[Qemu-commits] [qemu/qemu] d9e9cd: Add dummy Aspeed AST2600 Display Port MCU (DPMCU)

[Richard Henderson]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: d9e9cd59df4bc92e4cf7ad1bfa6e2a8429ff31b4
      
https://github.com/qemu/qemu/commit/d9e9cd59df4bc92e4cf7ad1bfa6e2a8429ff31b4
  Author: Troy Lee <troy_lee@aspeedtech.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/aspeed_ast2600.c
    M include/hw/arm/aspeed_soc.h

  Log Message:
  -----------
  Add dummy Aspeed AST2600 Display Port MCU (DPMCU)

AST2600 Display Port MCU introduces 0x18000000~0x1803FFFF as it's memory
and io address. If guest machine try to access DPMCU memory, it will
cause a fatal error.

Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20211210083034.726610-1-troy_lee@aspeedtech.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: b7469ef92a8034b32031ba22b84fb14046f9770e
      
https://github.com/qemu/qemu/commit/b7469ef92a8034b32031ba22b84fb14046f9770e
  Author: Idan Horowitz <idan.horowitz@gmail.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Add missing FEAT_TLBIOS instructions

Some of the instructions added by the FEAT_TLBIOS extension were forgotten
when the extension was originally added to QEMU.

Fixes: 7113d618505b ("target/arm: Add support for FEAT_TLBIOS")
Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20211231103928.1455657-1-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: a120157b24c78c2d890cd9793eb5a1cbbf42c9a9
      
https://github.com/qemu/qemu/commit/a120157b24c78c2d890cd9793eb5a1cbbf42c9a9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Correct off-by-one bounds check on rdbase

The checks in the ITS on the rdbase values in guest commands are
off-by-one: they permit the guest to pass us a value equal to
s->gicv3->num_cpu, but the valid values are 0...num_cpu-1.  This
meant the guest could cause us to index off the end of the
s->gicv3->cpu[] array when calling gicv3_redist_process_lpi(), and we
would probably crash.

(This is not a security bug, because this code is only usable
with emulation, not with KVM.)

Cc: qemu-stable@nongnu.org
Fixes: 17fb5e36aabd4b ("hw/intc: GICv3 redistributor ITS processing")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 8d2d6dd9bb6f4a275e9acc5d97b020cd91483285
      
https://github.com/qemu/qemu/commit/8d2d6dd9bb6f4a275e9acc5d97b020cd91483285
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M hw/intc/gicv3_internal.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Remove redundant ITS_CTLR_ENABLED define

We currently define a bitmask for the GITS_CTLR ENABLED bit in
two ways: as ITS_CTLR_ENABLED, and via the FIELD() macro as
R_GITS_CTLR_ENABLED_MASK. Consistently use the FIELD macro version
everywhere and remove the redundant ITS_CTLR_ENABLED define.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: 6c1db43de4965b5274830bbd36298638a6dbb468
      
https://github.com/qemu/qemu/commit/6c1db43de4965b5274830bbd36298638a6dbb468
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M include/hw/intc/arm_gicv3_its_common.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Remove maxids union from TableDesc

The TableDesc struct defines properties of the in-guest-memory tables
which the guest tells us about by writing to the GITS_BASER<n>
registers.  This struct currently has a union 'maxids', but all the
fields of the union have the same type (uint32_t) and do the same
thing (record one-greater-than the maximum ID value that can be used
as an index into the table).

We're about to add another table type (the GICv4 vPE table); rather
than adding another specifically-named union field for that table
type with the same type as the other union fields, remove the union
entirely and just have a 'uint32_t max_ids' struct field.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 62df780e3d4e918d984797f2d75b0cced157b757
      
https://github.com/qemu/qemu/commit/62df780e3d4e918d984797f2d75b0cced157b757
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Don't return early in extract_table_params() loop

In extract_table_params() we process each GITS_BASER<n> register.  If
the register's Valid bit is not set, this means there is no
in-guest-memory table and so we should not try to interpret the other
fields in the register.  This was incorrectly coded as a 'return'
rather than a 'break', so instead of looping round to process the
next GITS_BASER<n> we would stop entirely, treating any later tables
as being not valid also.

This has no real guest-visible effects because (since we don't have
GITS_TYPER.HCC != 0) the guest must in any case set up all the
GITS_BASER<n> to point to valid tables, so this only happens in an
odd misbehaving-guest corner case.

Fix the check to 'break', so that we leave the case statement and
loop back around to the next GITS_BASER<n>.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: e5487a413904973ca77999c904be8949da2e8f31
      
https://github.com/qemu/qemu/commit/e5487a413904973ca77999c904be8949da2e8f31
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Reduce code duplication in extract_table_params()

The extract_table_params() decodes the fields in the GITS_BASER<n>
registers into TableDesc structs.  Since the fields are the same for
all the GITS_BASER<n> registers, there is currently a lot of code
duplication within the switch (type) statement.  Refactor so that the
cases include only what is genuinely different for each type:
the calculation of the number of bits in the ID value that indexes
into the table.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: 9ae85431902dfa6dba594d639d1a37d709c56a73
      
https://github.com/qemu/qemu/commit/9ae85431902dfa6dba594d639d1a37d709c56a73
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Correct setting of TableDesc entry_sz

We set the TableDesc entry_sz field from the appropriate
GITS_BASER.ENTRYSIZE field.  That ID register field specifies the
number of bytes per table entry minus one.  However when we use
td->entry_sz we assume it to be the number of bytes per table entry
(for instance we calculate the number of entries in a page by
dividing the page size by the entry size).

The effects of this bug are:
 * we miscalculate the maximum number of entries in the table,
   so our checks on guest index values are wrong (too lax)
 * when looking up an entry in the second level of an indirect
   table, we calculate an incorrect index into the L2 table.
   Because we make the same incorrect calculation on both
   reads and writes of the L2 table, the guest won't notice
   unless it's unlucky enough to use an index value that
   causes us to index off the end of the L2 table page and
   cause guest memory corruption in whatever follows

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 764d6ba10cce25d20ef9f3e11a83a9783dadf65f
      
https://github.com/qemu/qemu/commit/764d6ba10cce25d20ef9f3e11a83a9783dadf65f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M hw/intc/gicv3_internal.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Don't misuse GITS_TYPE_PHYSICAL define

The GITS_TYPE_PHYSICAL define is the value we set the
GITS_TYPER.Physical field to -- this is 1 to indicate that we support
physical LPIs.  (Support for virtual LPIs is the GITS_TYPER.Virtual
field.) We also use this define as the *value* that we write into an
interrupt translation table entry's INTTYPE field, which should be 1
for a physical interrupt and 0 for a virtual interrupt.  Finally, we
use it as a *mask* when we read the interrupt translation table entry
INTTYPE field.

Untangle this confusion: define an ITE_INTTYPE_VIRTUAL and
ITE_INTTYPE_PHYSICAL to be the valid values of the ITE INTTYPE
field, and replace the ad-hoc collection of ITE_ENTRY_* defines with
use of the FIELD() macro to define the fields of an ITE and the
FIELD_EX64() and FIELD_DP64() macros to read and write them.
We use ITE in the new setup, rather than ITE_ENTRY, because
ITE stands for "Interrupt translation entry" and so the extra
"entry" would be redundant.

We take the opportunity to correct the name of the field that holds
the GICv4 'doorbell' interrupt ID (this is always the value 1023 in a
GICv3, which is why we were calling it the 'spurious' field).

The GITS_TYPE_PHYSICAL define is then used in only one place, where
we set the initial GITS_TYPER value.  Since GITS_TYPER.Physical is
essentially a boolean, hiding the '1' value behind a macro is more
confusing than helpful, so expand out the macro there and remove the
define entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: b87fab1c8e8977e8ea1233bafdbfa37090eefabf
      
https://github.com/qemu/qemu/commit/b87fab1c8e8977e8ea1233bafdbfa37090eefabf
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Correct handling of MAPI

The MAPI command takes arguments DeviceID, EventID, ICID, and is
defined to be equivalent to MAPTI DeviceID, EventID, EventID, ICID.
(That is, where MAPTI takes an explicit pINTID, MAPI uses the EventID
as the pINTID.)

We didn't quite get this right.  In particular the error checks for
MAPI include "EventID does not specify a valid LPI identifier", which
is the same as MAPTI's error check for the pINTID field.  QEMU's code
skips the pINTID error check entirely in the MAPI case.

We can fix this bug and in the process simplify the code by switching
to the obvious implementation of setting pIntid = eventid early
if ignore_pInt is true.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: e07f844599525685db44ce74bf4ab12025d1d96a
      
https://github.com/qemu/qemu/commit/e07f844599525685db44ce74bf4ab12025d1d96a
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M hw/intc/gicv3_internal.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Use FIELD macros for DTEs

Currently the ITS code that reads and writes DTEs uses open-coded
shift-and-mask to assemble the various fields into the 64-bit DTE
word.  The names of the macros used for mask and shift values are
also somewhat inconsistent, and don't follow our usual convention
that a MASK macro should specify the bits in their place in the word.
Replace all these with use of the FIELD macro.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 257bb6501cda75e9ba0804cd5b45e17275928252
      
https://github.com/qemu/qemu/commit/257bb6501cda75e9ba0804cd5b45e17275928252
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/gicv3_internal.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Correct comment about CTE RDBase field size

The comment says that in our CTE format the RDBase field is 36 bits;
in fact for us it is only 16 bits, because we use the RDBase format
where it specifies a 16-bit CPU number. The code already uses
RDBASE_PROCNUM_LENGTH (16) as the field width, so fix the comment
to match it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 437dc0ea982beb11cb9b4df82baf8aefe6af661c
      
https://github.com/qemu/qemu/commit/437dc0ea982beb11cb9b4df82baf8aefe6af661c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M hw/intc/gicv3_internal.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Use FIELD macros for CTEs

Use FIELD macros to handle CTEs, rather than ad-hoc mask-and-shift.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 80dcd37feb3a249cdd6a96826836e267df5c7077
      
https://github.com/qemu/qemu/commit/80dcd37feb3a249cdd6a96826836e267df5c7077
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c
    M include/hw/intc/arm_gicv3_its_common.h

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Fix various off-by-one errors

The ITS code has to check whether various parameters passed in
commands are in-bounds, where the limit is defined in terms of the
number of bits that are available for the parameter.  (For example,
the GITS_TYPER.Devbits ID register field specifies the number of
DeviceID bits minus 1, and device IDs passed in the MAPTI and MAPD
command packets must fit in that many bits.)

Currently we have off-by-one bugs in many of these bounds checks.
The typical problem is that we define a max_foo as 1 << n. In
the Devbits example, we set
  s->dt.max_ids = 1UL << (GITS_TYPER.Devbits + 1).
However later when we do the bounds check we write
  if (devid > s->dt.max_ids) { /* command error */ }
which incorrectly permits a devid of 1 << n.

These bugs will not cause QEMU crashes because the ID values being
checked are only used for accesses into tables held in guest memory
which we access with address_space_*() functions, but they are
incorrect behaviour of our emulation.

Fix them by standardizing on this pattern:
 * bounds limits are named num_foos and are the 2^n value
   (equal to the number of valid foo values)
 * bounds checks are either
   if (fooid < num_foos) { good }
   or
   if (fooid >= num_foos) { bad }

In this commit we fix the handling of the number of IDs
in the device table and the collection table, and the number
of commands that will fit in the command queue.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>


  Commit: 7f18ac3ab3337f3c83b2ab34001ef7c1bb4a43a7
      
https://github.com/qemu/qemu/commit/7f18ac3ab3337f3c83b2ab34001ef7c1bb4a43a7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/intc/arm_gicv3_its.c

  Log Message:
  -----------
  hw/intc/arm_gicv3_its: Rename max_l2_entries to num_l2_entries

In several places we have a local variable max_l2_entries which is
the number of entries which will fit in a level 2 table.  The
calculations done on this value are correct; rename it to
num_l2_entries to fit the convention we're using in this code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: 560223dcf0d9e83e26a85cec32d8aec272813d8e
      
https://github.com/qemu/qemu/commit/560223dcf0d9e83e26a85cec32d8aec272813d8e
  Author: Chris Rauer <crauer@google.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/npcm7xx_boards.c

  Log Message:
  -----------
  hw/arm: Add kudo i2c eeproms.

Signed-off-by: Chris Rauer <crauer@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220102215844.2888833-2-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: b27de2c57b28eac963fa0e35cad8a2a3b7977fc4
      
https://github.com/qemu/qemu/commit/b27de2c57b28eac963fa0e35cad8a2a3b7977fc4
  Author: Shengtan Mao <stmao@google.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/npcm7xx_boards.c

  Log Message:
  -----------
  hw/arm: attach MMC to kudo-bmc

Signed-off-by: Shengtan Mao <stmao@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Chris Rauer <crauer@google.com>
Message-id: 20220102215844.2888833-3-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 5b0829d38cccdbf05531521e45bbaf87a2f98402
      
https://github.com/qemu/qemu/commit/5b0829d38cccdbf05531521e45bbaf87a2f98402
  Author: Patrick Venture <venture@google.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/npcm7xx_boards.c

  Log Message:
  -----------
  hw/arm: add i2c muxes to kudo-bmc

Signed-off-by: Patrick Venture <venture@google.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220102215844.2888833-4-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: b8905cc2dde95ca6be5e56d77053b1ca0b8fc182
      
https://github.com/qemu/qemu/commit/b8905cc2dde95ca6be5e56d77053b1ca0b8fc182
  Author: Patrick Venture <venture@google.com>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/npcm7xx_boards.c

  Log Message:
  -----------
  hw/arm: kudo add lm75s on bus 13

Add the four lm75s behind the mux on bus 13.

Tested by booting the firmware:
lm75 42-0048: hwmon0: sensor 'lm75'
lm75 43-0049: supply vs not found, using dummy regulator
lm75 43-0049: hwmon1: sensor 'lm75'
lm75 44-0048: supply vs not found, using dummy regulator
lm75 44-0048: hwmon2: sensor 'lm75'
lm75 45-0049: supply vs not found, using dummy regulator
lm75 45-0049: hwmon3: sensor 'lm75'

Signed-off-by: Patrick Venture <venture@google.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220102215844.2888833-5-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: c87507a8cfb5b11bf1773c0214ee76ba9382179c
      
https://github.com/qemu/qemu/commit/c87507a8cfb5b11bf1773c0214ee76ba9382179c
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2022-01-07 (Fri, 07 Jan 2022)

  Changed paths:
    M hw/arm/aspeed_ast2600.c
    M hw/arm/npcm7xx_boards.c
    M hw/intc/arm_gicv3_its.c
    M hw/intc/gicv3_internal.h
    M include/hw/arm/aspeed_soc.h
    M include/hw/intc/arm_gicv3_its_common.h
    M target/arm/helper.c

  Log Message:
  -----------
  Merge tag 'pull-target-arm-20220107' of 
https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * Add dummy Aspeed AST2600 Display Port MCU (DPMCU)
 * Add missing FEAT_TLBIOS instructions
 * arm_gicv3_its: Various bug fixes and cleanups
 * kudo-bmc: Add more devices

# gpg: Signature made Fri 07 Jan 2022 09:20:24 AM PST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" 
[full]

* tag 'pull-target-arm-20220107' of 
https://git.linaro.org/people/pmaydell/qemu-arm:
  hw/arm: kudo add lm75s on bus 13
  hw/arm: add i2c muxes to kudo-bmc
  hw/arm: attach MMC to kudo-bmc
  hw/arm: Add kudo i2c eeproms.
  hw/intc/arm_gicv3_its: Rename max_l2_entries to num_l2_entries
  hw/intc/arm_gicv3_its: Fix various off-by-one errors
  hw/intc/arm_gicv3_its: Use FIELD macros for CTEs
  hw/intc/arm_gicv3_its: Correct comment about CTE RDBase field size
  hw/intc/arm_gicv3_its: Use FIELD macros for DTEs
  hw/intc/arm_gicv3_its: Correct handling of MAPI
  hw/intc/arm_gicv3_its: Don't misuse GITS_TYPE_PHYSICAL define
  hw/intc/arm_gicv3_its: Correct setting of TableDesc entry_sz
  hw/intc/arm_gicv3_its: Reduce code duplication in extract_table_params()
  hw/intc/arm_gicv3_its: Don't return early in extract_table_params() loop
  hw/intc/arm_gicv3_its: Remove maxids union from TableDesc
  hw/intc/arm_gicv3_its: Remove redundant ITS_CTLR_ENABLED define
  hw/intc/arm_gicv3_its: Correct off-by-one bounds check on rdbase
  target/arm: Add missing FEAT_TLBIOS instructions
  Add dummy Aspeed AST2600 Display Port MCU (DPMCU)

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


Compare: https://github.com/qemu/qemu/compare/01d10a2add58...c87507a8cfb5