Series comparison

-[Qemu-devel] [PULL 00/17] target-arm queue
+[PULL 0/9] target-arm queue
-Target-arm queue...
+Arm queue; bugfixes only.
 thanks
 -- PMM
-The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:
+The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)
+  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
-for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:
+for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
-  hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)
+  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * vITS: Support save/restore
+ * hw/arm/virt: ARM_VIRT must select ARM_GIC
- * timer/aspeed: Fix timer enablement when reload is not set
+ * exynos: Fix bad printf format specifiers
- * aspped: add temperature sensor device
+ * hw/input/ps2.c: Remove remnants of printf debug
- * timer.h: Provide better monotonic time on ARM hosts
+ * target/openrisc: Remove dead code attempting to check "is timer disabled"
- * exynos4210: various cleanups
+ * register: Remove unnecessary NULL check
- * exynos4210: support system poweroff
+ * util/cutils: Fix Coverity array overrun in freq_to_str()
  * configure: Make "does libgio work" test pull in some actual functions
  * tmp105: reset the T_low and T_High registers
  * tmp105: Correct handling of temperature limit checks
 ----------------------------------------------------------------
-Cédric Le Goater (3):
+Alex Chen (1):
-      hw/misc: add a TMP42{1, 2, 3} device model
+      exynos: Fix bad printf format specifiers
       aspeed: add a temp sensor device on I2C bus 3
       timer/aspeed: fix timer enablement when a reload is not set
-Eric Auger (4):
+Alistair Francis (1):
-      kvm-all: Pass an error object to kvm_device_access
+      register: Remove unnecessary NULL check
       hw/intc/arm_gicv3_its: Implement state save/restore
       hw/intc/arm_gicv3_kvm: Implement pending table save
       hw/intc/arm_gicv3_its: Allow save/restore
-Krzysztof Kozlowski (9):
+Andrew Jones (1):
-      hw/intc/exynos4210_gic: Use more meaningful name for local variable
+      hw/arm/virt: ARM_VIRT must select ARM_GIC
       hw/timer/exynos4210_mct: Fix checkpatch style errors
       hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
       hw/timer/exynos4210_mct: Remove unused defines
       hw/arm/exynos: Move DRAM initialization next boards
       hw/arm/exynos: Declare local variables in some order
       hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
       hw/intc/exynos4210_gic: Constify array of combiner interrupts
       hw/misc/exynos4210_pmu: Add support for system poweroff
-Pranith Kumar (1):
+Peter Maydell (5):
-      timer.h: Provide better monotonic time
+      hw/input/ps2.c: Remove remnants of printf debug
       target/openrisc: Remove dead code attempting to check "is timer disabled"
       configure: Make "does libgio work" test pull in some actual functions
       hw/misc/tmp105: reset the T_low and T_High registers
       tmp105: Correct handling of temperature limit checks
- hw/misc/Makefile.objs                  |   1 +
+Philippe Mathieu-Daudé (1):
- include/hw/arm/exynos4210.h            |   5 +-
+      util/cutils: Fix Coverity array overrun in freq_to_str()
  include/hw/intc/arm_gicv3_its_common.h |   8 +
  include/migration/vmstate.h            |   2 +
  include/qemu/timer.h                   |   5 +-
  include/sysemu/kvm.h                   |  11 +-
  hw/arm/aspeed.c                        |   9 +
  hw/arm/exynos4210.c                    |  27 +--
  hw/arm/exynos4_boards.c                |  50 +++-
  hw/intc/arm_gic_kvm.c                  |   9 +-
  hw/intc/arm_gicv3_common.c             |   1 +
  hw/intc/arm_gicv3_its_common.c         |  12 +-
  hw/intc/arm_gicv3_its_kvm.c            | 131 +++++++++--
  hw/intc/arm_gicv3_kvm.c                |  48 +++-
  hw/intc/exynos4210_gic.c               |  14 +-
  hw/misc/exynos4210_pmu.c               |  20 +-
  hw/misc/tmp421.c                       | 402 +++++++++++++++++++++++++++++++++
  hw/timer/aspeed_timer.c                |  37 ++-
  hw/timer/exynos4210_mct.c              |  50 ++--
  kvm-all.c                              |  14 +-
  default-configs/arm-softmmu.mak        |   1 +
 files changed, 741 insertions(+), 116 deletions(-)
  create mode 100644 hw/misc/tmp421.c
+ configure                    | 11 +++++--
+ hw/misc/tmp105.h             |  7 +++++
+ hw/core/register.c           |  4 ---
+ hw/input/ps2.c               |  9 ------
+ hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
+ hw/timer/exynos4210_mct.c    |  4 +--
+ hw/timer/exynos4210_pwm.c    |  8 ++---
+ target/openrisc/sys_helper.c |  3 --
+ util/cutils.c                |  3 +-
+ hw/arm/Kconfig               |  1 +
+files changed, 89 insertions(+), 34 deletions(-)

-[Qemu-devel] [PULL 01/17] hw/intc/exynos4210_gic: Use more meaningful name for local variable
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-There are to SysBusDevice variables in exynos4210_gic_realize()
-function: one for the device itself and second for arm_gic device.  Add
-a prefix "gic" to the second one so it will be easier to understand the
-code.
-While at it, put local uninitialized 'i' variable at the end, next to
-other uninitialized ones.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/exynos4210_gic.c | 12 ++++++------
-file changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-     DeviceState *dev = DEVICE(obj);
-     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
--    uint32_t i;
-     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
-     const char dist_prefix[] = "exynos4210-gic-alias_dist";
-     char cpu_alias_name[sizeof(cpu_prefix) + 3];
-     char dist_alias_name[sizeof(cpu_prefix) + 3];
--    SysBusDevice *busdev;
-+    SysBusDevice *gicbusdev;
-+    uint32_t i;
-     s->gic = qdev_create(NULL, "arm_gic");
-     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
-     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
-     qdev_init_nofail(s->gic);
--    busdev = SYS_BUS_DEVICE(s->gic);
-+    gicbusdev = SYS_BUS_DEVICE(s->gic);
-     /* Pass through outbound IRQ lines from the GIC */
--    sysbus_pass_irq(sbd, busdev);
-+    sysbus_pass_irq(sbd, gicbusdev);
-     /* Pass through inbound GPIO lines to the GIC */
-     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
-         memory_region_init_alias(&s->cpu_alias[i], obj,
-                                  cpu_alias_name,
--                                 sysbus_mmio_get_region(busdev, 1),
-+                                 sysbus_mmio_get_region(gicbusdev, 1),
-,
-                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
-         memory_region_add_subregion(&s->cpu_container,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
-         memory_region_init_alias(&s->dist_alias[i], obj,
-                                  dist_alias_name,
--                                 sysbus_mmio_get_region(busdev, 0),
-+                                 sysbus_mmio_get_region(gicbusdev, 0),
-,
-                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
-         memory_region_add_subregion(&s->dist_container,
---
-.7.4

-[Qemu-devel] [PULL 17/17] hw/intc/arm_gicv3_its: Allow save/restore
+[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
-From: Eric Auger <eric.auger@redhat.com>
+From: Andrew Jones <drjones@redhat.com>
-We change the restoration priority of both the GICv3 and ITS. The
+The removal of the selection of A15MPCORE from ARM_VIRT also
-GICv3 must be restored before the ITS and the ITS needs to be restored
+removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
 before PCIe devices since it translates their MSI transactions.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
-Reviewed-by: Juan Quintela <quintela@redhat.com>
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
+Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201111143440.112763-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/migration/vmstate.h    |  2 ++
+ hw/arm/Kconfig | 1 +
- hw/intc/arm_gicv3_common.c     |  1 +
+file changed, 1 insertion(+)
  hw/intc/arm_gicv3_its_common.c |  2 +-
  hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 files changed, 16 insertions(+), 13 deletions(-)
-diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/hw/arm/Kconfig
-+++ b/include/migration/vmstate.h
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
- typedef enum {
+     imply VFIO_PLATFORM
-     MIG_PRI_DEFAULT = 0,
+     imply VFIO_XGMAC
-     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
+     imply TPM_TIS_SYSBUS
-+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
++    select ARM_GIC
-+    MIG_PRI_GICV3,              /* Must happen before the ITS */
+     select ACPI
-     MIG_PRI_MAX,
+     select ARM_SMMUV3
- } MigrationPriority;
+     select GPIO_KEY
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
      .minimum_version_id = 1,
      .pre_save = gicv3_pre_save,
      .post_load = gicv3_post_load,
 +    .priority = MIG_PRI_GICV3,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(gicd_ctlr, GICv3State),
          VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
      .name = "arm_gicv3_its",
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
 -    .unmigratable = true,
 +    .priority = MIG_PRI_GICV3_ITS,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(ctlr, GICv3ITSState),
          VMSTATE_UINT32(iidr, GICv3ITSState),
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
      Error *local_err = NULL;
 -    /*
 -     * Block migration of a KVM GICv3 ITS device: the API for saving and
 -     * restoring the state in the kernel is not yet available
 -     */
 -    error_setg(&s->migration_blocker, "vITS migration is not implemented");
 -    migrate_add_blocker(s->migration_blocker, &local_err);
 -    if (local_err) {
 -        error_propagate(errp, local_err);
 -        error_free(s->migration_blocker);
 -        return;
 -    }
 -
      s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
      if (s->dev_fd < 0) {
          error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      gicv3_its_init_mmio(s, NULL);
 +    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +        GITS_CTLR)) {
 +        error_setg(&s->migration_blocker, "This operating system kernel "
 +                   "does not support vITS migration");
 +        migrate_add_blocker(s->migration_blocker, &local_err);
 +        if (local_err) {
 +            error_propagate(errp, local_err);
 +            error_free(s->migration_blocker);
 +            return;
 +        }
 +    }
 +
      kvm_msi_use_devid = true;
      kvm_gsi_direct_mapping = false;
      kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/17] hw/timer/exynos4210_mct: Fix checkpatch style errors
+[PULL 2/9] exynos: Fix bad printf format specifiers
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Alex Chen <alex.chen@huawei.com>
-Fix checkpatch errors:
+We should use printf format specifier "%u" instead of "%d" for
-. ERROR: spaces required around that '+' (ctx:VxV)
+argument of type "unsigned int".
 . ERROR: spaces required around that '&' (ctx:VxV)
-No functional changes.
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Message-id: 20201111073651.72804-1-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/timer/exynos4210_mct.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
+ hw/timer/exynos4210_pwm.c | 8 ++++----
 files changed, 6 insertions(+), 6 deletions(-)
 diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/exynos4210_mct.c
 +++ b/hw/timer/exynos4210_mct.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
+     /* If CSTAT is pending and IRQ is enabled */
+     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
+             (s->reg.int_enb & G_INT_ENABLE(id))) {
+-        DPRINTF("gcmp timer[%d] IRQ\n", id);
++        DPRINTF("gcmp timer[%u] IRQ\n", id);
+         qemu_irq_raise(s->irq[id]);
+     }
+ }
 @@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
- {
-     uint32_t freq = s->freq;
-     s->freq = 24000000 /
--            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
-+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
                      MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
      if (freq != s->freq) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
+-        DPRINTF("freq=%dHz\n", s->freq);
++        DPRINTF("freq=%uHz\n", s->freq);
-     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
+         /* global timer */
--    if (offset&0x4) {
+         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
-+    if (offset & 0x4) {
+diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
+index XXXXXXX..XXXXXXX 100644
-     } else {
+--- a/hw/timer/exynos4210_pwm.c
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
++++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      uint32_t id = s->id;
      bool cmp;
 -    DPRINTF("timer %d tick\n", id);
 +    DPRINTF("timer %u tick\n", id);
      /* set irq status */
      p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
      /* raise IRQ */
      if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
 -        DPRINTF("timer %d IRQ\n", id);
 +        DPRINTF("timer %u IRQ\n", id);
          qemu_irq_raise(p->timer[id].irq);
      }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      }
      if (cmp) {
 -        DPRINTF("auto reload timer %d count to %x\n", id,
 +        DPRINTF("auto reload timer %u count to %x\n", id,
                  p->timer[id].reg_tcntb);
          ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
          ptimer_run(p->timer[id].ptimer, 1);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/17] hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Statements under 'case' were in some places wrongly indented bringing
-confusion and making the code less readable.  Remove also few unneeded
-blank lines.  No functional changes.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
-file changed, 20 insertions(+), 25 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
-     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
-     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
--    index = GET_G_COMP_IDX(offset);
--    shift = 8 * (offset & 0x4);
--    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
-+        index = GET_G_COMP_IDX(offset);
-+        shift = 8 * (offset & 0x4);
-+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
-     break;
-     case G_TCON:
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
-         lt_i = GET_L_TIMER_IDX(offset);
-         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
--
-         break;
-     case L0_TCON: case L1_TCON:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
-     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
--    index = GET_G_COMP_IDX(offset);
--    shift = 8 * (offset & 0x4);
--    s->g_timer.reg.comp[index] =
--            (s->g_timer.reg.comp[index] &
--            (((uint64_t)UINT32_MAX << 32) >> shift)) +
--            (value << shift);
-+        index = GET_G_COMP_IDX(offset);
-+        shift = 8 * (offset & 0x4);
-+        s->g_timer.reg.comp[index] =
-+                (s->g_timer.reg.comp[index] &
-+                (((uint64_t)UINT32_MAX << 32) >> shift)) +
-+                (value << shift);
--    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
-+        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
--    if (offset & 0x4) {
--        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
--    } else {
--        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
--    }
-+        if (offset & 0x4) {
-+            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-+        } else {
-+            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-+        }
--    exynos4210_gfrc_restart(s);
--    break;
-+        exynos4210_gfrc_restart(s);
-+        break;
-     case G_TCON:
-         old_val = s->g_timer.reg.tcon;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case G_INT_ENB:
--
-         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
-         for (i = 0; i < MCT_GT_CMP_NUM; i++) {
-             if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case L0_TCNTB: case L1_TCNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case L0_ICNTB: case L1_ICNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         if (icntb_max[lt_i] < value) {
-             icntb_max[lt_i] = value;
-         }
--DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
--        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
-+        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
-+                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
- #endif
--break;
-+        break;
-     case L0_FRCNTB: case L1_FRCNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
---
-.7.4

-[Qemu-devel] [PULL 09/17] hw/misc/exynos4210_pmu: Add support for system poweroff
+[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
-From: Krzysztof Kozlowski <krzk@kernel.org>
+In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
 and mouse emulation. However we didn't remove all the debug-by-printf
 support. In fact there is only one printf() remaining, and it is
 redundant with the trace_ps2_write_mouse() event next to it.
 Remove the printf() and the now-unused DEBUG* macros.
-On all Exynos-based boards, the system powers down itself by driving
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Handle writing to respective PMU register to fix power off failure:
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
 ---
  hw/input/ps2.c | 9 ---------
 file changed, 9 deletions(-)
-    reboot: Power down
+diff --git a/hw/input/ps2.c b/hw/input/ps2.c
     Unable to poweroff system
     shutdown: 31 output lines suppressed due to ratelimiting
     Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000
     CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
     Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
     [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
     [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
     [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
     [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
     [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
     [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)
 Additionally the initial value of PS_HOLD has to be changed because
 recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
 When the register is kept at reset value, the kernel will not issue a
 write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
 so mimic its existence here.
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
 file changed, 19 insertions(+), 1 deletion(-)
 diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/exynos4210_pmu.c
+--- a/hw/input/ps2.c
-+++ b/hw/misc/exynos4210_pmu.c
++++ b/hw/input/ps2.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
+ #include "trace.h"
- #include "hw/sysbus.h"
-+#include "sysemu/sysemu.h"
+-/* debug PC keyboard */
+-//#define DEBUG_KBD
- #ifndef DEBUG_PMU
+-
- #define DEBUG_PMU           0
+-/* debug PC keyboard : only mouse */
-@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
+-//#define DEBUG_MOUSE
-     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
+-
-     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
+ /* Keyboard Commands */
-     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
+ #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
--    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
+ #define KBD_CMD_ECHO         0xEE
-+    /*
+@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
-+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
+     PS2MouseState *s = (PS2MouseState *)opaque;
-+     * DATA bit high, set usually by bootloader, keeps system on.
-+     */
+     trace_ps2_write_mouse(opaque, val);
-+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
+-#ifdef DEBUG_MOUSE
-     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
+-    printf("kbd: write mouse 0x%02x\n", val);
-     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
+-#endif
-     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
+     switch(s->common.write_cmd) {
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
+     default:
-     uint32_t reg[PMU_NUM_OF_REGISTERS];
+     case -1:
  } Exynos4210PmuState;
 +static void exynos4210_pmu_poweroff(void)
 +{
 +    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
 +    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +}
 +
  static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
                                      unsigned size)
  {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
              PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
                      (uint32_t)offset, (uint32_t)val);
              s->reg[i] = val;
 +            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
 +                /*
 +                 * We are interested only in setting data bit
 +                 * of PS_HOLD_CONTROL register to indicate power off request.
 +                 */
 +                exynos4210_pmu_poweroff();
 +            }
              return;
          }
          reg_p++;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/17] hw/timer/exynos4210_mct: Remove unused defines
+[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
-From: Krzysztof Kozlowski <krzk@kernel.org>
+In the mtspr helper we attempt to check for "is the timer disabled"
 with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
 is zero and the condition is always false (Coverity complains about
 the dead code.)
-Remove defines not used anywhere.
+The correct check would be to test whether the TTMR_M field in the
 register is equal to TIMER_NONE instead.  However, the
 cpu_openrisc_timer_update() function checks whether the timer is
 enabled (it looks at cpu->env.is_counting, which is set to 0 via
 cpu_openrisc_count_stop() when the TTMR_M field is set to
 TIMER_NONE), so there's no need to check for "timer disabled" in the
 target/openrisc code.  Instead, simply remove the dead code.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: Coverity CID 1005812
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Acked-by: Stafford Horne <shorne@gmail.com>
+Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
 ---
- hw/timer/exynos4210_mct.c | 3 ---
+ target/openrisc/sys_helper.c | 3 ---
 file changed, 3 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/target/openrisc/sys_helper.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/target/openrisc/sys_helper.c
-@@ -XXX,XX +XXX,XX @@ enum LocalTimerRegCntIndexes {
+@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
-     L_REG_CNT_AMOUNT
- };
+     case TO_SPR(10, 1): /* TTCR */
+         cpu_openrisc_count_set(cpu, rb);
--#define MCT_NIRQ                6
+-        if (env->ttmr & TIMER_NONE) {
- #define MCT_SFR_SIZE            0x444
+-            return;
+-        }
- #define MCT_GT_CMP_NUM          4
+         cpu_openrisc_timer_update(cpu);
+         break;
--#define MCT_GT_MAX_VAL          UINT64_MAX
+ #endif
 -
  #define MCT_GT_COUNTER_STEP     0x100000000ULL
  #define MCT_LT_COUNTER_STEP     0x100000000ULL
  #define MCT_LT_CNT_LOW_LIMIT    0x100
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/17] hw/arm/exynos: Move DRAM initialization next boards
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
-from exynos4210.c to exynos4_boards.c because DRAM is board specific,
-not SoC.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/exynos4210.h |  5 +----
- hw/arm/exynos4210.c         | 20 +-----------------
- hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
-files changed, 45 insertions(+), 30 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
-     MemoryRegion iram_mem;
-     MemoryRegion irom_mem;
-     MemoryRegion irom_alias_mem;
--    MemoryRegion dram0_mem;
--    MemoryRegion dram1_mem;
-     MemoryRegion boot_secondary;
-     MemoryRegion bootreg_mem;
-     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
- void exynos4210_write_secondary(ARMCPU *cpu,
-         const struct arm_boot_info *info);
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
--        unsigned long ram_size);
-+Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
- /* Initialize exynos4210 IRQ subsystem stub */
- qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-     return mp_affinity;
- }
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
--        unsigned long ram_size)
-+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
- {
-     int i, n;
-     Exynos4210State *s = g_new(Exynos4210State, 1);
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
--    unsigned long mem_size;
-     DeviceState *dev;
-     SysBusDevice *busdev;
-     ObjectClass *cpu_oc;
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
-                                 &s->iram_mem);
--    /* DRAM */
--    mem_size = ram_size;
--    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
--        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
--                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
--        vmstate_register_ram_global(&s->dram1_mem);
--        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
--                &s->dram1_mem);
--        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
--    }
--    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
--                           &error_fatal);
--    vmstate_register_ram_global(&s->dram0_mem);
--    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
--            &s->dram0_mem);
--
-    /* PMU.
-     * The only reason of existence at the moment is that secondary CPU boot
-     * loader uses PMU INFORM5 register as a holding pen.
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "qemu-common.h"
- #include "cpu.h"
-@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
-     EXYNOS4_NUM_OF_BOARDS
- } Exynos4BoardType;
-+typedef struct Exynos4BoardState {
-+    Exynos4210State *soc;
-+    MemoryRegion dram0_mem;
-+    MemoryRegion dram1_mem;
-+} Exynos4BoardState;
-+
- static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
-     [EXYNOS4_BOARD_NURI]     = 0xD33,
-     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
-@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
-     }
- }
--static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
--                                                   Exynos4BoardType board_type)
-+static void exynos4_boards_init_ram(Exynos4BoardState *s,
-+                                    MemoryRegion *system_mem,
-+                                    unsigned long ram_size)
-+{
-+    unsigned long mem_size = ram_size;
-+
-+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
-+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
-+                               &error_fatal);
-+        vmstate_register_ram_global(&s->dram1_mem);
-+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
-+                                    &s->dram1_mem);
-+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
-+    }
-+
-+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
-+                           &error_fatal);
-+    vmstate_register_ram_global(&s->dram0_mem);
-+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
-+                                &s->dram0_mem);
-+}
-+
-+static Exynos4BoardState *
-+exynos4_boards_init_common(MachineState *machine,
-+                           Exynos4BoardType board_type)
- {
-+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
-     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
-             machine->kernel_cmdline,
-             machine->initrd_filename);
--    return exynos4210_init(get_system_memory(),
--            exynos4_board_ram_size[board_type]);
-+    exynos4_boards_init_ram(s, get_system_memory(),
-+                            exynos4_board_ram_size[board_type]);
-+
-+    s->soc = exynos4210_init(get_system_memory());
-+
-+    return s;
- }
- static void nuri_init(MachineState *machine)
-@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
- static void smdkc210_init(MachineState *machine)
- {
--    Exynos4210State *s = exynos4_boards_init_common(machine,
--                                                    EXYNOS4_BOARD_SMDKC210);
-+    Exynos4BoardState *s = exynos4_boards_init_common(machine,
-+                                                      EXYNOS4_BOARD_SMDKC210);
-     lan9215_init(SMDK_LAN9118_BASE_ADDR,
--            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
-+            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
-     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
- }
---
-.7.4

-[Qemu-devel] [PULL 06/17] hw/arm/exynos: Declare local variables in some order
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Bring some more readability by declaring local function variables: first
-initialized ones and then the rest (with reversed-christmas-tree order).
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/exynos4210.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
- Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
- {
--    int i, n;
-     Exynos4210State *s = g_new(Exynos4210State, 1);
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
--    DeviceState *dev;
-     SysBusDevice *busdev;
-     ObjectClass *cpu_oc;
-+    DeviceState *dev;
-+    int i, n;
-     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
-     assert(cpu_oc);
---
-.7.4

-[Qemu-devel] [PULL 16/17] hw/intc/arm_gicv3_kvm: Implement pending table save
+[PULL 5/9] register: Remove unnecessary NULL check
-From: Eric Auger <eric.auger@redhat.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-This patch adds the flush of the LPI pending bits into the
+This patch fixes CID 1432800 by removing an unnecessary check.
 redistributor pending tables. This happens on VM stop.
-There is no explicit restore as the tables are implicitly sync'ed
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 on ITS table restore and on LPI enable at redistributor level.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
+ hw/core/register.c | 4 ----
-file changed, 34 insertions(+)
+file changed, 4 deletions(-)
-diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
+diff --git a/hw/core/register.c b/hw/core/register.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
+--- a/hw/core/register.c
-+++ b/hw/intc/arm_gicv3_kvm.c
++++ b/hw/core/register.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
- #include "hw/sysbus.h"
+         int index = rae[i].addr / data_size;
- #include "qemu/error-report.h"
+         RegisterInfo *r = &ri[index];
- #include "sysemu/kvm.h"
-+#include "sysemu/sysemu.h"
+-        if (data + data_size * index == 0 || !&rae[i]) {
- #include "kvm_arm.h"
+-            continue;
- #include "gicv3_internal.h"
+-        }
- #include "vgic_common.h"
+-
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
+         /* Init the register, this will zero it. */
-     REGINFO_SENTINEL
+         object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
- };
 +/**
 + * vm_change_state_handler - VM change state callback aiming at flushing
 + * RDIST pending tables into guest RAM
 + *
 + * The tables get flushed to guest RAM whenever the VM gets stopped.
 + */
 +static void vm_change_state_handler(void *opaque, int running,
 +                                    RunState state)
 +{
 +    GICv3State *s = (GICv3State *)opaque;
 +    Error *err = NULL;
 +    int ret;
 +
 +    if (running) {
 +        return;
 +    }
 +
 +    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 +                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
 +                           NULL, true, &err);
 +    if (err) {
 +        error_report_err(err);
 +    }
 +    if (ret < 0 && ret != -EFAULT) {
 +        abort();
 +    }
 +}
 +
 +
  static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
  {
      GICv3State *s = KVM_ARM_GICV3(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
              return;
          }
      }
 +    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 +                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
 +        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 +    }
  }
  static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 07/17] hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
+[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Use a define for a9mpcore_priv device type name instead of hard-coded
+Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
 string.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+>>> Overrunning array "suffixes" of 7 8-byte elements at element
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+    index 7 (byte offset 63) using index "idx" (which evaluates to 7).
 Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
 which is ~18.446 EHz, less than 1000 EHz.
 Reported-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4210.c | 3 ++-
+ util/cutils.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/util/cutils.c b/util/cutils.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/util/cutils.c
-+++ b/hw/arm/exynos4210.c
++++ b/util/cutils.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
- #include "qemu-common.h"
+     double freq = freq_hz;
- #include "qemu/log.h"
+     size_t idx = 0;
- #include "cpu.h"
-+#include "hw/cpu/a9mpcore.h"
+-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
- #include "hw/boards.h"
++    while (freq >= 1000.0) {
- #include "sysemu/sysemu.h"
+         freq /= 1000.0;
- #include "hw/sysbus.h"
+         idx++;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
      }
++    assert(idx < ARRAY_SIZE(suffixes));
-     /* Private memory region and Internal GIC */
--    dev = qdev_create(NULL, "a9mpcore_priv");
+     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
-+    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
+ }
      qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
      qdev_init_nofail(dev);
      busdev = SYS_BUS_DEVICE(dev);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/17] hw/intc/exynos4210_gic: Constify array of combiner interrupts
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-The static array of interrupt combiner mappings is not modified so it
-can be made const for code safeness.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/exynos4210_gic.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ enum ExtInt {
-  * which is INTG16 in Internal Interrupt Combiner.
-  */
--static uint32_t
-+static const uint32_t
- combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-     /* int combiner groups 16-19 */
-     { }, { }, { }, { },
---
-.7.4

-[Qemu-devel] [PULL 10/17] timer.h: Provide better monotonic time
+Deleted patch
-From: Pranith Kumar <bobby.prani@gmail.com>
-Tested and confirmed that the stretch i386 debian qcow2 image on a
-raspberry pi 2 works.
-Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
-Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/timer.h | 5 ++---
-file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/timer.h b/include/qemu/timer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/timer.h
-+++ b/include/qemu/timer.h
-@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
- /* The host CPU doesn't have an easily accessible cycle counter.
-    Just return a monotonically increasing value.  This will be
-    totally wrong, but hopefully better than nothing.  */
--static inline int64_t cpu_get_host_ticks (void)
-+static inline int64_t cpu_get_host_ticks(void)
- {
--    static int64_t ticks = 0;
--    return ticks++;
-+    return get_clock();
- }
- #endif
---
-.7.4

-[Qemu-devel] [PULL 15/17] hw/intc/arm_gicv3_its: Implement state save/restore
+[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
-From: Eric Auger <eric.auger@redhat.com>
+In commit 76346b6264a9b01979 we tried to add a configure check that
 the libgio pkg-config data was correct, which builds an executable
 linked against it.  Unfortunately this doesn't catch the problem
 (missing static library dependency info), because a "do nothing" test
 source file doesn't have any symbol references that cause the linker
 to pull in .o files from libgio.a, and so we don't see the "missing
 symbols from libmount" error that a full QEMU link triggers.
-We need to handle both registers and ITS tables. While
+(The ineffective test went unnoticed because of a typo that
-register handling is standard, ITS table handling is more
+effectively disabled libgio unconditionally, but after commit
-challenging since the kernel API is devised so that the
+a5dfc11f2 fixed that, a static link of the system emulator on
-tables are flushed into guest RAM and not in vmstate buffers.
+Ubuntu stopped working again.)
-Flushing the ITS tables on device pre_save() is too late
+Improve the gio test by having the test source fragment reference a
-since the guest RAM is already saved at this point.
+g_dbus function (which is what is indirectly causing us to end up
 wanting functions from libmount).
-Table flushing needs to happen when we are sure the vcpus
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-are stopped and before the last dirty page saving. The
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-right point is RUN_STATE_FINISH_MIGRATE but sometimes the
+Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
-VM gets stopped before migration launch so let's simply
+---
-flush the tables each time the VM gets stopped.
+ configure | 11 +++++++++--
 file changed, 9 insertions(+), 2 deletions(-)
-For regular ITS registers we just can use vmstate pre_save()
+diff --git a/configure b/configure
-and post_load() callbacks.
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
++++ b/configure
-Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
+@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+     # Check that the libraries actually work -- Ubuntu 18.04 ships
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+     # with pkg-config --static --libs data for gio-2.0 that is missing
----
+     # -lblkid and will give a link error.
- include/hw/intc/arm_gicv3_its_common.h |   8 +++
+-    write_c_skeleton
- hw/intc/arm_gicv3_its_common.c         |  10 ++++
+-    if compile_prog "" "$gio_libs" ; then
- hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
++    cat > $TMPC <<EOF
-files changed, 123 insertions(+)
++#include <gio/gio.h>
++int main(void)
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
  #define ITS_TRANS_SIZE   0x10000
  #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 +#define GITS_CTLR        0x0
 +#define GITS_IIDR        0x4
 +#define GITS_CBASER      0x80
 +#define GITS_CWRITER     0x88
 +#define GITS_CREADR      0x90
 +#define GITS_BASER       0x100
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      /* Registers */
      uint32_t ctlr;
 +    uint32_t iidr;
      uint64_t cbaser;
      uint64_t cwriter;
      uint64_t creadr;
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
      .unmigratable = true,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(ctlr, GICv3ITSState),
 +        VMSTATE_UINT32(iidr, GICv3ITSState),
 +        VMSTATE_UINT64(cbaser, GICv3ITSState),
 +        VMSTATE_UINT64(cwriter, GICv3ITSState),
 +        VMSTATE_UINT64(creadr, GICv3ITSState),
 +        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
 +        VMSTATE_END_OF_LIST()
 +    },
  };
  static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
      s->cbaser = 0;
      s->cwriter = 0;
      s->creadr = 0;
 +    s->iidr = 0;
      memset(&s->baser, 0, sizeof(s->baser));
      gicv3_its_post_load(s, 0);
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
      return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
  }
 +/**
 + * vm_change_state_handler - VM change state callback aiming at flushing
 + * ITS tables into guest RAM
 + *
 + * The tables get flushed to guest RAM whenever the VM gets stopped.
 + */
 +static void vm_change_state_handler(void *opaque, int running,
 +                                    RunState state)
 +{
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
++    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
-+    Error *err = NULL;
++    return 0;
 +    int ret;
 +
 +    if (running) {
 +        return;
 +    }
 +
 +    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 +                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
 +    if (err) {
 +        error_report_err(err);
 +    }
 +    if (ret < 0 && ret != -EFAULT) {
 +        abort();
 +    }
 +}
-+
++EOF
- static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
++    if compile_prog "$gio_cflags" "$gio_libs" ; then
- {
+         gio=yes
-     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+     else
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
+         gio=no
      kvm_msi_use_devid = true;
      kvm_gsi_direct_mapping = false;
      kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 +
 +    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
  }
  static void kvm_arm_its_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
                               &error_abort);
  }
 +/**
 + * kvm_arm_its_pre_save - handles the saving of ITS registers.
 + * ITS tables are flushed into guest RAM separately and earlier,
 + * through the VM change state handler, since at the moment pre_save()
 + * is called, the guest RAM has already been saved.
 + */
 +static void kvm_arm_its_pre_save(GICv3ITSState *s)
 +{
 +    int i;
 +
 +    for (i = 0; i < 8; i++) {
 +        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                          GITS_BASER + i * 8, &s->baser[i], false,
 +                          &error_abort);
 +    }
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CTLR, &s->ctlr, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CBASER, &s->cbaser, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CREADR, &s->creadr, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CWRITER, &s->cwriter, false, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_IIDR, &s->iidr, false, &error_abort);
 +}
 +
 +/**
 + * kvm_arm_its_post_load - Restore both the ITS registers and tables
 + */
 +static void kvm_arm_its_post_load(GICv3ITSState *s)
 +{
 +    int i;
 +
 +    if (!s->iidr) {
 +        return;
 +    }
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_IIDR, &s->iidr, true, &error_abort);
 +
 +    /*
 +     * must be written before GITS_CREADR since GITS_CBASER write
 +     * access resets GITS_CREADR.
 +     */
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CBASER, &s->cbaser, true, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CREADR, &s->creadr, true, &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CWRITER, &s->cwriter, true, &error_abort);
 +
 +
 +    for (i = 0; i < 8; i++) {
 +        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                          GITS_BASER + i * 8, &s->baser[i], true,
 +                          &error_abort);
 +    }
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
 +                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
 +                      &error_abort);
 +
 +    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +                      GITS_CTLR, &s->ctlr, true, &error_abort);
 +}
 +
  static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
      dc->realize = kvm_arm_its_realize;
      icc->send_msi = kvm_its_send_msi;
 +    icc->pre_save = kvm_arm_its_pre_save;
 +    icc->post_load = kvm_arm_its_post_load;
  }
  static const TypeInfo kvm_arm_its_info = {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/17] kvm-all: Pass an error object to kvm_device_access
+[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
-From: Eric Auger <eric.auger@redhat.com>
+The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
 power-up reset values for the T_low and T_high registers are 80 degrees C
 and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
 values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
-In some circumstances, we don't want to abort if the
+We were resetting these registers to zero, which is problematic for Linux
-kvm_device_access fails. This will be the case during ITS
+guests which enable the alert interrupt and then immediately take an
-migration, in case the ITS table save/restore fails because
+unexpected overtemperature alert because the current temperature is above
-the guest did not program the vITS correctly. So let's pass an
+freezing...
 error object to the function and return the ioctl value. New
 callers will be able to make a decision upon this returned
 value.
-Existing callers pass &error_abort which will cause the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-function to abort on failure.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
 ---
  hw/misc/tmp105.c | 3 +++
 file changed, 3 insertions(+)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
 [PMM: wrapped long line]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/sysemu/kvm.h        | 11 +++++++----
  hw/intc/arm_gic_kvm.c       |  9 +++++----
  hw/intc/arm_gicv3_its_kvm.c |  2 +-
  hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
  kvm-all.c                   | 14 ++++++++------
 files changed, 28 insertions(+), 22 deletions(-)
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
+--- a/hw/misc/tmp105.c
-+++ b/include/sysemu/kvm.h
++++ b/hw/misc/tmp105.c
-@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
-  * @attr: the attribute of that group to set or get
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
-  * @val: pointer to a storage area for the value
+     s->alarm = 0;
-  * @write: true for set and false for get operation
-+ * @errp: error object handle
++    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-  *
++    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- * This function is not allowed to fail. Use kvm_device_check_attr()
++
-- * in order to check for the availability of optional attributes.
+     tmp105_interrupt_update(s);
 + * Returns: 0 on success
 + *          < 0 on error
 + * Use kvm_device_check_attr() in order to check for the availability
 + * of optional attributes.
   */
 -void kvm_device_access(int fd, int group, uint64_t attr,
 -                       void *val, bool write);
 +int kvm_device_access(int fd, int group, uint64_t attr,
 +                      void *val, bool write, Error **errp);
  /**
   * kvm_create_device - create a KVM device for the device control API
 diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic_kvm.c
 +++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
                              uint32_t *val, bool write)
  {
      kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
 -                      KVM_VGIC_ATTR(offset, cpu), val, write);
 +                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
  }
- static void kvm_gicc_access(GICState *s, int offset, int cpu,
-                             uint32_t *val, bool write)
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
--                      KVM_VGIC_ATTR(offset, cpu), val, write);
-+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
- }
- #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
-         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
-             uint32_t numirqs = s->num_irq;
-             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
--                              &numirqs, true);
-+                              &numirqs, true, &error_abort);
-         }
-         /* Tell the kernel to complete VGIC initialization now */
-         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                                   KVM_DEV_ARM_VGIC_CTRL_INIT)) {
-             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
-+                              &error_abort);
-         }
-     } else if (ret != -ENODEV && ret != -ENOTSUP) {
-         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
-diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-     /* explicit init of the ITS */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
-     /* register the base address */
-     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
-diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
-+++ b/hw/intc/arm_gicv3_kvm.c
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
-                       KVM_VGIC_ATTR(offset, 0),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
-                       KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
-                       KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
-                       KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
-                       (VGIC_LEVEL_INFO_LINE_LEVEL <<
-                        KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
--                      val, write);
-+                      val, write, &error_abort);
- }
- /* Loop through each distributor IRQ related register; since bits
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-     /* Initialize to actual HW supported configuration */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
-                       KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
--                      &c->icc_ctlr_el1[GICV3_NS], false);
-+                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
-     c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
- }
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
-     }
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
--                      0, &s->num_irq, true);
-+                      0, &s->num_irq, true, &error_abort);
-     /* Tell the kernel to complete VGIC initialization now */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
-     kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
-                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
-diff --git a/kvm-all.c b/kvm-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/kvm-all.c
-+++ b/kvm-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/option.h"
- #include "qemu/config-file.h"
- #include "qemu/error-report.h"
-+#include "qapi/error.h"
- #include "hw/hw.h"
- #include "hw/pci/msi.h"
- #include "hw/pci/msix.h"
-@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
-     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
- }
--void kvm_device_access(int fd, int group, uint64_t attr,
--                       void *val, bool write)
-+int kvm_device_access(int fd, int group, uint64_t attr,
-+                      void *val, bool write, Error **errp)
- {
-     struct kvm_device_attr kvmattr;
-     int err;
-@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
-                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
-                            &kvmattr);
-     if (err < 0) {
--        error_report("KVM_%s_DEVICE_ATTR failed: %s",
--                     write ? "SET" : "GET", strerror(-err));
--        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
--        abort();
-+        error_setg_errno(errp, -err,
-+                         "KVM_%s_DEVICE_ATTR failed: Group %d "
-+                         "attr 0x%016" PRIx64,
-+                         write ? "SET" : "GET", group, attr);
-     }
-+    return err;
- }
- /* Return 1 on success, 0 on failure */
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/17] hw/misc: add a TMP42{1, 2, 3} device model
+[PULL 9/9] tmp105: Correct handling of temperature limit checks
-From: Cédric Le Goater <clg@kaod.org>
+The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
 signals an alert when the temperature equals or exceeds the T_high value and
 then remains high until a device register is read or the device responds to
 the SMBUS Alert Response address, or the device is put into Shutdown Mode.
 Thereafter the Alert pin will only be re-signalled when temperature falls
 below T_low; alert can then be cleared in the same set of ways, and the
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
-Largely inspired by the TMP105 temperature sensor, here is a model for
+We were misimplementing this as a simple "always alert if temperature is
-the TMP42{1,2,3} temperature sensors.
+above T_high or below T_low" condition, which gives a spurious alert on
 startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
 limit values.
-Specs can be found here :
+Implement the correct (hysteresis) behaviour by tracking whether we
 are currently looking for the temperature to rise over T_high or
 for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
-    http://www.ti.com/lit/gpn/tmp421
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
 ---
  hw/misc/tmp105.h |  7 +++++
  hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 files changed, 68 insertions(+), 9 deletions(-)
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
 Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/misc/Makefile.objs           |   1 +
  hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   1 +
 files changed, 404 insertions(+)
  create mode 100644 hw/misc/tmp421.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/hw/misc/tmp105.h
-+++ b/hw/misc/Makefile.objs
++++ b/hw/misc/tmp105.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct TMP105State {
- common-obj-$(CONFIG_APPLESMC) += applesmc.o
+     int16_t limit[2];
- common-obj-$(CONFIG_MAX111X) += max111x.o
+     int faults;
- common-obj-$(CONFIG_TMP105) += tmp105.o
+     uint8_t alarm;
-+common-obj-$(CONFIG_TMP421) += tmp421.o
++    /*
- common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
++     * The TMP105 initially looks for a temperature rising above T_high;
- common-obj-$(CONFIG_SGA) += sga.o
++     * once this is detected, the condition it looks for next is the
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
++     * temperature falling below T_low. This flag is false when initially
-diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
++     * looking for T_high, true when looking for T_low.
-new file mode 100644
++     */
-index XXXXXXX..XXXXXXX
++    bool detect_falling;
---- /dev/null
+ };
-+++ b/hw/misc/tmp421.c
-@@ -XXX,XX +XXX,XX @@
+ #endif
-+/*
+diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
-+ * Texas Instruments TMP421 temperature sensor.
+index XXXXXXX..XXXXXXX 100644
-+ *
+--- a/hw/misc/tmp105.c
-+ * Copyright (c) 2016 IBM Corporation.
++++ b/hw/misc/tmp105.c
-+ *
+@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
-+ * Largely inspired by :
+             return;
-+ *
+     }
-+ * Texas Instruments TMP105 temperature sensor.
-+ *
+-    if ((s->config >> 1) & 1) {                    /* TM */
-+ * Copyright (C) 2008 Nokia Corporation
+-        if (s->temperature >= s->limit[1])
-+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+-            s->alarm = 1;
-+ *
+-        else if (s->temperature < s->limit[0])
-+ * This program is free software; you can redistribute it and/or
+-            s->alarm = 1;
-+ * modify it under the terms of the GNU General Public License as
++    if (s->config >> 1 & 1) {
-+ * published by the Free Software Foundation; either version 2 or
++        /*
-+ * (at your option) version 3 of the License.
++         * TM == 1 : Interrupt mode. We signal Alert when the
-+ *
++         * temperature rises above T_high, and expect the guest to clear
-+ * This program is distributed in the hope that it will be useful,
++         * it (eg by reading a device register).
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++         */
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++        if (s->detect_falling) {
-+ * GNU General Public License for more details.
++            if (s->temperature < s->limit[0]) {
-+ *
++                s->alarm = 1;
-+ * You should have received a copy of the GNU General Public License along
++                s->detect_falling = false;
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
++            }
-+ */
++        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      } else {
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 0;
 +        /*
 +         * TM == 0 : Comparator mode. We signal Alert when the temperature
 +         * rises above T_high, and stop signalling it when the temperature
 +         * falls below T_low.
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
      tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
      return 0;
  }
 +static bool detect_falling_needed(void *opaque)
 +{
 +    TMP105State *s = opaque;
 +
-+#include "qemu/osdep.h"
++    /*
-+#include "hw/hw.h"
++     * We only need to migrate the detect_falling bool if it's set;
-+#include "hw/i2c/i2c.h"
++     * for migration from older machines we assume that it is false
-+#include "qapi/error.h"
++     * (ie temperature is not out of range).
-+#include "qapi/visitor.h"
++     */
-+
++    return s->detect_falling;
 +/* Manufacturer / Device ID's */
 +#define TMP421_MANUFACTURER_ID          0x55
 +#define TMP421_DEVICE_ID                0x21
 +#define TMP422_DEVICE_ID                0x22
 +#define TMP423_DEVICE_ID                0x23
 +
 +typedef struct DeviceInfo {
 +    int model;
 +    const char *name;
 +} DeviceInfo;
 +
 +static const DeviceInfo devices[] = {
 +    { TMP421_DEVICE_ID, "tmp421" },
 +    { TMP422_DEVICE_ID, "tmp422" },
 +    { TMP423_DEVICE_ID, "tmp423" },
 +};
 +
 +typedef struct TMP421State {
 +    /*< private >*/
 +    I2CSlave i2c;
 +    /*< public >*/
 +
 +    int16_t temperature[4];
 +
 +    uint8_t status;
 +    uint8_t config[2];
 +    uint8_t rate;
 +
 +    uint8_t len;
 +    uint8_t buf[2];
 +    uint8_t pointer;
 +
 +} TMP421State;
 +
 +typedef struct TMP421Class {
 +    I2CSlaveClass parent_class;
 +    DeviceInfo *dev;
 +} TMP421Class;
 +
 +#define TYPE_TMP421 "tmp421-generic"
 +#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
 +
 +#define TMP421_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
 +#define TMP421_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
 +
 +/* the TMP421 registers */
 +#define TMP421_STATUS_REG               0x08
 +#define    TMP421_STATUS_BUSY             (1 << 7)
 +#define TMP421_CONFIG_REG_1             0x09
 +#define    TMP421_CONFIG_RANGE            (1 << 2)
 +#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
 +#define TMP421_CONFIG_REG_2             0x0A
 +#define    TMP421_CONFIG_RC               (1 << 2)
 +#define    TMP421_CONFIG_LEN              (1 << 3)
 +#define    TMP421_CONFIG_REN              (1 << 4)
 +#define    TMP421_CONFIG_REN2             (1 << 5)
 +#define    TMP421_CONFIG_REN3             (1 << 6)
 +
 +#define TMP421_CONVERSION_RATE_REG      0x0B
 +#define TMP421_ONE_SHOT                 0x0F
 +
 +#define TMP421_RESET                    0xFC
 +#define TMP421_MANUFACTURER_ID_REG      0xFE
 +#define TMP421_DEVICE_ID_REG            0xFF
 +
 +#define TMP421_TEMP_MSB0                0x00
 +#define TMP421_TEMP_MSB1                0x01
 +#define TMP421_TEMP_MSB2                0x02
 +#define TMP421_TEMP_MSB3                0x03
 +#define TMP421_TEMP_LSB0                0x10
 +#define TMP421_TEMP_LSB1                0x11
 +#define TMP421_TEMP_LSB2                0x12
 +#define TMP421_TEMP_LSB3                0x13
 +
 +static const int32_t mins[2] = { -40000, -55000 };
 +static const int32_t maxs[2] = { 127000, 150000 };
 +
 +static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
 +{
 +    TMP421State *s = TMP421(obj);
 +    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
 +    int offset = ext_range * 64 * 256;
 +    int64_t value;
 +    int tempid;
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
 +    if (tempid >= 4 || tempid < 0) {
 +        error_setg(errp, "error reading %s", name);
 +        return;
 +    }
 +
 +    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
 +
 +    visit_type_int(v, name, &value, errp);
 +}
 +
-+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
++static const VMStateDescription vmstate_tmp105_detect_falling = {
-+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
++    .name = "TMP105/detect-falling",
-+ */
++    .version_id = 1,
-+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
++    .minimum_version_id = 1,
-+                                   void *opaque, Error **errp)
++    .needed = detect_falling_needed,
 +{
 +    TMP421State *s = TMP421(obj);
 +    Error *local_err = NULL;
 +    int64_t temp;
 +    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
 +    int offset = ext_range * 64 * 256;
 +    int tempid;
 +
 +    visit_type_int(v, name, &temp, &local_err);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +
 +    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
 +        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
 +                   temp / 1000, temp % 1000);
 +        return;
 +    }
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
 +    if (tempid >= 4 || tempid < 0) {
 +        error_setg(errp, "error reading %s", name);
 +        return;
 +    }
 +
 +    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
 +}
 +
 +static void tmp421_read(TMP421State *s)
 +{
 +    TMP421Class *sc = TMP421_GET_CLASS(s);
 +
 +    s->len = 0;
 +
 +    switch (s->pointer) {
 +    case TMP421_MANUFACTURER_ID_REG:
 +        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
 +        break;
 +    case TMP421_DEVICE_ID_REG:
 +        s->buf[s->len++] = sc->dev->model;
 +        break;
 +    case TMP421_CONFIG_REG_1:
 +        s->buf[s->len++] = s->config[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->buf[s->len++] = s->config[1];
 +        break;
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->buf[s->len++] = s->rate;
 +        break;
 +    case TMP421_STATUS_REG:
 +        s->buf[s->len++] = s->status;
 +        break;
 +
 +        /* FIXME: check for channel enablement in config registers */
 +    case TMP421_TEMP_MSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    }
 +}
 +
 +static void tmp421_reset(I2CSlave *i2c);
 +
 +static void tmp421_write(TMP421State *s)
 +{
 +    switch (s->pointer) {
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->rate = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_1:
 +        s->config[0] = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->config[1] = s->buf[0];
 +        break;
 +    case TMP421_RESET:
 +        tmp421_reset(I2C_SLAVE(s));
 +        break;
 +    }
 +}
 +
 +static int tmp421_rx(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len < 2) {
 +        return s->buf[s->len++];
 +    } else {
 +        return 0xff;
 +    }
 +}
 +
 +static int tmp421_tx(I2CSlave *i2c, uint8_t data)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len == 0) {
 +        /* first byte is the register pointer for a read or write
 +         * operation */
 +        s->pointer = data;
 +        s->len++;
 +    } else if (s->len == 1) {
 +        /* second byte is the data to write. The device only supports
 +         * one byte writes */
 +        s->buf[0] = data;
 +        tmp421_write(s);
 +    }
 +
 +    return 0;
 +}
 +
 +static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (event == I2C_START_RECV) {
 +        tmp421_read(s);
 +    }
 +
 +    s->len = 0;
 +    return 0;
 +}
 +
 +static const VMStateDescription vmstate_tmp421 = {
 +    .name = "TMP421",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
-+        VMSTATE_UINT8(len, TMP421State),
++        VMSTATE_BOOL(detect_falling, TMP105State),
 +        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
 +        VMSTATE_UINT8(pointer, TMP421State),
 +        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
 +        VMSTATE_UINT8(status, TMP421State),
 +        VMSTATE_UINT8(rate, TMP421State),
 +        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
 +        VMSTATE_I2C_SLAVE(i2c, TMP421State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static void tmp421_reset(I2CSlave *i2c)
+ static const VMStateDescription vmstate_tmp105 = {
-+{
+     .name = "TMP105",
-+    TMP421State *s = TMP421(i2c);
+     .version_id = 0,
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
-+
+         VMSTATE_UINT8(alarm, TMP105State),
-+    memset(s->temperature, 0, sizeof(s->temperature));
+         VMSTATE_I2C_SLAVE(i2c, TMP105State),
-+    s->pointer = 0;
+         VMSTATE_END_OF_LIST()
-+
++    },
-+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
++    .subsections = (const VMStateDescription*[]) {
-+
++        &vmstate_tmp105_detect_falling,
-+     /* resistance correction and channel enablement */
++        NULL
-+    switch (sc->dev->model) {
+     }
-+    case TMP421_DEVICE_ID:
+ };
-+        s->config[1] = 0x1c;
-+        break;
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
-+    case TMP422_DEVICE_ID:
+     s->config = 0;
-+        s->config[1] = 0x3c;
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
-+        break;
+     s->alarm = 0;
-+    case TMP423_DEVICE_ID:
++    s->detect_falling = false;
-+        s->config[1] = 0x7c;
-+        break;
+     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-+    }
+     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 +
 +    s->rate = 0x7;       /* 8Hz */
 +    s->status = 0;
 +}
 +
 +static int tmp421_init(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    tmp421_reset(&s->i2c);
 +
 +    return 0;
 +}
 +
 +static void tmp421_initfn(Object *obj)
 +{
 +    object_property_add(obj, "temperature0", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature1", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature2", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature3", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +}
 +
 +static void tmp421_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
 +    TMP421Class *sc = TMP421_CLASS(klass);
 +
 +    k->init = tmp421_init;
 +    k->event = tmp421_event;
 +    k->recv = tmp421_rx;
 +    k->send = tmp421_tx;
 +    dc->vmsd = &vmstate_tmp421;
 +    sc->dev = (DeviceInfo *) data;
 +}
 +
 +static const TypeInfo tmp421_info = {
 +    .name          = TYPE_TMP421,
 +    .parent        = TYPE_I2C_SLAVE,
 +    .instance_size = sizeof(TMP421State),
 +    .class_size    = sizeof(TMP421Class),
 +    .instance_init = tmp421_initfn,
 +    .abstract      = true,
 +};
 +
 +static void tmp421_register_types(void)
 +{
 +    int i;
 +
 +    type_register_static(&tmp421_info);
 +    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
 +        TypeInfo ti = {
 +            .name       = devices[i].name,
 +            .parent     = TYPE_TMP421,
 +            .class_init = tmp421_class_init,
 +            .class_data = (void *) &devices[i],
 +        };
 +        type_register(&ti);
 +    }
 +}
 +
 +type_init(tmp421_register_types)
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
  CONFIG_TSC2005=y
  CONFIG_LM832X=y
  CONFIG_TMP105=y
 +CONFIG_TMP421=y
  CONFIG_STELLARIS=y
  CONFIG_STELLARIS_INPUT=y
  CONFIG_STELLARIS_ENET=y
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 12/17] aspeed: add a temp sensor device on I2C bus 3
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Temperatures can be changed from the monitor with :
-    (qemu) qom-set /machine/unattached/device[2] temperature0 12000
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
- static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    DeviceState *dev;
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-      * enough to provide basic RTC features. Alarms will be missing */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+
-+    /* add a TMP423 temperature sensor */
-+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
-+                           "tmp423", 0x4c);
-+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
-+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
-+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
-+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
- }
- static void palmetto_bmc_init(MachineState *machine)
---
-.7.4

-[Qemu-devel] [PULL 13/17] timer/aspeed: fix timer enablement when a reload is not set
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-When a timer is enabled before a reload value is set, the controller
-waits for a reload value to be set before starting decrementing. This
-fix tries to cover that case by changing the timer expiry only when
-a reload value is valid.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
-file changed, 29 insertions(+), 8 deletions(-)
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
-+++ b/hw/timer/aspeed_timer.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
-             next = seq[1];
-         } else if (now < seq[2]) {
-             next = seq[2];
--        } else {
-+        } else if (t->reload) {
-             reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
-             t->start = now - ((now - t->start) % reload_ns);
-+        } else {
-+            /* no reload value, return 0 */
-+            break;
-         }
-     }
-     return next;
- }
-+static void aspeed_timer_mod(AspeedTimer *t)
-+{
-+    uint64_t next = calculate_next(t);
-+    if (next) {
-+        timer_mod(&t->timer, next);
-+    }
-+}
-+
- static void aspeed_timer_expire(void *opaque)
- {
-     AspeedTimer *t = opaque;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
-         qemu_set_irq(t->irq, t->level);
-     }
--    timer_mod(&t->timer, calculate_next(t));
-+    aspeed_timer_mod(t);
- }
- static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
-                                    uint32_t value)
- {
-     AspeedTimer *t;
-+    uint32_t old_reload;
-     trace_aspeed_timer_set_value(timer, reg, value);
-     t = &s->timers[timer];
-     switch (reg) {
-+    case TIMER_REG_RELOAD:
-+        old_reload = t->reload;
-+        t->reload = value;
-+
-+        /* If the reload value was not previously set, or zero, and
-+         * the current value is valid, try to start the timer if it is
-+         * enabled.
-+         */
-+        if (old_reload || !t->reload) {
-+            break;
-+        }
-+
-     case TIMER_REG_STATUS:
-         if (timer_enabled(t)) {
-             uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
-             uint32_t rate = calculate_rate(t);
-             t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
--            timer_mod(&t->timer, calculate_next(t));
-+            aspeed_timer_mod(t);
-         }
-         break;
--    case TIMER_REG_RELOAD:
--        t->reload = value;
--        break;
-     case TIMER_REG_MATCH_FIRST:
-     case TIMER_REG_MATCH_SECOND:
-         t->match[reg - 2] = value;
-         if (timer_enabled(t)) {
--            timer_mod(&t->timer, calculate_next(t));
-+            aspeed_timer_mod(t);
-         }
-         break;
-     default:
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
-     trace_aspeed_timer_ctrl_enable(t->id, enable);
-     if (enable) {
-         t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
--        timer_mod(&t->timer, calculate_next(t));
-+        aspeed_timer_mod(t);
-     } else {
-         timer_del(&t->timer);
-     }
---
-.7.4

Target-arm queue...

thanks
-- PMM

The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613

for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:

hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * vITS: Support save/restore
 * timer/aspeed: Fix timer enablement when reload is not set
 * aspped: add temperature sensor device
 * timer.h: Provide better monotonic time on ARM hosts
 * exynos4210: various cleanups
 * exynos4210: support system poweroff

----------------------------------------------------------------
Cédric Le Goater (3):
      hw/misc: add a TMP42{1, 2, 3} device model
      aspeed: add a temp sensor device on I2C bus 3
      timer/aspeed: fix timer enablement when a reload is not set

Eric Auger (4):
      kvm-all: Pass an error object to kvm_device_access
      hw/intc/arm_gicv3_its: Implement state save/restore
      hw/intc/arm_gicv3_kvm: Implement pending table save
      hw/intc/arm_gicv3_its: Allow save/restore

Krzysztof Kozlowski (9):
      hw/intc/exynos4210_gic: Use more meaningful name for local variable
      hw/timer/exynos4210_mct: Fix checkpatch style errors
      hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
      hw/timer/exynos4210_mct: Remove unused defines
      hw/arm/exynos: Move DRAM initialization next boards
      hw/arm/exynos: Declare local variables in some order
      hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
      hw/intc/exynos4210_gic: Constify array of combiner interrupts
      hw/misc/exynos4210_pmu: Add support for system poweroff

Pranith Kumar (1):
      timer.h: Provide better monotonic time

From: Krzysztof Kozlowski <krzk@kernel.org>

There are to SysBusDevice variables in exynos4210_gic_realize()
function: one for the device itself and second for arm_gic device.  Add
a prefix "gic" to the second one so it will be easier to understand the
code.

While at it, put local uninitialized 'i' variable at the end, next to
other uninitialized ones.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/exynos4210_gic.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
     DeviceState *dev = DEVICE(obj);
     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
     char cpu_alias_name[sizeof(cpu_prefix) + 3];
     char dist_alias_name[sizeof(cpu_prefix) + 3];
-    SysBusDevice *busdev;
+    SysBusDevice *gicbusdev;
+    uint32_t i;
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
     qdev_init_nofail(s->gic);
-    busdev = SYS_BUS_DEVICE(s->gic);
+    gicbusdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(sbd, busdev);
+    sysbus_pass_irq(sbd, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
         memory_region_init_alias(&s->cpu_alias[i], obj,
                                  cpu_alias_name,
-                                 sysbus_mmio_get_region(busdev, 1),
+                                 sysbus_mmio_get_region(gicbusdev, 1),
                                  0,
                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
         memory_region_add_subregion(&s->cpu_container,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
         memory_region_init_alias(&s->dist_alias[i], obj,
                                  dist_alias_name,
-                                 sysbus_mmio_get_region(busdev, 0),
+                                 sysbus_mmio_get_region(gicbusdev, 0),
                                  0,
                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
         memory_region_add_subregion(&s->dist_container,
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Fix checkpatch errors:
1. ERROR: spaces required around that '+' (ctx:VxV)
2. ERROR: spaces required around that '&' (ctx:VxV)

No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 {
     uint32_t freq = s->freq;
     s->freq = 24000000 /
-            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset&0x4) {
+    if (offset & 0x4) {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
     } else {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Statements under 'case' were in some places wrongly indented bringing
confusion and making the code less readable.  Remove also few unneeded
blank lines.  No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
     break;
 
     case G_TCON:
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
         lt_i = GET_L_TIMER_IDX(offset);
 
         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
-
         break;
 
     case L0_TCON: case L1_TCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    s->g_timer.reg.comp[index] =
-            (s->g_timer.reg.comp[index] &
-            (((uint64_t)UINT32_MAX << 32) >> shift)) +
-            (value << shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        s->g_timer.reg.comp[index] =
+                (s->g_timer.reg.comp[index] &
+                (((uint64_t)UINT32_MAX << 32) >> shift)) +
+                (value << shift);
 
-    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
+        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset & 0x4) {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-    } else {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-    }
+        if (offset & 0x4) {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
+        } else {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
+        }
 
-    exynos4210_gfrc_restart(s);
-    break;
+        exynos4210_gfrc_restart(s);
+        break;
 
     case G_TCON:
         old_val = s->g_timer.reg.tcon;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case G_INT_ENB:
-
         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
         for (i = 0; i < MCT_GT_CMP_NUM; i++) {
             if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_TCNTB: case L1_TCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_ICNTB: case L1_ICNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         if (icntb_max[lt_i] < value) {
             icntb_max[lt_i] = value;
         }
-DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
-        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
+        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
+                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
 #endif
-break;
+        break;
 
     case L0_FRCNTB: case L1_FRCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
from exynos4210.c to exynos4_boards.c because DRAM is board specific,
not SoC.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  5 +----
 hw/arm/exynos4210.c         | 20 +-----------------
 hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
 3 files changed, 45 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     MemoryRegion iram_mem;
     MemoryRegion irom_mem;
     MemoryRegion irom_alias_mem;
-    MemoryRegion dram0_mem;
-    MemoryRegion dram1_mem;
     MemoryRegion boot_secondary;
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size);
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return mp_affinity;
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size)
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    unsigned long mem_size;
     DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
                                 &s->iram_mem);
 
-    /* DRAM */
-    mem_size = ram_size;
-    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
-                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
-        vmstate_register_ram_global(&s->dram1_mem);
-        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
-                &s->dram1_mem);
-        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
-    }
-    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
-                           &error_fatal);
-    vmstate_register_ram_global(&s->dram0_mem);
-    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
-            &s->dram0_mem);
-
    /* PMU.
     * The only reason of existence at the moment is that secondary CPU boot
     * loader uses PMU INFORM5 register as a holding pen.
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
     EXYNOS4_NUM_OF_BOARDS
 } Exynos4BoardType;
 
+typedef struct Exynos4BoardState {
+    Exynos4210State *soc;
+    MemoryRegion dram0_mem;
+    MemoryRegion dram1_mem;
+} Exynos4BoardState;
+
 static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
     [EXYNOS4_BOARD_NURI]     = 0xD33,
     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
     }
 }
 
-static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
-                                                   Exynos4BoardType board_type)
+static void exynos4_boards_init_ram(Exynos4BoardState *s,
+                                    MemoryRegion *system_mem,
+                                    unsigned long ram_size)
+{
+    unsigned long mem_size = ram_size;
+
+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
+                               &error_fatal);
+        vmstate_register_ram_global(&s->dram1_mem);
+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
+                                    &s->dram1_mem);
+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
+    }
+
+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
+                           &error_fatal);
+    vmstate_register_ram_global(&s->dram0_mem);
+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
+                                &s->dram0_mem);
+}
+
+static Exynos4BoardState *
+exynos4_boards_init_common(MachineState *machine,
+                           Exynos4BoardType board_type)
 {
+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
     MachineClass *mc = MACHINE_GET_CLASS(machine);
 
     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
             machine->kernel_cmdline,
             machine->initrd_filename);
 
-    return exynos4210_init(get_system_memory(),
-            exynos4_board_ram_size[board_type]);
+    exynos4_boards_init_ram(s, get_system_memory(),
+                            exynos4_board_ram_size[board_type]);
+
+    s->soc = exynos4210_init(get_system_memory());
+
+    return s;
 }
 
 static void nuri_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
 
 static void smdkc210_init(MachineState *machine)
 {
-    Exynos4210State *s = exynos4_boards_init_common(machine,
-                                                    EXYNOS4_BOARD_SMDKC210);
+    Exynos4BoardState *s = exynos4_boards_init_common(machine,
+                                                      EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Bring some more readability by declaring local function variables: first
initialized ones and then the rest (with reversed-christmas-tree order).

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
 
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
-    int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
+    DeviceState *dev;
+    int i, n;
 
     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
     assert(cpu_oc);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Use a define for a9mpcore_priv device type name instead of hard-coded
string.

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "hw/cpu/a9mpcore.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     }
 
     /* Private memory region and Internal GIC */
-    dev = qdev_create(NULL, "a9mpcore_priv");
+    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
     qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
     qdev_init_nofail(dev);
     busdev = SYS_BUS_DEVICE(dev);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

On all Exynos-based boards, the system powers down itself by driving
PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
Handle writing to respective PMU register to fix power off failure:

reboot: Power down
    Unable to poweroff system
    shutdown: 31 output lines suppressed due to ratelimiting
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000

CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
    Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
    [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
    [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
    [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
    [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
    [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
    [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)

Additionally the initial value of PS_HOLD has to be changed because
recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
When the register is kept at reset value, the kernel will not issue a
write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
so mimic its existence here.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
+#include "sysemu/sysemu.h"
 
 #ifndef DEBUG_PMU
 #define DEBUG_PMU           0
@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
-    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
+    /*
+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
+     * DATA bit high, set usually by bootloader, keeps system on.
+     */
+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
 
+static void exynos4210_pmu_poweroff(void)
+{
+    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
+    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+}
+
 static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
                                     unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
             PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
                     (uint32_t)offset, (uint32_t)val);
             s->reg[i] = val;
+            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
+                /*
+                 * We are interested only in setting data bit
+                 * of PS_HOLD_CONTROL register to indicate power off request.
+                 */
+                exynos4210_pmu_poweroff();
+            }
             return;
         }
         reg_p++;
-- 
2.7.4

From: Pranith Kumar <bobby.prani@gmail.com>

Tested and confirmed that the stretch i386 debian qcow2 image on a
raspberry pi 2 works.

Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/timer.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
 /* The host CPU doesn't have an easily accessible cycle counter.
    Just return a monotonically increasing value.  This will be
    totally wrong, but hopefully better than nothing.  */
-static inline int64_t cpu_get_host_ticks (void)
+static inline int64_t cpu_get_host_ticks(void)
 {
-    static int64_t ticks = 0;
-    return ticks++;
+    return get_clock();
 }
 #endif
 
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for
the TMP42{1,2,3} temperature sensors.

Specs can be found here :

http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 404 insertions(+)
 create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
 common-obj-$(CONFIG_MAX111X) += max111x.o
 common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_TMP421) += tmp421.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Texas Instruments TMP421 temperature sensor.
+ *
+ * Copyright (c) 2016 IBM Corporation.
+ *
+ * Largely inspired by :
+ *
+ * Texas Instruments TMP105 temperature sensor.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/i2c/i2c.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+
+/* Manufacturer / Device ID's */
+#define TMP421_MANUFACTURER_ID          0x55
+#define TMP421_DEVICE_ID                0x21
+#define TMP422_DEVICE_ID                0x22
+#define TMP423_DEVICE_ID                0x23
+
+typedef struct DeviceInfo {
+    int model;
+    const char *name;
+} DeviceInfo;
+
+static const DeviceInfo devices[] = {
+    { TMP421_DEVICE_ID, "tmp421" },
+    { TMP422_DEVICE_ID, "tmp422" },
+    { TMP423_DEVICE_ID, "tmp423" },
+};
+
+typedef struct TMP421State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    int16_t temperature[4];
+
+    uint8_t status;
+    uint8_t config[2];
+    uint8_t rate;
+
+    uint8_t len;
+    uint8_t buf[2];
+    uint8_t pointer;
+
+} TMP421State;
+
+typedef struct TMP421Class {
+    I2CSlaveClass parent_class;
+    DeviceInfo *dev;
+} TMP421Class;
+
+#define TYPE_TMP421 "tmp421-generic"
+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
+
+#define TMP421_CLASS(klass) \
+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
+#define TMP421_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
+
+/* the TMP421 registers */
+#define TMP421_STATUS_REG               0x08
+#define    TMP421_STATUS_BUSY             (1 << 7)
+#define TMP421_CONFIG_REG_1             0x09
+#define    TMP421_CONFIG_RANGE            (1 << 2)
+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
+#define TMP421_CONFIG_REG_2             0x0A
+#define    TMP421_CONFIG_RC               (1 << 2)
+#define    TMP421_CONFIG_LEN              (1 << 3)
+#define    TMP421_CONFIG_REN              (1 << 4)
+#define    TMP421_CONFIG_REN2             (1 << 5)
+#define    TMP421_CONFIG_REN3             (1 << 6)
+
+#define TMP421_CONVERSION_RATE_REG      0x0B
+#define TMP421_ONE_SHOT                 0x0F
+
+#define TMP421_RESET                    0xFC
+#define TMP421_MANUFACTURER_ID_REG      0xFE
+#define TMP421_DEVICE_ID_REG            0xFF
+
+#define TMP421_TEMP_MSB0                0x00
+#define TMP421_TEMP_MSB1                0x01
+#define TMP421_TEMP_MSB2                0x02
+#define TMP421_TEMP_MSB3                0x03
+#define TMP421_TEMP_LSB0                0x10
+#define TMP421_TEMP_LSB1                0x11
+#define TMP421_TEMP_LSB2                0x12
+#define TMP421_TEMP_LSB3                0x13
+
+static const int32_t mins[2] = { -40000, -55000 };
+static const int32_t maxs[2] = { 127000, 150000 };
+
+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int64_t value;
+    int tempid;
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
+
+    visit_type_int(v, name, &value, errp);
+}
+
+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+ */
+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    Error *local_err = NULL;
+    int64_t temp;
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int tempid;
+
+    visit_type_int(v, name, &temp, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
+                   temp / 1000, temp % 1000);
+        return;
+    }
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
+}
+
+static void tmp421_read(TMP421State *s)
+{
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    s->len = 0;
+
+    switch (s->pointer) {
+    case TMP421_MANUFACTURER_ID_REG:
+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
+        break;
+    case TMP421_DEVICE_ID_REG:
+        s->buf[s->len++] = sc->dev->model;
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->buf[s->len++] = s->config[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->buf[s->len++] = s->config[1];
+        break;
+    case TMP421_CONVERSION_RATE_REG:
+        s->buf[s->len++] = s->rate;
+        break;
+    case TMP421_STATUS_REG:
+        s->buf[s->len++] = s->status;
+        break;
+
+        /* FIXME: check for channel enablement in config registers */
+    case TMP421_TEMP_MSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    }
+}
+
+static void tmp421_reset(I2CSlave *i2c);
+
+static void tmp421_write(TMP421State *s)
+{
+    switch (s->pointer) {
+    case TMP421_CONVERSION_RATE_REG:
+        s->rate = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->config[0] = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->config[1] = s->buf[0];
+        break;
+    case TMP421_RESET:
+        tmp421_reset(I2C_SLAVE(s));
+        break;
+    }
+}
+
+static int tmp421_rx(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len < 2) {
+        return s->buf[s->len++];
+    } else {
+        return 0xff;
+    }
+}
+
+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len == 0) {
+        /* first byte is the register pointer for a read or write
+         * operation */
+        s->pointer = data;
+        s->len++;
+    } else if (s->len == 1) {
+        /* second byte is the data to write. The device only supports
+         * one byte writes */
+        s->buf[0] = data;
+        tmp421_write(s);
+    }
+
+    return 0;
+}
+
+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (event == I2C_START_RECV) {
+        tmp421_read(s);
+    }
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription vmstate_tmp421 = {
+    .name = "TMP421",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, TMP421State),
+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
+        VMSTATE_UINT8(pointer, TMP421State),
+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
+        VMSTATE_UINT8(status, TMP421State),
+        VMSTATE_UINT8(rate, TMP421State),
+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tmp421_reset(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    memset(s->temperature, 0, sizeof(s->temperature));
+    s->pointer = 0;
+
+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
+
+     /* resistance correction and channel enablement */
+    switch (sc->dev->model) {
+    case TMP421_DEVICE_ID:
+        s->config[1] = 0x1c;
+        break;
+    case TMP422_DEVICE_ID:
+        s->config[1] = 0x3c;
+        break;
+    case TMP423_DEVICE_ID:
+        s->config[1] = 0x7c;
+        break;
+    }
+
+    s->rate = 0x7;       /* 8Hz */
+    s->status = 0;
+}
+
+static int tmp421_init(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    tmp421_reset(&s->i2c);
+
+    return 0;
+}
+
+static void tmp421_initfn(Object *obj)
+{
+    object_property_add(obj, "temperature0", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature1", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature2", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature3", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+}
+
+static void tmp421_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    TMP421Class *sc = TMP421_CLASS(klass);
+
+    k->init = tmp421_init;
+    k->event = tmp421_event;
+    k->recv = tmp421_rx;
+    k->send = tmp421_tx;
+    dc->vmsd = &vmstate_tmp421;
+    sc->dev = (DeviceInfo *) data;
+}
+
+static const TypeInfo tmp421_info = {
+    .name          = TYPE_TMP421,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(TMP421State),
+    .class_size    = sizeof(TMP421Class),
+    .instance_init = tmp421_initfn,
+    .abstract      = true,
+};
+
+static void tmp421_register_types(void)
+{
+    int i;
+
+    type_register_static(&tmp421_info);
+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
+        TypeInfo ti = {
+            .name       = devices[i].name,
+            .parent     = TYPE_TMP421,
+            .class_init = tmp421_class_init,
+            .class_data = (void *) &devices[i],
+        };
+        type_register(&ti);
+    }
+}
+
+type_init(tmp421_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
 CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
+CONFIG_TMP421=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Temperatures can be changed from the monitor with :

(qemu) qom-set /machine/unattached/device[2] temperature0 12000

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    DeviceState *dev;
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+
+    /* add a TMP423 temperature sensor */
+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
+                           "tmp423", 0x4c);
+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
 static void palmetto_bmc_init(MachineState *machine)
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

When a timer is enabled before a reload value is set, the controller
waits for a reload value to be set before starting decrementing. This
fix tries to cover that case by changing the timer expiry only when
a reload value is valid.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
             next = seq[1];
         } else if (now < seq[2]) {
             next = seq[2];
-        } else {
+        } else if (t->reload) {
             reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
             t->start = now - ((now - t->start) % reload_ns);
+        } else {
+            /* no reload value, return 0 */
+            break;
         }
     }
 
     return next;
 }
 
+static void aspeed_timer_mod(AspeedTimer *t)
+{
+    uint64_t next = calculate_next(t);
+    if (next) {
+        timer_mod(&t->timer, next);
+    }
+}
+
 static void aspeed_timer_expire(void *opaque)
 {
     AspeedTimer *t = opaque;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
         qemu_set_irq(t->irq, t->level);
     }
 
-    timer_mod(&t->timer, calculate_next(t));
+    aspeed_timer_mod(t);
 }
 
 static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
                                    uint32_t value)
 {
     AspeedTimer *t;
+    uint32_t old_reload;
 
     trace_aspeed_timer_set_value(timer, reg, value);
     t = &s->timers[timer];
     switch (reg) {
+    case TIMER_REG_RELOAD:
+        old_reload = t->reload;
+        t->reload = value;
+
+        /* If the reload value was not previously set, or zero, and
+         * the current value is valid, try to start the timer if it is
+         * enabled.
+         */
+        if (old_reload || !t->reload) {
+            break;
+        }
+
     case TIMER_REG_STATUS:
         if (timer_enabled(t)) {
             uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
             uint32_t rate = calculate_rate(t);
 
             t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
-    case TIMER_REG_RELOAD:
-        t->reload = value;
-        break;
     case TIMER_REG_MATCH_FIRST:
     case TIMER_REG_MATCH_SECOND:
         t->match[reg - 2] = value;
         if (timer_enabled(t)) {
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
     trace_aspeed_timer_ctrl_enable(t->id, enable);
     if (enable) {
         t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        timer_mod(&t->timer, calculate_next(t));
+        aspeed_timer_mod(t);
     } else {
         timer_del(&t->timer);
     }
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

In some circumstances, we don't want to abort if the
kvm_device_access fails. This will be the case during ITS
migration, in case the ITS table save/restore fails because
the guest did not program the vITS correctly. So let's pass an
error object to the function and return the ioctl value. New
callers will be able to make a decision upon this returned
value.

Existing callers pass &error_abort which will cause the
function to abort on failure.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
[PMM: wrapped long line]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h        | 11 +++++++----
 hw/intc/arm_gic_kvm.c       |  9 +++++----
 hw/intc/arm_gicv3_its_kvm.c |  2 +-
 hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
 kvm-all.c                   | 14 ++++++++------
 5 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
  * @attr: the attribute of that group to set or get
  * @val: pointer to a storage area for the value
  * @write: true for set and false for get operation
+ * @errp: error object handle
  *
- * This function is not allowed to fail. Use kvm_device_check_attr()
- * in order to check for the availability of optional attributes.
+ * Returns: 0 on success
+ *          < 0 on error
+ * Use kvm_device_check_attr() in order to check for the availability
+ * of optional attributes.
  */
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write);
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp);
 
 /**
  * kvm_create_device - create a KVM device for the device control API
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 static void kvm_gicc_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
             uint32_t numirqs = s->num_irq;
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
-                              &numirqs, true);
+                              &numirqs, true, &error_abort);
         }
         /* Tell the kernel to complete VGIC initialization now */
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
                                   KVM_DEV_ARM_VGIC_CTRL_INIT)) {
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
+                              &error_abort);
         }
     } else if (ret != -ENODEV && ret != -ENOTSUP) {
         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     /* explicit init of the ITS */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     /* register the base address */
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
                       KVM_VGIC_ATTR(offset, 0),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
                       KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
                       KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
                       (VGIC_LEVEL_INFO_LINE_LEVEL <<
                        KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 /* Loop through each distributor IRQ related register; since bits
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     /* Initialize to actual HW supported configuration */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
-                      &c->icc_ctlr_el1[GICV3_NS], false);
+                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
 
     c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     }
 
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
-                      0, &s->num_irq, true);
+                      0, &s->num_irq, true, &error_abort);
 
     /* Tell the kernel to complete VGIC initialization now */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
diff --git a/kvm-all.c b/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
 }
 
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write)
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp)
 {
     struct kvm_device_attr kvmattr;
     int err;
@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
                            &kvmattr);
     if (err < 0) {
-        error_report("KVM_%s_DEVICE_ATTR failed: %s",
-                     write ? "SET" : "GET", strerror(-err));
-        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
-        abort();
+        error_setg_errno(errp, -err,
+                         "KVM_%s_DEVICE_ATTR failed: Group %d "
+                         "attr 0x%016" PRIx64,
+                         write ? "SET" : "GET", group, attr);
     }
+    return err;
 }
 
 /* Return 1 on success, 0 on failure */
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We need to handle both registers and ITS tables. While
register handling is standard, ITS table handling is more
challenging since the kernel API is devised so that the
tables are flushed into guest RAM and not in vmstate buffers.

Flushing the ITS tables on device pre_save() is too late
since the guest RAM is already saved at this point.

Table flushing needs to happen when we are sure the vcpus
are stopped and before the last dirty page saving. The
right point is RUN_STATE_FINISH_MIGRATE but sometimes the
VM gets stopped before migration launch so let's simply
flush the tables each time the VM gets stopped.

For regular ITS registers we just can use vmstate pre_save()
and post_load() callbacks.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gicv3_its_common.h |   8 +++
 hw/intc/arm_gicv3_its_common.c         |  10 ++++
 hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
 3 files changed, 123 insertions(+)

diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
+#define GITS_CTLR        0x0
+#define GITS_IIDR        0x4
+#define GITS_CBASER      0x80
+#define GITS_CWRITER     0x88
+#define GITS_CREADR      0x90
+#define GITS_BASER       0x100
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
     /* Registers */
     uint32_t ctlr;
+    uint32_t iidr;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .unmigratable = true,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ctlr, GICv3ITSState),
+        VMSTATE_UINT32(iidr, GICv3ITSState),
+        VMSTATE_UINT64(cbaser, GICv3ITSState),
+        VMSTATE_UINT64(cwriter, GICv3ITSState),
+        VMSTATE_UINT64(creadr, GICv3ITSState),
+        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
+        VMSTATE_END_OF_LIST()
+    },
 };
 
 static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
     s->cbaser = 0;
     s->cwriter = 0;
     s->creadr = 0;
+    s->iidr = 0;
     memset(&s->baser, 0, sizeof(s->baser));
 
     gicv3_its_post_load(s, 0);
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
     return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 }
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * ITS tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 {
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+
+    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 static void kvm_arm_its_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
                              &error_abort);
 }
 
+/**
+ * kvm_arm_its_pre_save - handles the saving of ITS registers.
+ * ITS tables are flushed into guest RAM separately and earlier,
+ * through the VM change state handler, since at the moment pre_save()
+ * is called, the guest RAM has already been saved.
+ */
+static void kvm_arm_its_pre_save(GICv3ITSState *s)
+{
+    int i;
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], false,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, false, &error_abort);
+}
+
+/**
+ * kvm_arm_its_post_load - Restore both the ITS registers and tables
+ */
+static void kvm_arm_its_post_load(GICv3ITSState *s)
+{
+    int i;
+
+    if (!s->iidr) {
+        return;
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, true, &error_abort);
+
+    /*
+     * must be written before GITS_CREADR since GITS_CBASER write
+     * access resets GITS_CREADR.
+     */
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, true, &error_abort);
+
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], true,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
+                      &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, true, &error_abort);
+}
+
 static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 
     dc->realize = kvm_arm_its_realize;
     icc->send_msi = kvm_its_send_msi;
+    icc->pre_save = kvm_arm_its_pre_save;
+    icc->post_load = kvm_arm_its_post_load;
 }
 
 static const TypeInfo kvm_arm_its_info = {
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

This patch adds the flush of the LPI pending bits into the
redistributor pending tables. This happens on VM stop.

There is no explicit restore as the tables are implicitly sync'ed
on ITS table restore and on LPI enable at redistributor level.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
+#include "sysemu/sysemu.h"
 #include "kvm_arm.h"
 #include "gicv3_internal.h"
 #include "vgic_common.h"
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * RDIST pending tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3State *s = (GICv3State *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
+                           NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
+
 static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
 {
     GICv3State *s = KVM_ARM_GICV3(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+    }
 }
 
 static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We change the restoration priority of both the GICv3 and ITS. The
GICv3 must be restored before the ITS and the ITS needs to be restored
before PCIe devices since it translates their MSI transactions.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/migration/vmstate.h    |  2 ++
 hw/intc/arm_gicv3_common.c     |  1 +
 hw/intc/arm_gicv3_its_common.c |  2 +-
 hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 4 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
 typedef enum {
     MIG_PRI_DEFAULT = 0,
     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
+    MIG_PRI_GICV3,              /* Must happen before the ITS */
     MIG_PRI_MAX,
 } MigrationPriority;
 
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
     .minimum_version_id = 1,
     .pre_save = gicv3_pre_save,
     .post_load = gicv3_post_load,
+    .priority = MIG_PRI_GICV3,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(gicd_ctlr, GICv3State),
         VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
-    .unmigratable = true,
+    .priority = MIG_PRI_GICV3_ITS,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(ctlr, GICv3ITSState),
         VMSTATE_UINT32(iidr, GICv3ITSState),
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
     Error *local_err = NULL;
 
-    /*
-     * Block migration of a KVM GICv3 ITS device: the API for saving and
-     * restoring the state in the kernel is not yet available
-     */
-    error_setg(&s->migration_blocker, "vITS migration is not implemented");
-    migrate_add_blocker(s->migration_blocker, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        error_free(s->migration_blocker);
-        return;
-    }
-
     s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
     if (s->dev_fd < 0) {
         error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, NULL);
 
+    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+        GITS_CTLR)) {
+        error_setg(&s->migration_blocker, "This operating system kernel "
+                   "does not support vITS migration");
+        migrate_add_blocker(s->migration_blocker, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            error_free(s->migration_blocker);
+            return;
+        }
+    }
+
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-- 
2.7.4

Arm queue; bugfixes only.

thanks
-- PMM

The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117

for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:

tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: ARM_VIRT must select ARM_GIC
 * exynos: Fix bad printf format specifiers
 * hw/input/ps2.c: Remove remnants of printf debug
 * target/openrisc: Remove dead code attempting to check "is timer disabled"
 * register: Remove unnecessary NULL check
 * util/cutils: Fix Coverity array overrun in freq_to_str()
 * configure: Make "does libgio work" test pull in some actual functions
 * tmp105: reset the T_low and T_High registers
 * tmp105: Correct handling of temperature limit checks

----------------------------------------------------------------
Alex Chen (1):
      exynos: Fix bad printf format specifiers

Alistair Francis (1):
      register: Remove unnecessary NULL check

Andrew Jones (1):
      hw/arm/virt: ARM_VIRT must select ARM_GIC

Peter Maydell (5):
      hw/input/ps2.c: Remove remnants of printf debug
      target/openrisc: Remove dead code attempting to check "is timer disabled"
      configure: Make "does libgio work" test pull in some actual functions
      hw/misc/tmp105: reset the T_low and T_High registers
      tmp105: Correct handling of temperature limit checks

Philippe Mathieu-Daudé (1):
      util/cutils: Fix Coverity array overrun in freq_to_str()

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 hw/timer/exynos4210_pwm.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
     /* If CSTAT is pending and IRQ is enabled */
     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
             (s->reg.int_enb & G_INT_ENABLE(id))) {
-        DPRINTF("gcmp timer[%d] IRQ\n", id);
+        DPRINTF("gcmp timer[%u] IRQ\n", id);
         qemu_irq_raise(s->irq[id]);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
-        DPRINTF("freq=%dHz\n", s->freq);
+        DPRINTF("freq=%uHz\n", s->freq);
 
         /* global timer */
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 
     if (freq != s->timer[id].freq) {
         ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
-        DPRINTF("freq=%dHz\n", s->timer[id].freq);
+        DPRINTF("freq=%uHz\n", s->timer[id].freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     uint32_t id = s->id;
     bool cmp;
 
-    DPRINTF("timer %d tick\n", id);
+    DPRINTF("timer %u tick\n", id);
 
     /* set irq status */
     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
 
     /* raise IRQ */
     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
-        DPRINTF("timer %d IRQ\n", id);
+        DPRINTF("timer %u IRQ\n", id);
         qemu_irq_raise(p->timer[id].irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     }
 
     if (cmp) {
-        DPRINTF("auto reload timer %d count to %x\n", id,
+        DPRINTF("auto reload timer %u count to %x\n", id,
                 p->timer[id].reg_tcntb);
         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
         ptimer_run(p->timer[id].ptimer, 1);
-- 
2.20.1

In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
and mouse emulation. However we didn't remove all the debug-by-printf
support. In fact there is only one printf() remaining, and it is
redundant with the trace_ps2_write_mouse() event next to it.
Remove the printf() and the now-unused DEBUG* macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
---
 hw/input/ps2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -XXX,XX +XXX,XX @@
 
 #include "trace.h"
 
-/* debug PC keyboard */
-//#define DEBUG_KBD
-
-/* debug PC keyboard : only mouse */
-//#define DEBUG_MOUSE
-
 /* Keyboard Commands */
 #define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
 #define KBD_CMD_ECHO     	0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
     PS2MouseState *s = (PS2MouseState *)opaque;
 
     trace_ps2_write_mouse(opaque, val);
-#ifdef DEBUG_MOUSE
-    printf("kbd: write mouse 0x%02x\n", val);
-#endif
     switch(s->common.write_cmd) {
     default:
     case -1:
-- 
2.20.1

In the mtspr helper we attempt to check for "is the timer disabled"
with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
is zero and the condition is always false (Coverity complains about
the dead code.)

The correct check would be to test whether the TTMR_M field in the
register is equal to TIMER_NONE instead.  However, the
cpu_openrisc_timer_update() function checks whether the timer is
enabled (it looks at cpu->env.is_counting, which is set to 0 via
cpu_openrisc_count_stop() when the TTMR_M field is set to
TIMER_NONE), so there's no need to check for "timer disabled" in the
target/openrisc code.  Instead, simply remove the dead code.

Fixes: Coverity CID 1005812
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
---
 target/openrisc/sys_helper.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 
     case TO_SPR(10, 1): /* TTCR */
         cpu_openrisc_count_set(cpu, rb);
-        if (env->ttmr & TIMER_NONE) {
-            return;
-        }
         cpu_openrisc_timer_update(cpu);
         break;
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):

>>> Overrunning array "suffixes" of 7 8-byte elements at element
    index 7 (byte offset 63) using index "idx" (which evaluates to 7).

Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
which is ~18.446 EHz, less than 1000 EHz.

Reported-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/cutils.c b/util/cutils.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
     double freq = freq_hz;
     size_t idx = 0;
 
-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+    while (freq >= 1000.0) {
         freq /= 1000.0;
         idx++;
     }
+    assert(idx < ARRAY_SIZE(suffixes));
 
     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
 }
-- 
2.20.1

In commit 76346b6264a9b01979 we tried to add a configure check that
the libgio pkg-config data was correct, which builds an executable
linked against it.  Unfortunately this doesn't catch the problem
(missing static library dependency info), because a "do nothing" test
source file doesn't have any symbol references that cause the linker
to pull in .o files from libgio.a, and so we don't see the "missing
symbols from libmount" error that a full QEMU link triggers.

(The ineffective test went unnoticed because of a typo that
effectively disabled libgio unconditionally, but after commit
3569a5dfc11f2 fixed that, a static link of the system emulator on
Ubuntu stopped working again.)

Improve the gio test by having the test source fragment reference a
g_dbus function (which is what is indirectly causing us to end up
wanting functions from libmount).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
---
 configure | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
     # Check that the libraries actually work -- Ubuntu 18.04 ships
     # with pkg-config --static --libs data for gio-2.0 that is missing
     # -lblkid and will give a link error.
-    write_c_skeleton
-    if compile_prog "" "$gio_libs" ; then
+    cat > $TMPC <<EOF
+#include <gio/gio.h>
+int main(void)
+{
+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+    return 0;
+}
+EOF
+    if compile_prog "$gio_cflags" "$gio_libs" ; then
         gio=yes
     else
         gio=no
-- 
2.20.1

The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
power-up reset values for the T_low and T_high registers are 80 degrees C
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
values are then shifted right by four bits to give the register reset
values, since both registers store the 12 bits of temperature data in bits
[15..4] of a 16 bit register.

We were resetting these registers to zero, which is problematic for Linux
guests which enable the alert interrupt and then immediately take an
unexpected overtemperature alert because the current temperature is above
freezing...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
---
 hw/misc/tmp105.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
 
+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
+
     tmp105_interrupt_update(s);
 }
 
-- 
2.20.1

The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
signals an alert when the temperature equals or exceeds the T_high value and
then remains high until a device register is read or the device responds to
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
Thereafter the Alert pin will only be re-signalled when temperature falls
below T_low; alert can then be cleared in the same set of ways, and the
device returns to its initial "alert when temperature goes above T_high"
mode. (If this textual description is confusing, see figure 3 in the
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)

We were misimplementing this as a simple "always alert if temperature is
above T_high or below T_low" condition, which gives a spurious alert on
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
limit values.

Implement the correct (hysteresis) behaviour by tracking whether we
are currently looking for the temperature to rise over T_high or
for it to fall below T_low. Our implementation of the comparator
mode (TM==0) wasn't wrong, but rephrase it to match the way that
interrupt mode is now handled for clarity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
---
 hw/misc/tmp105.h |  7 +++++
 hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.h
+++ b/hw/misc/tmp105.h
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
     int16_t limit[2];
     int faults;
     uint8_t alarm;
+    /*
+     * The TMP105 initially looks for a temperature rising above T_high;
+     * once this is detected, the condition it looks for next is the
+     * temperature falling below T_low. This flag is false when initially
+     * looking for T_high, true when looking for T_low.
+     */
+    bool detect_falling;
 };
 
 #endif
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
             return;
     }
 
-    if ((s->config >> 1) & 1) {					/* TM */
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 1;
+    if (s->config >> 1 & 1) {
+        /*
+         * TM == 1 : Interrupt mode. We signal Alert when the
+         * temperature rises above T_high, and expect the guest to clear
+         * it (eg by reading a device register).
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 1;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     } else {
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 0;
+        /*
+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+         * rises above T_high, and stop signalling it when the temperature
+         * falls below T_low.
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 0;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     }
 
     tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool detect_falling_needed(void *opaque)
+{
+    TMP105State *s = opaque;
+
+    /*
+     * We only need to migrate the detect_falling bool if it's set;
+     * for migration from older machines we assume that it is false
+     * (ie temperature is not out of range).
+     */
+    return s->detect_falling;
+}
+
+static const VMStateDescription vmstate_tmp105_detect_falling = {
+    .name = "TMP105/detect-falling",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = detect_falling_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(detect_falling, TMP105State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_tmp105 = {
     .name = "TMP105",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
         VMSTATE_UINT8(alarm, TMP105State),
         VMSTATE_I2C_SLAVE(i2c, TMP105State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_tmp105_detect_falling,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->config = 0;
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
+    s->detect_falling = false;
 
     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- 
2.20.1