A random mix of items here, nothing very major.

The following changes since commit d0dff238a87fa81393ed72754d4dc8b09e50b08b:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170206' into staging (2017-02-07 15:29:26 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170207

for you to fetch changes up to 7727b832886fafbdec7299eb7773dc9071bf4cdd:

stellaris: Use the 'unimplemented' device for parts we don't implement (2017-02-07 18:30:00 +0000)

target-arm:

* new "unimplemented" device for stubbing out devices in a

system model so accesses can be logged

* stellaris: document the SoC memory map

* arm: create instruction syndromes for AArch32 data aborts

* arm: Correctly handle watchpoints for BE32 CPUs

* Fix Thumb-1 BE32 execution and disassembly

* arm: Add cfgend parameter for ARM CPU selection

* sd: sdhci: check data length during dma_memory_read

* aspeed: add a watchdog controller

* integratorcp: adding vmstate for save/restore

Cédric Le Goater (2):

wdt: Add Aspeed watchdog device model

aspeed: add a watchdog controller

Julian Brown (4):

hw/arm/integratorcp: Support specifying features via -cpu

target/arm: Add cfgend parameter for ARM CPU selection.

Fix Thumb-1 BE32 execution and disassembly.

arm: Correctly handle watchpoints for BE32 CPUs

Pavel Dovgalyuk (1):

integratorcp: adding vmstate for save/restore

Peter Maydell (5):

target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode

target/arm: A32, T32: Create Instruction Syndromes for Data Aborts

stellaris: Document memory map and which SoC devices are unimplemented

hw/misc: New "unimplemented" sysbus device

stellaris: Use the 'unimplemented' device for parts we don't implement

Prasad J Pandit (1):

sd: sdhci: check data length during dma_memory_read

hw/misc/Makefile.objs | 2 +

hw/watchdog/Makefile.objs | 1 +

include/disas/bfd.h | 7 ++

include/hw/arm/aspeed_soc.h | 2 +

include/hw/misc/unimp.h | 39 +++++++

include/hw/watchdog/wdt_aspeed.h | 32 ++++++

include/qom/cpu.h | 3 +

target/arm/arm_ldst.h | 10 +-

target/arm/cpu.h | 7 ++

target/arm/internals.h | 5 +

target/arm/translate.h | 14 +++

disas.c | 1 +

exec.c | 1 +

hw/arm/aspeed_soc.c | 13 +++

hw/arm/integratorcp.c | 78 +++++++++++++-

hw/arm/stellaris.c | 48 +++++++++

hw/misc/unimp.c | 107 +++++++++++++++++++

hw/sd/sdhci.c | 2 +-

hw/watchdog/wdt_aspeed.c | 225 +++++++++++++++++++++++++++++++++++++++

qom/cpu.c | 6 ++

target/arm/cpu.c | 39 +++++++

target/arm/op_helper.c | 22 ++++

target/arm/translate-a64.c | 14 ---

target/arm/translate.c | 193 ++++++++++++++++++++++++---------

24 files changed, 801 insertions(+), 70 deletions(-)

create mode 100644 include/hw/misc/unimp.h

create mode 100644 include/hw/watchdog/wdt_aspeed.h

create mode 100644 hw/misc/unimp.c

create mode 100644 hw/watchdog/wdt_aspeed.c

From: Julian Brown <julian@codesourcery.com>

Since the integratorcp board creates the CPU object directly

rather than via cpu_arm_init(), we have to call the CPU

class parse_features() method ourselves if we want to

support the user passing features via the -cpu command

line argument as well as just the cpu name. Do so.

Signed-off-by: Julian Brown <julian@codesourcery.com>

[PMM: split out into its own patch]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/integratorcp.c | 19 +++++++++++++++++--

1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c

--- a/hw/arm/integratorcp.c

+++ b/hw/arm/integratorcp.c

@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)

const char *kernel_filename = machine->kernel_filename;

const char *kernel_cmdline = machine->kernel_cmdline;

const char *initrd_filename = machine->initrd_filename;

+ char **cpustr;

ObjectClass *cpu_oc;

+ CPUClass *cc;

Object *cpuobj;

ARMCPU *cpu;

+ const char *typename;

MemoryRegion *address_space_mem = get_system_memory();

MemoryRegion *ram = g_new(MemoryRegion, 1);

MemoryRegion *ram_alias = g_new(MemoryRegion, 1);

qemu_irq pic[32];

DeviceState *dev, *sic, *icp;

int i;

+ Error *err = NULL;

if (!cpu_model) {

cpu_model = "arm926";

- cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);

+ cpustr = g_strsplit(cpu_model, ",", 2);

+

+ cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]);

if (!cpu_oc) {

fprintf(stderr, "Unable to find CPU definition\n");

+ typename = object_class_get_name(cpu_oc);

+

+ cc = CPU_CLASS(cpu_oc);

+ cc->parse_features(typename, cpustr[1], &err);

+ g_strfreev(cpustr);

+ if (err) {

+ error_report_err(err);

+ exit(1);

+ }

- cpuobj = object_new(object_class_get_name(cpu_oc));

+ cpuobj = object_new(typename);

/* By default ARM1176 CPUs have EL3 enabled. This board does not

* currently support EL3 so the CPU EL3 property is disabled before

2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

While doing multi block SDMA transfer in routine

'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting

index 'begin' and data length 's->data_count' could end up to be same.

This could lead to an OOB access issue. Correct transfer data length

to avoid it.

Reported-by: Jiang Xin <jiangxin1@huawei.com>

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

hw/sd/sdhci.c | 2 +-

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c

--- a/hw/sd/sdhci.c

+++ b/hw/sd/sdhci.c

@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)

boundary_count -= block_size - begin;

}

dma_memory_read(&address_space_memory, s->sdmasysad,

- &s->fifo_buffer[begin], s->data_count);

+ &s->fifo_buffer[begin], s->data_count - begin);

s->sdmasysad += s->data_count - begin;

if (s->data_count == block_size) {

for (n = 0; n < block_size; n++) {

2.7.4

Add support for generating the ISS (Instruction Specific Syndrome)

for Data Abort exceptions taken from AArch32. These syndromes are

used by hypervisors for example to trap and emulate memory accesses.

This is the equivalent for AArch32 guests of the work done for AArch64

guests in commit aaa1f954d4cab243.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

target/arm/translate.h | 14 ++++

target/arm/translate-a64.c | 14 ----

target/arm/translate.c | 184 +++++++++++++++++++++++++++++++++------------

3 files changed, 149 insertions(+), 63 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h

--- a/target/arm/translate.h

+++ b/target/arm/translate.h

@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)

? 3 : MAX(1, s->current_el);

+static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)

+ /* We don't need to save all of the syndrome so we mask and shift

+ * out unneeded bits to help the sleb128 encoder do a better job.

+ syn &= ARM_INSN_START_WORD2_MASK;

+ syn >>= ARM_INSN_START_WORD2_SHIFT;

+ /* We check and clear insn_start_idx to catch multiple updates. */

+ assert(s->insn_start_idx != 0);

+ tcg_set_insn_param(s->insn_start_idx, 2, syn);

+ s->insn_start_idx = 0;

/* target-specific extra values for is_jmp */

/* These instructions trap after executing, so the A32/T32 decoder must

* defer them until after the conditional execution state has been updated.

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static inline void gen_goto_tb(DisasContext *s, int n, uint64_t dest)

-static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)

-{

- /* We don't need to save all of the syndrome so we mask and shift

- * out uneeded bits to help the sleb128 encoder do a better job.

- */

- syn &= ARM_INSN_START_WORD2_MASK;

- syn >>= ARM_INSN_START_WORD2_SHIFT;

-

- /* We check and clear insn_start_idx to catch multiple updates. */

- assert(s->insn_start_idx != 0);

- tcg_set_insn_param(s->insn_start_idx, 2, syn);

- s->insn_start_idx = 0;

-}

-

static void unallocated_encoding(DisasContext *s)

/* Unallocated and reserved encodings are uncategorized */

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)

a64_translate_init();

2.7.4

Add a comment documenting the memory map of the SoC devices and which

are not implemented.

Message-id: 1484247815-15279-2-git-send-email-peter.maydell@linaro.org

hw/arm/stellaris.c | 34 ++++++++++++++++++++++++++++++++++

1 file changed, 34 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c

--- a/hw/arm/stellaris.c

+++ b/hw/arm/stellaris.c

@@ -XXX,XX +XXX,XX @@ static void stellaris_init(const char *kernel_filename, const char *cpu_model,

0x40024000, 0x40025000, 0x40026000};

static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};

+ /* Memory map of SoC devices, from

+ * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)

+ * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf

+ *

+ * 40000000 wdtimer (unimplemented)

+ * 40002000 i2c (unimplemented)

+ * 40004000 GPIO

+ * 40005000 GPIO

+ * 40006000 GPIO

+ * 40007000 GPIO

+ * 40008000 SSI

+ * 4000c000 UART

+ * 4000d000 UART

+ * 4000e000 UART

+ * 40020000 i2c

+ * 40021000 i2c (unimplemented)

+ * 40024000 GPIO

+ * 40025000 GPIO

+ * 40026000 GPIO

+ * 40028000 PWM (unimplemented)

+ * 4002c000 QEI (unimplemented)

+ * 4002d000 QEI (unimplemented)

+ * 40030000 gptimer

+ * 40031000 gptimer

+ * 40032000 gptimer

+ * 40033000 gptimer

+ * 40038000 ADC

+ * 4003c000 analogue comparator (unimplemented)

+ * 40048000 ethernet

+ * 400fc000 hibernation module (unimplemented)

+ * 400fd000 flash memory control (unimplemented)

+ * 400fe000 system control

+ */

+

DeviceState *gpio_dev[7], *nvic;

qemu_irq gpio_in[7][8];

qemu_irq gpio_out[7][8];

2.7.4

In the ARM ldr/str decode path, rather than directly testing