* Respect firmware ELF entry point
* Add Svvptc extension support
* Fix masking of rv32 physical address
* Fix linking problem with semihosting disabled
* Fix IMSIC interrupt state updates

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEaukCtqfKh31tZZKWr3yVEwxTgBMFAmb83lYACgkQr3yVEwxT
# gBNndBAAmh66yWt9TeTHlQ/rgBhx2nUMBbfICBWQyNGvPlslffwrNoLkh8jpkuiP
# PD0RQArAAGeM09cgCZCu14JzIBmmNiGgUxsUnqOZvUw18uIlLFlpt/tiT7iGw/Xb
# pfI7waF66/FPXBErY2yiw9/RGQLlkiGNBC9FNYrD/kCahf9MSIobv85tOgSQ2qjH
# nOJ+UBN0TQ1x0Z5lJMj9Pzl1WDvelRnCkYI5nXg1heKG73Hm7GmHt99QpTV2Okqn
# T3jFzEfMTQeHO4nC/X2pbaesE62K+mTg/FZpId2iV8lMCSm1zKof+xJ4boKM9RB2
# 0HjXAT+MveLuLUNtgfbV9C+VgU25M+wnfy5tH0l801Y/Gez8Q1fbK2uykuiyiUSy
# MNNk/KzmOYuffwItuyeL3mmWHXsN+izUIeMmMxfL9X9nssZXRsrDXc+MByS7w0fk
# QOeZmXHTxXwxFymr0t0DLK2eKEG6cqQty1KWp6iLx3uwnMTGo+576P41Q+boj64s
# VllWzmuR0Ta0xuSR4sDvEFCO7OCFEgVdn1j0FvhRFskPEDrbQgXRLq8i3awtU6z1
# NIh+A30XeK+EZLv0sEje6gav5lZHWMfAeCOKJstVzOl8+NQibuKTUrsqLgTrBK6K
# plw8qwvZYjSnYErzHfywlq9ArufIvOHYcx9Nb76tLNy9E+y01yo=
# =15Hm
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 02 Oct 2024 06:47:02 BST
# gpg:                using RSA key 6AE902B6A7CA877D6D659296AF7C95130C538013
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 6AE9 02B6 A7CA 877D 6D65  9296 AF7C 9513 0C53 8013

* tag 'pull-riscv-to-apply-20241002' of https://github.com/alistair23/qemu: (35 commits)
  bsd-user: Add RISC-V 64-bit Target Configuration and Debug XML Files
  bsd-user: Implement set_mcontext and get_ucontext_sigreturn for RISCV
  bsd-user: Implement 'get_mcontext' for RISC-V
  bsd-user: Implement RISC-V signal trampoline setup functions
  bsd-user: Define RISC-V signal handling structures and constants
  bsd-user: Add generic RISC-V64 target definitions
  bsd-user: Define RISC-V system call structures and constants
  bsd-user: Define RISC-V VM parameters and helper functions
  bsd-user: Add RISC-V thread setup and initialization support
  bsd-user: Implement RISC-V sysarch system call emulation
  bsd-user: Add RISC-V signal trampoline setup function
  bsd-user: Define RISC-V register structures and register copying
  bsd-user: Add RISC-V ELF definitions and hardware capability detection
  bsd-user: Implement RISC-V TLS register setup
  bsd-user: Implement RISC-V CPU register cloning and reset functions
  bsd-user: Add RISC-V CPU execution loop and syscall handling
  bsd-user: Implement RISC-V CPU initialization and main loop
  hw/intc: riscv-imsic: Fix interrupt state updates.
  target/riscv/cpu_helper: Fix linking problem with semihosting disabled
  target/riscv32: Fix masking of physical address
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Merge tag 'pull-request-2024-10-02' of https://gitlab.com/thuth/qemu into staging

* Fix mips64el in the CI
* Remove unused sh4eb target
* Add an additional EXECUTE TCG test for s390x

# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCAAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmb9QdARHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbWQsQ/+NyTWEdTVXYLKGjv17QE3s5irfH6pT6WB
# Ea5HOkiT7mAOJZEzHS38fUzgySFA24MOpeqqPK6Dyi6O/fpXKkJL+e1Km2qWvc66
# NCKsicj271+AWHOrT2KnWnk6zRnxJBpeV/c/ajJnyjTAOYc5ItBPeNlfDsj1+sNP
# UzQ3mTmiw6M9jDntvJCtC99NyBBZTuyFLp/5ZA/fXCJdmzVEHEOU/rjWuVIq1nDC
# zm3MxUZwheHAkJ5wk7O+T3Qsio5iGBCeWBeNsH6hy6KyAf7fhU3h5vn4zaVzKQPB
# 88I8BbPok5sIVB1ODseIZLiF4IWZt8cPV00SJVSNebyufJ6wsuEFLT+nbMcQy4K1
# hZMvqA2WY+MGyThF67iC8OtaeDksUBoYw6RM0cCGlRQ2fsR4QAahk8Cg1BIG6Hn7
# hYtKu68Rs+vrxH6lgjq9wWBrafl7MbROQxlTm8KsJJdHigQ4UUB23+OKKcJrePi+
# vQpFEWIEgLVrxUrnwyJPulqG5fVXNkOWYfu1Y/WARr7uNe4gf86UvBunQmSxlV3Y
# 4Q1iQlKaVznzyUe8QEvP8LpZRols0v5BT9zpF0TJwC/vk+SjuAtz4/URWvLn5Qwd
# zIhWp9ZUxHUJgCqiciNHAY1AzsG2CiSuihKgTbPBZo0b3oYMB7sMaDLq733M98k2
# lI6f5DjIyhg=
# =V9nZ
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 02 Oct 2024 13:51:28 BST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2024-10-02' of https://gitlab.com/thuth/qemu:
  tests/tcg/s390x: Test modifying an EXECUTE target
  qemu-timer: Remove unused timer functions
  Remove the unused sh4eb target
  configs: Fix typo in the sh4-softmmu devices config file
  testing: bump mips64el cross to bookworm and fix package list

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

tests/tcg/s390x: Test modifying an EXECUTE target

QEMU correctly implements the tracking of EXECUTE target modifications
by storing the instruction text in env->ex_value and tb->cs_base, the
latter of which is used for lookups.

Still, EXECUTE is a tricky corner of the s390x emulation, which can
benefit from having a regression test.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20241001145634.9786-1-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

qemu-timer: Remove unused timer functions

qemu_clock_get_main_loop_timerlist and timerlist_get_clock have been
unused since they were originally added in
  ff83c66ecc ("aio / timers: Split QEMUClock into QEMUClock and QEMUTimerList")

Remove them.

Signed-off-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Message-ID: <20240919144124.309646-1-dave@treblig.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>

Remove the unused sh4eb target

Since the "shix" machine has been removed, the "r2d" machine is the only
machine that is still available for the sh4 and sh4eb targets. However,
the "r2d" machine apparently does not work in big endian mode, see here:

 https://lore.kernel.org/qemu-devel/87a5fwjjew.wl-ysato@users.sourceforge.jp/

So there is no working machine left in the sh4eb-softmmu target, i.e. it
is currently completely useless. Thus remove it from the configuration
now. (Note: The linux-user binary is not removed since it might still
be used to run sh4 binaries in big endian mode).

Message-ID: <20240926105843.81385-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

configs: Fix typo in the sh4-softmmu devices config file

This is the config file for the little endian target, so there
should not be a "eb" in here.

Message-ID: <20240920161045.84622-1-thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Thomas Huth <thuth@redhat.com>

testing: bump mips64el cross to bookworm and fix package list

The mips64el cross setup is very broken for bullseye which has now
entered LTS support so is unlikely to be fixed. While we still can't
build the container with all packages for bookworm due to a single
missing dependency that will hopefully get fixed in due course. For
the sake of keeping the CI green we disable the problematic packages
via the lcitool's mappings.yml file.

See also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081535

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[thuth: Disable the problematic packages via lcitool's mappings.yml]
Message-ID: <20241002080333.127172-1-thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>

qapi/block-core: Drop drive-backup's "Any other error" documentation

We've always been rather lax about documenting errors.  Many "Errors"
sections are obviously not exhaustive.  Only drive-backup is explicit
about this: "Any other error returns a GenericError".

Not useful.  Drop.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240911132459.2548063-3-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>

qapi: Drop "with an explanation" from error descriptions

All errors come with an explanation, namely the human-readable error
message in the error response's @desc member.  Drop the redundant
"with an explanation" phrase.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240911132459.2548063-2-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>

qapi: Document QCryptodevBackendServiceType

QCryptodevBackendServiceType was introduced by
bc304a6442e (cryptodev: Introduce server type in QAPI). However there
is a lack of member description.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Drop QCryptodevBackendServiceType from pragma documentation-exceptions]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240911112545.2248881-9-armbru@redhat.com>

qapi/cxl: Supply missing member documentation

Since we neglect to document a member of CxlCorErrorType, its
description in the QEMU QMP Reference manual is "Not documented".  Fix
that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240911112545.2248881-8-armbru@redhat.com>

qapi/rocker: Supply missing member documentation

Since we neglect to document the argument of query-rocker and
query-rocker-ports, their description in the QEMU QMP Reference manual
is "Not documented".  Fix that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240911112545.2248881-7-armbru@redhat.com>

qapi/pci: Supply missing member documentation

Since we neglect to document a member of PciMemoryRegion, its
description in the QEMU QMP Reference manual is "Not documented".  Fix
that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240911112545.2248881-6-armbru@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

qapi/introspect: Supply missing member documentation

Since we neglect to document the members of JSONType, their
description in the QEMU QMP Reference manual is "Not documented".  Fix
that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20240911112545.2248881-5-armbru@redhat.com>

qapi/crypto: Supply missing member documentation

Since we neglect to document the members of QCryptoAkCipherKeyType,
their description in the QEMU QMP Reference manual is "Not
documented".  Fix that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240911112545.2248881-4-armbru@redhat.com>

qapi/common: Supply missing member documentation

Since we neglect to document the members of GrabToggleKeys, their
description in the QEMU QMP Reference manual is "Not documented".  Fix
that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240911112545.2248881-3-armbru@redhat.com>

qapi/char: Supply missing member documentation

Since we neglect to document several members of ChardevBackendKind,
their description in the QEMU QMP Reference manual is "Not
documented".  Fix that, and improve the existing member documentation.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20240911112545.2248881-2-armbru@redhat.com>

bsd-user: Add RISC-V 64-bit Target Configuration and Debug XML Files

Added configuration for RISC-V 64-bit target to the build system.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-18-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement set_mcontext and get_ucontext_sigreturn for RISCV

Added implementations for 'set_mcontext' and 'get_ucontext_sigreturn'
functions for RISC-V architecture,
Both functions ensure that the CPU state and user context are properly
managed.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-17-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement 'get_mcontext' for RISC-V

Added the 'get_mcontext' function to extract and populate
the RISC-V machine context from the CPU state.
This function is used to gather the current state of the
general-purpose registers and store it in a 'target_mcontext_'
structure.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
Co-authored-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-16-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement RISC-V signal trampoline setup functions

Added functions for setting up the RISC-V signal trampoline and signal
frame:

'set_sigtramp_args()': Configures the RISC-V CPU state with arguments
for the signal handler. It sets up the registers with the signal
number,pointers to the signal info and user context, the signal handler
address, and the signal frame pointer.

'setup_sigframe_arch()': Initializes the signal frame with the current
machine context.This function copies the context from the CPU state to
the signal frame, preparing it for the signal handler.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
Co-authored-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-15-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Define RISC-V signal handling structures and constants

Added definitions for RISC-V signal handling, including structures
and constants for managing signal frames and context

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-14-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Add generic RISC-V64 target definitions

Added a generic definition for RISC-V64 target-specific details.
Implemented the 'regpairs_aligned' function,which returns 'false'
to indicate that register pairs are not aligned in the RISC-V64 ABI.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-13-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Define RISC-V system call structures and constants

Introduced definitions for the RISC-V system call interface, including
the 'target_pt_regs' structure that outlines the register storage
layout during a system call.
Added constants for hardware machine identifiers.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Jessica Clarke <jrtc27@jrtc27.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-12-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Define RISC-V VM parameters and helper functions

Added definitions for RISC-V VM parameters, including maximum and
default sizes for text, data, and stack, as well as address space
limits.
Implemented helper functions for retrieving and setting specific
values in the CPU state, such as stack pointer and return values.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-11-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Add RISC-V thread setup and initialization support

Implemented functions for setting up and initializing threads in the
RISC-V architecture.
The 'target_thread_set_upcall' function sets up the stack pointer,
program counter, and function argument for new threads.
The 'target_thread_init' function initializes thread registers based on
the provided image information.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Jessica Clarke <jrtc27@jrtc27.com>
Co-authored-by: Kyle Evans <kevans@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-10-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement RISC-V sysarch system call emulation

Added the 'do_freebsd_arch_sysarch' function to emulate the 'sysarch'
system call for the RISC-V architecture.
Currently, this function returns '-TARGET_EOPNOTSUPP' to indicate that
the operation is not supported.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-9-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Add RISC-V signal trampoline setup function

Implemented the 'setup_sigtramp' function for setting up the signal
trampoline code in the RISC-V architecture.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-8-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Define RISC-V register structures and register copying

Added definitions for RISC-V register structures, including
general-purpose registers and floating-point registers, in
'target_arch_reg.h'. Implemented the 'target_copy_regs' function to
copy register values from the CPU state to the target register
structure, ensuring proper endianness handling using 'tswapreg'.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-7-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Add RISC-V ELF definitions and hardware capability detection

Introduced RISC-V specific ELF definitions and hardware capability
detection.
Additionally, a function to retrieve hardware capabilities
('get_elf_hwcap') is implemented, which returns the common bits set in
each CPU's ISA strings.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Kyle Evans <kevans@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-6-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement RISC-V TLS register setup

Included the prototype for the 'target_cpu_set_tls' function in the
'target_arch.h' header file. This function is responsible for setting
the Thread Local Storage (TLS) register for RISC-V architecture.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-5-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement RISC-V CPU register cloning and reset functions

Added functions for cloning CPU registers and resetting the CPU state
for RISC-V architecture.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-4-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Add RISC-V CPU execution loop and syscall handling

Implemented the RISC-V CPU execution loop, including handling various
exceptions and system calls. The loop continuously executes CPU
instructions,processes exceptions, and handles system calls by invoking
FreeBSD syscall handlers.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Jessica Clarke <jrtc27@jrtc27.com>
Co-authored-by: Kyle Evans <kevans@FreeBSD.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-3-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

bsd-user: Implement RISC-V CPU initialization and main loop

Added the initial implementation for RISC-V CPU initialization and main
loop. This includes setting up the general-purpose registers and
program counter based on the provided target architecture definitions.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Ajeet Singh <itachis@FreeBSD.org>
Co-authored-by: Jessica Clarke <jrtc27@jrtc27.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240916155119.14610-2-itachis@FreeBSD.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/intc: riscv-imsic: Fix interrupt state updates.

The IMSIC state variable eistate[] is modified by CSR instructions
within a range dedicated to the local CPU and by MMIO writes from any CPU.
Access to eistate from MMIO accessors is protected by the BQL, but
read-modify-write (RMW) sequences from CSRRW do not acquire the BQL,
making the RMW sequence vulnerable to a race condition with MMIO access
from a remote CPU.

This race can manifest as missing IPI or MSI in multi-CPU systems, eg:

[   43.008092] watchdog: BUG: soft lockup - CPU#2 stuck for 27s! [kworker/u19:1:52]
[   43.011723] CPU: 2 UID: 0 PID: 52 Comm: kworker/u19:1 Not tainted 6.11.0-rc6
[   43.013070] Workqueue: events_unbound deferred_probe_work_func
[   43.018776] [<ffffffff800b4a86>] smp_call_function_many_cond+0x190/0x5c2
[   43.019205] [<ffffffff800b4f28>] on_each_cpu_cond_mask+0x20/0x32
[   43.019447] [<ffffffff8001069a>] __flush_tlb_range+0xf2/0x190
[   43.019683] [<ffffffff80010914>] flush_tlb_kernel_range+0x20/0x28

The interrupt line raise/lower sequence was changed to prevent a race
between the evaluation of the eistate and the execution of the qemu_irq
raise/lower, ensuring that the interrupt line is not incorrectly
deactivated based on a stale topei check result. To avoid holding BQL
all modifications of eistate are converted to atomic operations.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <a7604e4d61068ca4d384ae2a1377e1521d4d0235.1725651699.git.tjeznach@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/cpu_helper: Fix linking problem with semihosting disabled

If QEMU has been configured with "--without-default-devices", the build
is currently failing with:

 /usr/bin/ld: libqemu-riscv32-softmmu.a.p/target_riscv_cpu_helper.c.o:
  in function `riscv_cpu_do_interrupt':
 .../qemu/target/riscv/cpu_helper.c:1678:(.text+0x2214): undefined
  reference to `do_common_semihosting'

We always want semihosting to be enabled if TCG is available, so change
the "imply" statements in the Kconfig file to "select", and make sure to
avoid calling into do_common_semihosting() if TCG is not available.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240906094858.718105-1-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv32: Fix masking of physical address

C doesn't extend the sign bit for unsigned types since there isn't a
sign bit to extend. This means a promotion of a u32 to a u64 results
in the upper 32 bits of the u64 being zero. If that result is then
used as a mask on another u64 the upper 32 bits will be cleared. rv32
physical addresses may be up to 34 bits wide, so we don't want to
clear the high bits while page aligning the address. The fix is to
use hwaddr for the mask, which, even on rv32, is 64-bits wide.

Fixes: af3fc195e3c8 ("target/riscv: Change the TLB page size depends on PMP entries.")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240909083241.43836-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target: riscv: Add Svvptc extension support

The Svvptc extension describes a uarch that does not cache invalid TLB
entries: that's the case for qemu so there is nothing particular to
implement other than the introduction of this extension.

Since qemu already exposes Svvptc behaviour, let's enable it by default
since it allows to drastically reduce the number of sfence.vma emitted
by S-mode.

Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240828083651.203861-1-alexghiti@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

hw/riscv: Respect firmware ELF entry point

When riscv_load_firmware() loads an ELF, the ELF segment addresses are
used, not the passed-in firmware_load_addr. The machine models assume
the firmware entry point is what they provided for firmware_load_addr,
and use that address to generate the boot ROM, so if the ELF is linked
at any other address, the boot ROM will jump to empty memory.

Pass back the ELF entry point to use when generating the boot ROM, so
the boot ROM can jump to firmware loaded anywhere in RAM. For example,
on the virt machine, this allows using an OpenSBI fw_dynamic.elf built
with FW_TEXT_START values other than 0x80000000.

Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240817002651.3209701-1-samuel.holland@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add textra matching condition for the triggers

According to RISC-V Debug specification, the optional textra32 and
textra64 trigger CSRs can be used to configure additional matching
conditions for the triggers. For example, if the textra.MHSELECT field
is set to 4 (mcontext), this trigger will only match or fire if the low
bits of mcontext/hcontext equal textra.MHVALUE field.

This commit adds the aforementioned matching condition as common trigger
matching conditions. Currently, the only legal values of textra.MHSELECT
are 0 (ignore) and 4 (mcontext). When textra.MHSELECT is 0, we pass the
checking. When textra.MHSELECT is 4, we compare textra.MHVALUE with
mcontext CSR. The remaining fields, such as textra.SBYTEMASK,
textra.SVALUE, and textra.SSELECT, are hardwired to zero for now. Thus,
we skip checking them here.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240826024657.262553-3-alvinga@andestech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Preliminary textra trigger CSR writting support

This commit allows program to write textra trigger CSR for type 2, 3, 6
triggers. In this preliminary patch, the textra.MHVALUE and the
textra.MHSELECT fields are allowed to be configured. Other fields, such
as textra.SBYTEMASK, textra.SVALUE, and textra.SSELECT, are hardwired to
zero for now.

For textra.MHSELECT field, the only legal values are 0 (ignore) and 4
(mcontext). Writing 1~3 into textra.MHSELECT will be changed to 0, and
writing 5~7 into textra.MHSELECT will be changed to 4. This behavior is
aligned to RISC-V SPIKE simulator.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240826024657.262553-2-alvinga@andestech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

util/util/cpuinfo-riscv.c: fix riscv64 build on musl libc

build fails on musl libc (alpine linux) with this error:

../util/cpuinfo-riscv.c: In function 'cpuinfo_init':
../util/cpuinfo-riscv.c:63:21: error: '__NR_riscv_hwprobe' undeclared (first use in this function); did you mean 'riscv_hwprobe'?
   63 |         if (syscall(__NR_riscv_hwprobe, &pair, 1, 0, NULL, 0) == 0
      |                     ^~~~~~~~~~~~~~~~~~
      |                     riscv_hwprobe
../util/cpuinfo-riscv.c:63:21: note: each undeclared identifier is reported only once for each function it appears in
ninja: subcommand failed

add '#include "asm/unistd.h"' to util/cpuinfo-riscv.c fixes build

Signed-off-by: Milan P. Stanić <mps@arvanta.net>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240905150702.2484-1-mps@arvanta.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/cpu.c: Add 'fcsr' register to QEMU log as a part of F extension

FCSR is a part of F extension. Print it to log if FPU option is enabled.

Signed-off-by: Maria Klauchek <m.klauchek@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240902103433.18424-1-m.klauchek@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Stop timer with infinite timecmp

While the spec doesn't state it, setting timecmp to UINT64_MAX is
another way to stop a timer, as it's considered setting the next
timer event to occur at infinity. And, even if the time CSR does
eventually reach UINT64_MAX, the very next tick will bring it back to
zero, once again less than timecmp. For this reason
riscv_timer_write_timecmp() special cases UINT64_MAX. However, if a
previously set timecmp has not yet expired, then setting timecmp to
UINT64_MAX to disable / stop it would not work, as the special case
left the previous QEMU timer active, which would then still deliver
an interrupt at that previous timecmp time. Ensure the stopped timer
will not still deliver an interrupt by also deleting the QEMU timer
in the UINT64_MAX special case.

Fixes: ae0edf2188b3 ("target/riscv: No need to re-start QEMU timer when timecmp == UINT64_MAX")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240829084002.1805006-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/kvm: Fix the group bit setting of AIA

Just as the hart bit setting of the AIA should be calculated as
ceil(log2(max_hart_id + 1)) the group bit setting should be
calculated as ceil(log2(max_group_id + 1)). The hart bits are
implemented by passing max_hart_id to find_last_bit() and adding
one to the result. Do the same for the group bit setting.

Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240821075040.498945-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target: riscv: Enable Bit Manip for OpenTitan Ibex CPU

The OpenTitan Ibex CPU now supports the the Zba, Zbb, Zbc
and Zbs bit-manipulation sub-extensions ratified in
v.1.0.0 of the RISC-V Bit- Manipulation ISA Extension, so let's enable
them in QEMU as well.

1: https://github.com/lowRISC/opentitan/pull/9748

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240823003231.3522113-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: fix za64rs enabling

za64rs requires priv 1.12 when enabled by priv 1.11.

This fixes annoying warning:
warning: disabling za64rs extension for hart 0x00000000 because privilege spec version does not match

on priv 1.11 CPUs.

Fixes: 68c9e54beae8 ("target/riscv: do not enable all named features by default")
Signed-off-by: Vladimir Isaev <vladimir.isaev@syntacore.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240823063431.17474-1-vladimir.isaev@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv/tcg/tcg-cpu.c: consider MISA bit choice in implied rule

Gitlab issue [1] reports a misleading error when trying to run a 'rv64'
cpu with 'zfinx' and without 'f':

$ ./build/qemu-system-riscv64 -nographic -M virt -cpu rv64,zfinx=true,f=false
qemu-system-riscv64: Zfinx cannot be supported together with F extension

The user explicitly disabled F and the error message mentions a conflict
with Zfinx and F.

The problem isn't the error reporting, but the logic used when applying
the implied ZFA rule that enables RVF unconditionally, without honoring
user choice (i.e. keep F disabled).

Change cpu_enable_implied_rule() to check if the user deliberately
disabled a MISA bit. In this case we shouldn't either re-enable the bit
nor apply any implied rules related to it.

After this change the error message now shows:

$ ./build/qemu-system-riscv64 -nographic -M virt -cpu rv64,zfinx=true,f=false
qemu-system-riscv64: Zfa extension requires F extension

Disabling 'zfa':

$ ./build/qemu-system-riscv64 -nographic -M virt -cpu rv64,zfinx=true,f=false,zfa=false
qemu-system-riscv64: D extension requires F extension

And finally after disabling 'd':

$ ./build/qemu-system-riscv64 -nographic -M virt -cpu rv64,zfinx=true,f=false,zfa=false,d=false
(OpenSBI boots ...)

[1] https://gitlab.com/qemu-project/qemu/-/issues/2486

Cc: Frank Chang <frank.chang@sifive.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2486
Fixes: 047da861f9 ("target/riscv: Introduce extension implied rule helpers")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240824173338.316666-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

tests/acpi: Add expected ACPI SRAT AML file for RISC-V

As per the step 5 in the process documented in bios-tables-test.c,
generate the expected ACPI SRAT AML data file for RISC-V using the
rebuild-expected-aml.sh script and update the
bios-tables-test-allowed-diff.h.

This is a new file being added for the first time. Hence, iASL diff
output is not added.

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <a667480203b35508038176c8ce4722370294cc57.1723172696.git.haibo1.xu@intel.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

tests/qtest/bios-tables-test.c: Enable numamem testing for RISC-V

Add ACPI SRAT table test case for RISC-V when NUMA was enabled.

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <a6f7e1a4b20ff7eb199e94ca0c8aa2e6794ce5b2.1723172696.git.haibo1.xu@intel.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

tests/acpi: Add empty ACPI SRAT data file for RISC-V

As per process documented (steps 1-3) in bios-tables-test.c, add
empty AML data file for RISC-V ACPI SRAT table and add the entry
in bios-tables-test-allowed-diff.h.

Signed-off-by: Haibo Xu <haibo1.xu@intel.com>
Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <0e30216273f2f59916bc651350578d8e8bc3a75f.1723172696.git.haibo1.xu@intel.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

target/riscv: Add a property to set vl to ceil(AVL/2)

RVV spec allows implementations to set vl with values within
[ceil(AVL/2),VLMAX] when VLMAX < AVL < 2*VLMAX. This commit adds a
property "rvv_vl_half_avl" to enable setting vl = ceil(AVL/2). This
behavior helps identify compiler issues and bugs.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20240722175004.23666-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Merge tag 'pull-target-arm-20241001' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * MAINTAINERS: Update STM32L4x5 and B-L475E-IOT01A maintainers
 * hw/arm/xlnx: Connect secondary CGEM IRQs
 * m25p80: Add SFDP table for mt35xu01g flash
 * target/arm: Avoid target_ulong for physical address lookups
 * hw/ssi/xilinx_spips: Fix flash erase assert in dual parallel configuration
 * hw: fix memory leak in IRQState allocation
 * hw/sd/sdcard: Fix handling of disabled boot partitions
 * arm: Remove deprecated board models

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmb8JW8ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3m85D/9W5E4BQd4mG0JPT+OcCRP/
# MQGXsU6fOm3mtYfehXMwnJf2POOK0t/IC5W1mOGmIV6R4ABv2il3cXvQznCpcKY3
# eRmMLn4tfI2bn8zJmkIMY5am7j7G3RJzktz8iQ3bstNwD3pYU46tr36iup7vU71b
# Z5Q3+uauBoUo/9rw5jgjjoZ9Z3Ay2RECsZc/vD6NIN0kh2TYgdpitR47J8jhS3ZX
# +laqimnRl5wQpe0TIYzpdFr82CXfT62WfQ/+6D6xftbTrV1gfLWesc7hHsgw7Sem
# ST+nX+0Wr0UfBvsNN4ldi4jB4FfMeUCPX4wBbkKaYyD7bYFnoiz8RPYCxrHlKqeL
# 9P7+LuA+h+odIcsCza9zUSpQIu4gGIuovmnjz6rbD8m6poV0OmU/Ncj4JC9hGJNi
# Y1utyFELsvpdQhHP1M2K0qEgO3q/fJyzgA5LXkeXLVozjJM6DX7deVdXjwcBWqeI
# McJwe/C1TZ/WQlssrWmx6+naA8sygrsbo98a7X+DVsZ0ka6ofZSKkr7aHd3+dia+
# a4KbiMX6ChqZxPbIB+m4GnOkCDefu098rXlOu4gkMdzyQT/sm7wmVzQ3YsW3jVqx
# DNG6Mrg6OVvevXQysdLkJIemnM9YeLxf0lEJ/NpkyGQ7LlmdBws+p1ooCvuvg2Ua
# CRFY1tuUfWrshpziF1cT4A==
# =q4iF
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 01 Oct 2024 17:38:07 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20241001' of https://git.linaro.org/people/pmaydell/qemu-arm: (54 commits)
  hw: Remove omap2 specific defines and enums
  hw/dma: Remove omap_dma4 device
  hw/misc/omap_clk: Remove OMAP2-specifics
  hw/misc: Remove omap_l4 device
  hw/display: Remove omap_dss
  hw/misc: Remove omap_tap device
  hw/ssi: Remove omap_mcspi
  hw/timer: Remove omap_synctimer
  hw/timer: Remove omap_gptimer
  hw/misc: Remove omap_gpmc
  hw/misc: Remove omap_sdrc device
  hw/sd: Remove omap2_mmc device
  hw/intc: Remove omap2-intc device
  hw/char: Remove omap2_uart
  hw/gpio: Remove TYPE_OMAP2_GPIO
  hw/arm: Remove omap2.c
  docs: Document removal of old Arm boards
  hw/usb: Remove MUSB USB host controller
  hw/usb: Remove tusb6010 USB controller
  hw/block: Remove OneNAND device
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw: Remove omap2 specific defines and enums

Remove some defines and enums that are OMAP2 specific and
no longer used anywhere.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-54-peter.maydell@linaro.org

hw/dma: Remove omap_dma4 device

The omap_dma4 device was only used in the OMAP2 SoC, which has
been removed.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-53-peter.maydell@linaro.org

hw/misc/omap_clk: Remove OMAP2-specifics

Remove the handling for all non-OMAP1 SoCs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-52-peter.maydell@linaro.org

hw/misc: Remove omap_l4 device

The omap_l4 device is OMAP2 only, so we can remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-51-peter.maydell@linaro.org

hw/display: Remove omap_dss

The omap_dss device is OMAP2 only, and we are removing it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-50-peter.maydell@linaro.org

hw/misc: Remove omap_tap device

The omap_tap device is OMAP2 only, and we are removing it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-49-peter.maydell@linaro.org

hw/ssi: Remove omap_mcspi

The omap_mcspi device is used only in the OMAP2 SoC, which we
are removing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-48-peter.maydell@linaro.org

hw/timer: Remove omap_synctimer

Remove the omap_synctimer device, which is only in the OMAP2 SoC.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-46-peter.maydell@linaro.org

hw/timer: Remove omap_gptimer

The omap_gptimer device is only in the OMAP2 SoC, which we
are removing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-45-peter.maydell@linaro.org

hw/misc: Remove omap_gpmc

The omap_gpmc device is only in OMAP2, which we are removing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-44-peter.maydell@linaro.org

hw/misc: Remove omap_sdrc device

The omap_sdrc device is only in OMAP2, which we are removing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-43-peter.maydell@linaro.org

hw/sd: Remove omap2_mmc device

Remove the OMAP2 specific code from omap_mmc.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-42-peter.maydell@linaro.org

hw/intc: Remove omap2-intc device

Remove the OMAP2 specific code from omap_intc.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-41-peter.maydell@linaro.org

hw/char: Remove omap2_uart

Remove the OMAP2 specific code from omap_uart.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-40-peter.maydell@linaro.org

hw/gpio: Remove TYPE_OMAP2_GPIO

We've removed the OMAP2 SoC, so we can remove the OMAP2 GPIO
device. (The source file remains, as it also has the model of
the OMAP1 GPIO device.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-39-peter.maydell@linaro.org

hw/arm: Remove omap2.c

The users of the OMAP2 SoC emulation have been removed, so we can
delete omap2.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-38-peter.maydell@linaro.org

docs: Document removal of old Arm boards

Now we have removed all the board types that it covers, we can move
the text about old Arm boards from deprecated.rst to
removed-features.rst, tweaking it appropriately.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-37-peter.maydell@linaro.org

hw/usb: Remove MUSB USB host controller

Remove the MUSB USB2.0 OTG-compliant USB host controller
device model. This was only used by the tusb6010 USB
controller in the n800/n810 machines.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-35-peter.maydell@linaro.org

hw/usb: Remove tusb6010 USB controller

The tusb6010 was only used by the n800/n810 machines, so it
can be removed now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-34-peter.maydell@linaro.org

hw/block: Remove OneNAND device

The OneNAND devices were only used by n800/n810, so they
can be removed now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-33-peter.maydell@linaro.org

hw/input: Remove lm832x device

Remove the lm832x keyboard-and-pwm i2c device model. This
was only used by the n800 and n810 machines.

(Although this is an i2c device and so in theory available to create
on the command line, in practice it has an outbound IRQ line that the
machine model needs to wire up, and the only way to inject keys events
into it is to call the lm832x_key_event() function, so it isn't
in practice possible to use it separately from the n800/n810.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-32-peter.maydell@linaro.org

hw/rtc: Remove twl92230 device

Remove the TWL92230 RTC device, which was used only by the n800 and n810.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-31-peter.maydell@linaro.org

hw/input: Remove tsc210x device

Remove the tsc210x touchscreen controller device, which was
only used by the n800 and n810 and cheetah.

The uWireSlave struct is still used in omap1.c (at least for
compilation purposes -- nothing any longer calls omap_uwire_attach()
and so the struct's members will not be used at runtime), so
we move it into omap.h so we can delete tsc2xxx.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-30-peter.maydell@linaro.org

hw/input: Remove tsc2005 touchscreen controller

Remove the tsc2005 touchscreen controller, which was only used
by the n800 and n810 machines.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-29-peter.maydell@linaro.org

hw/display: Remove Blizzard display device

Remove the blizzard display device, which was only used with the
n800 and n810 machines.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-28-peter.maydell@linaro.org

hw/misc: Remove cbus

The devices in hw/misc/cbus.c were used only by the
now-removed nseries machine types, so they can be removed.

As this is the last use of the CONFIG_NSERIES define we
can remove that from KConfig now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-27-peter.maydell@linaro.org

hw/arm: Remove 'n800' and 'n810' machines

Remove the 'n800' and 'n810' machine types, which modelled
Nokia internet tablets. These were deprecated in 9.0 and
so we can remove them for 9.2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-26-peter.maydell@linaro.org
[PMM: added removal of arm-n800-machine.c post-review]

hw/timer: Remove pxa27x-timer

The pxa27x-timer can be removed now we have removed the PXA2xx
SoC models. The pxa25x-timer device must remain as it is still
used by strongarm.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-24-peter.maydell@linaro.org

hw/arm: Remove pxa2xx_pic

Remove the pxa2xx-specific interrupt controller device.
As this is the last user of the pxa.h header file and the
CONFIG_PXA2XX define we can remove those too.

This completes the removal of the pxa2xx specific code.  We leave:
 * pxa2xx_timer -- still used by the Collie board (strongarm)
 * the definitions of the CPUs themselves in target/arm
   (still usable by linux-user mode)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-23-peter.maydell@linaro.org

hw/arm: Remove pxa2xx_gpio

Remove the pxa2xx-specific GPIO device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-22-peter.maydell@linaro.org

hw/pcmcia: Remove pxa2xx pcmcia device

Remove the pxa2xx specific pcmcia device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-21-peter.maydell@linaro.org

hw/dma: Remove pxa2xx_dma

Remove the pxa2xx-specific pxa2xx_dma device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-20-peter.maydell@linaro.org

hw/display: Remove pxa2xx_lcd.c

Remove the pxa2xx-specific pxa2xx_lcd device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-19-peter.maydell@linaro.org

hw/input: Remove pxa2xx_keypad

Remove the pxa2xx-specific pxa2xx_keypad device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-18-peter.maydell@linaro.org

hw/sd: Remove pxa2xx_mmci.c

Remove the pxa2xx-specific pxa2xx_mmci device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-17-peter.maydell@linaro.org

hw/arm: Remove pxa2xx.c

All the callers of pxa270_init() and pxa255_init() have now been removed,
so we can remove pxa2xx.c. This also removes the only uses of a lot of
pxa2xx specific devices, which will be removed in subsequent commits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-16-peter.maydell@linaro.org

hw/timer/pxa2xx_timer: Remove use of pxa.h header

pxa2xx_timer includes pxa.h, but it doesn't actually make
use of any of the #defines, function prototypes or structs
defined there. Remove the unnecessary include (we will
shortly be removing the whole header file).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-15-peter.maydell@linaro.org

hw/arm: Remove STRONGARM->PXA2XX dependency

Currently the STRONGARM KConfig symbol pulls in PXA2XX. Since we've now
removed all the true uses of PXA2XX, we'd like to remove the PXA2XX
symbol too. To permit that, make STRONGARM directly select the things
it truly depends on:
 * pxa25x-timer
 * SSI

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-14-peter.maydell@linaro.org

hw/arm: Remove 'z2' machine

The 'z2' machine was deprecated in 9.0, so we can remove it for
9.2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-13-peter.maydell@linaro.org

hw/misc: Remove MAINSTONE_FPGA device

The MAINSTONE_FPGA device was used only by the 'mainstone' machine
type, so we can remove it now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-12-peter.maydell@linaro.org

hw/arm: Remove 'mainstone' machine

The 'mainstone' machine has been deprecated since 9.0, and
so we can remove it for the 9.2 release.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-11-peter.maydell@linaro.org

hw/arm: Remove 'connex' and 'verdex' machines

The connex and verdex machines have been deprecated since
9.0 and so can be removed for the 9.2 release.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-10-peter.maydell@linaro.org

hw/arm: Remove 'cheetah' machine

The 'cheetah' machine has been deprecated since 9.0, so we can
remove it for the 9.2 release.

(tsc210x.c is also used by nseries, so move its MAINTAINER file
line there; the nseries boards are also about to be removed.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-9-peter.maydell@linaro.org

hw/arm/KConfig: Replace ZAURUS with ZAURUS_SCOOP

The ZAURUS KConfig symbol used to do multiple things:
 * pull in the tc6393xb display device
 * pull in the Zaurus SCOOP GPIO device
 * pull in hw/block/nand.c code
 * pull in hw/block/ecc.c code
and was used by multiple machine types in the Zaurus family.

Now that we've removed all the Zaurus machine types except
"collie" (which is not currently deprecated), we can simplify
this. "collie" doesn't need any of the above things except
for the SCOOP GPIO device.

Remove the does-lots-of-things ZAURUS KConfig symbol and instead have
collie pull in ZAURUS_SCOOP, a new KConfig symbol which exists only
to control the presence of the SCOOP GPIO device.  Move the
associated source file lines in MAINTAINERS into the Collie
subsection, since this is now its only user.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240903160751.4100218-8-peter.maydell@linaro.org

hw/display: Remove tc6393xb device

The tc6393xb was used only by the XScale-based Zaurus machine types.
Now they have been removed we can remove this device too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20240903160751.4100218-7-peter.maydell@linaro.org

hw/input: Drop ADS7846 device

The ADS7846 touchscreen controller device was used only by
the XScale-based PDA machine types. Now that they have been
removed, this device is not used in the tree and can be
deleted.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240903160751.4100218-3-peter.maydell@linaro.org