Series comparison

-[Qemu-devel] [PULL 00/17] target-arm queue
+[PULL 0/2] target-arm queue
-Target-arm queue...
+This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
 we were using uninitialized data for the guarded bit when
 combining stage 1 and stage 2 attrs.
 thanks
 -- PMM
-The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:
+The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)
+  Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410
-for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:
+for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:
-  hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)
+  target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+target-arm: Fix bug where we weren't initializing
- * vITS: Support save/restore
+            guarded bit state when combining S1/S2 attrs
  * timer/aspeed: Fix timer enablement when reload is not set
  * aspped: add temperature sensor device
  * timer.h: Provide better monotonic time on ARM hosts
  * exynos4210: various cleanups
  * exynos4210: support system poweroff
 ----------------------------------------------------------------
-Cédric Le Goater (3):
+Richard Henderson (2):
-      hw/misc: add a TMP42{1, 2, 3} device model
+      target/arm: PTE bit GP only applies to stage1
-      aspeed: add a temp sensor device on I2C bus 3
+      target/arm: Copy guarded bit in combine_cacheattrs
       timer/aspeed: fix timer enablement when a reload is not set
-Eric Auger (4):
+ target/arm/ptw.c | 11 ++++++-----
-      kvm-all: Pass an error object to kvm_device_access
+file changed, 6 insertions(+), 5 deletions(-)
       hw/intc/arm_gicv3_its: Implement state save/restore
       hw/intc/arm_gicv3_kvm: Implement pending table save
       hw/intc/arm_gicv3_its: Allow save/restore
 Krzysztof Kozlowski (9):
       hw/intc/exynos4210_gic: Use more meaningful name for local variable
       hw/timer/exynos4210_mct: Fix checkpatch style errors
       hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
       hw/timer/exynos4210_mct: Remove unused defines
       hw/arm/exynos: Move DRAM initialization next boards
       hw/arm/exynos: Declare local variables in some order
       hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
       hw/intc/exynos4210_gic: Constify array of combiner interrupts
       hw/misc/exynos4210_pmu: Add support for system poweroff
 Pranith Kumar (1):
       timer.h: Provide better monotonic time
  hw/misc/Makefile.objs                  |   1 +
  include/hw/arm/exynos4210.h            |   5 +-
  include/hw/intc/arm_gicv3_its_common.h |   8 +
  include/migration/vmstate.h            |   2 +
  include/qemu/timer.h                   |   5 +-
  include/sysemu/kvm.h                   |  11 +-
  hw/arm/aspeed.c                        |   9 +
  hw/arm/exynos4210.c                    |  27 +--
  hw/arm/exynos4_boards.c                |  50 +++-
  hw/intc/arm_gic_kvm.c                  |   9 +-
  hw/intc/arm_gicv3_common.c             |   1 +
  hw/intc/arm_gicv3_its_common.c         |  12 +-
  hw/intc/arm_gicv3_its_kvm.c            | 131 +++++++++--
  hw/intc/arm_gicv3_kvm.c                |  48 +++-
  hw/intc/exynos4210_gic.c               |  14 +-
  hw/misc/exynos4210_pmu.c               |  20 +-
  hw/misc/tmp421.c                       | 402 +++++++++++++++++++++++++++++++++
  hw/timer/aspeed_timer.c                |  37 ++-
  hw/timer/exynos4210_mct.c              |  50 ++--
  kvm-all.c                              |  14 +-
  default-configs/arm-softmmu.mak        |   1 +
 files changed, 741 insertions(+), 116 deletions(-)
  create mode 100644 hw/misc/tmp421.c

-[Qemu-devel] [PULL 01/17] hw/intc/exynos4210_gic: Use more meaningful name for local variable
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-There are to SysBusDevice variables in exynos4210_gic_realize()
-function: one for the device itself and second for arm_gic device.  Add
-a prefix "gic" to the second one so it will be easier to understand the
-code.
-While at it, put local uninitialized 'i' variable at the end, next to
-other uninitialized ones.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/exynos4210_gic.c | 12 ++++++------
-file changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-     DeviceState *dev = DEVICE(obj);
-     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
--    uint32_t i;
-     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
-     const char dist_prefix[] = "exynos4210-gic-alias_dist";
-     char cpu_alias_name[sizeof(cpu_prefix) + 3];
-     char dist_alias_name[sizeof(cpu_prefix) + 3];
--    SysBusDevice *busdev;
-+    SysBusDevice *gicbusdev;
-+    uint32_t i;
-     s->gic = qdev_create(NULL, "arm_gic");
-     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
-     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
-     qdev_init_nofail(s->gic);
--    busdev = SYS_BUS_DEVICE(s->gic);
-+    gicbusdev = SYS_BUS_DEVICE(s->gic);
-     /* Pass through outbound IRQ lines from the GIC */
--    sysbus_pass_irq(sbd, busdev);
-+    sysbus_pass_irq(sbd, gicbusdev);
-     /* Pass through inbound GPIO lines to the GIC */
-     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
-         memory_region_init_alias(&s->cpu_alias[i], obj,
-                                  cpu_alias_name,
--                                 sysbus_mmio_get_region(busdev, 1),
-+                                 sysbus_mmio_get_region(gicbusdev, 1),
-,
-                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
-         memory_region_add_subregion(&s->cpu_container,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
-         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
-         memory_region_init_alias(&s->dist_alias[i], obj,
-                                  dist_alias_name,
--                                 sysbus_mmio_get_region(busdev, 0),
-+                                 sysbus_mmio_get_region(gicbusdev, 0),
-,
-                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
-         memory_region_add_subregion(&s->dist_container,
---
-.7.4

-[Qemu-devel] [PULL 02/17] hw/timer/exynos4210_mct: Fix checkpatch style errors
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Fix checkpatch errors:
-. ERROR: spaces required around that '+' (ctx:VxV)
-. ERROR: spaces required around that '&' (ctx:VxV)
-No functional changes.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/exynos4210_mct.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
- {
-     uint32_t freq = s->freq;
-     s->freq = 24000000 /
--            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
-+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
-                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
-     if (freq != s->freq) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
--    if (offset&0x4) {
-+    if (offset & 0x4) {
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-     } else {
-         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
---
-.7.4

-[Qemu-devel] [PULL 03/17] hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Statements under 'case' were in some places wrongly indented bringing
-confusion and making the code less readable.  Remove also few unneeded
-blank lines.  No functional changes.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
-file changed, 20 insertions(+), 25 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
-     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
-     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
--    index = GET_G_COMP_IDX(offset);
--    shift = 8 * (offset & 0x4);
--    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
-+        index = GET_G_COMP_IDX(offset);
-+        shift = 8 * (offset & 0x4);
-+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
-     break;
-     case G_TCON:
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
-         lt_i = GET_L_TIMER_IDX(offset);
-         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
--
-         break;
-     case L0_TCON: case L1_TCON:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
-     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
--    index = GET_G_COMP_IDX(offset);
--    shift = 8 * (offset & 0x4);
--    s->g_timer.reg.comp[index] =
--            (s->g_timer.reg.comp[index] &
--            (((uint64_t)UINT32_MAX << 32) >> shift)) +
--            (value << shift);
-+        index = GET_G_COMP_IDX(offset);
-+        shift = 8 * (offset & 0x4);
-+        s->g_timer.reg.comp[index] =
-+                (s->g_timer.reg.comp[index] &
-+                (((uint64_t)UINT32_MAX << 32) >> shift)) +
-+                (value << shift);
--    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
-+        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
--    if (offset & 0x4) {
--        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
--    } else {
--        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
--    }
-+        if (offset & 0x4) {
-+            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-+        } else {
-+            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-+        }
--    exynos4210_gfrc_restart(s);
--    break;
-+        exynos4210_gfrc_restart(s);
-+        break;
-     case G_TCON:
-         old_val = s->g_timer.reg.tcon;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case G_INT_ENB:
--
-         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
-         for (i = 0; i < MCT_GT_CMP_NUM; i++) {
-             if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case L0_TCNTB: case L1_TCNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         break;
-     case L0_ICNTB: case L1_ICNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         if (icntb_max[lt_i] < value) {
-             icntb_max[lt_i] = value;
-         }
--DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
--        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
-+        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
-+                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
- #endif
--break;
-+        break;
-     case L0_FRCNTB: case L1_FRCNTB:
--
-         lt_i = GET_L_TIMER_IDX(offset);
-         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
---
-.7.4

-[Qemu-devel] [PULL 04/17] hw/timer/exynos4210_mct: Remove unused defines
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Remove defines not used anywhere.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/exynos4210_mct.c | 3 ---
-file changed, 3 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ enum LocalTimerRegCntIndexes {
-     L_REG_CNT_AMOUNT
- };
--#define MCT_NIRQ                6
- #define MCT_SFR_SIZE            0x444
- #define MCT_GT_CMP_NUM          4
--#define MCT_GT_MAX_VAL          UINT64_MAX
--
- #define MCT_GT_COUNTER_STEP     0x100000000ULL
- #define MCT_LT_COUNTER_STEP     0x100000000ULL
- #define MCT_LT_CNT_LOW_LIMIT    0x100
---
-.7.4

-[Qemu-devel] [PULL 05/17] hw/arm/exynos: Move DRAM initialization next boards
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
-from exynos4210.c to exynos4_boards.c because DRAM is board specific,
-not SoC.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/exynos4210.h |  5 +----
- hw/arm/exynos4210.c         | 20 +-----------------
- hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
-files changed, 45 insertions(+), 30 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
-     MemoryRegion iram_mem;
-     MemoryRegion irom_mem;
-     MemoryRegion irom_alias_mem;
--    MemoryRegion dram0_mem;
--    MemoryRegion dram1_mem;
-     MemoryRegion boot_secondary;
-     MemoryRegion bootreg_mem;
-     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
- void exynos4210_write_secondary(ARMCPU *cpu,
-         const struct arm_boot_info *info);
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
--        unsigned long ram_size);
-+Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
- /* Initialize exynos4210 IRQ subsystem stub */
- qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-     return mp_affinity;
- }
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
--        unsigned long ram_size)
-+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
- {
-     int i, n;
-     Exynos4210State *s = g_new(Exynos4210State, 1);
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
--    unsigned long mem_size;
-     DeviceState *dev;
-     SysBusDevice *busdev;
-     ObjectClass *cpu_oc;
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
-                                 &s->iram_mem);
--    /* DRAM */
--    mem_size = ram_size;
--    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
--        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
--                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
--        vmstate_register_ram_global(&s->dram1_mem);
--        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
--                &s->dram1_mem);
--        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
--    }
--    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
--                           &error_fatal);
--    vmstate_register_ram_global(&s->dram0_mem);
--    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
--            &s->dram0_mem);
--
-    /* PMU.
-     * The only reason of existence at the moment is that secondary CPU boot
-     * loader uses PMU INFORM5 register as a holding pen.
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "qemu-common.h"
- #include "cpu.h"
-@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
-     EXYNOS4_NUM_OF_BOARDS
- } Exynos4BoardType;
-+typedef struct Exynos4BoardState {
-+    Exynos4210State *soc;
-+    MemoryRegion dram0_mem;
-+    MemoryRegion dram1_mem;
-+} Exynos4BoardState;
-+
- static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
-     [EXYNOS4_BOARD_NURI]     = 0xD33,
-     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
-@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
-     }
- }
--static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
--                                                   Exynos4BoardType board_type)
-+static void exynos4_boards_init_ram(Exynos4BoardState *s,
-+                                    MemoryRegion *system_mem,
-+                                    unsigned long ram_size)
-+{
-+    unsigned long mem_size = ram_size;
-+
-+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
-+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
-+                               &error_fatal);
-+        vmstate_register_ram_global(&s->dram1_mem);
-+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
-+                                    &s->dram1_mem);
-+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
-+    }
-+
-+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
-+                           &error_fatal);
-+    vmstate_register_ram_global(&s->dram0_mem);
-+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
-+                                &s->dram0_mem);
-+}
-+
-+static Exynos4BoardState *
-+exynos4_boards_init_common(MachineState *machine,
-+                           Exynos4BoardType board_type)
- {
-+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
-     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
-             machine->kernel_cmdline,
-             machine->initrd_filename);
--    return exynos4210_init(get_system_memory(),
--            exynos4_board_ram_size[board_type]);
-+    exynos4_boards_init_ram(s, get_system_memory(),
-+                            exynos4_board_ram_size[board_type]);
-+
-+    s->soc = exynos4210_init(get_system_memory());
-+
-+    return s;
- }
- static void nuri_init(MachineState *machine)
-@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
- static void smdkc210_init(MachineState *machine)
- {
--    Exynos4210State *s = exynos4_boards_init_common(machine,
--                                                    EXYNOS4_BOARD_SMDKC210);
-+    Exynos4BoardState *s = exynos4_boards_init_common(machine,
-+                                                      EXYNOS4_BOARD_SMDKC210);
-     lan9215_init(SMDK_LAN9118_BASE_ADDR,
--            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
-+            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
-     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
- }
---
-.7.4

-[Qemu-devel] [PULL 06/17] hw/arm/exynos: Declare local variables in some order
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Bring some more readability by declaring local function variables: first
-initialized ones and then the rest (with reversed-christmas-tree order).
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/exynos4210.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
- Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
- {
--    int i, n;
-     Exynos4210State *s = g_new(Exynos4210State, 1);
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
--    DeviceState *dev;
-     SysBusDevice *busdev;
-     ObjectClass *cpu_oc;
-+    DeviceState *dev;
-+    int i, n;
-     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
-     assert(cpu_oc);
---
-.7.4

-[Qemu-devel] [PULL 07/17] hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Use a define for a9mpcore_priv device type name instead of hard-coded
-string.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/exynos4210.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
- #include "qemu/log.h"
- #include "cpu.h"
-+#include "hw/cpu/a9mpcore.h"
- #include "hw/boards.h"
- #include "sysemu/sysemu.h"
- #include "hw/sysbus.h"
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-     }
-     /* Private memory region and Internal GIC */
--    dev = qdev_create(NULL, "a9mpcore_priv");
-+    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
-     qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
-     qdev_init_nofail(dev);
-     busdev = SYS_BUS_DEVICE(dev);
---
-.7.4

-[Qemu-devel] [PULL 08/17] hw/intc/exynos4210_gic: Constify array of combiner interrupts
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-The static array of interrupt combiner mappings is not modified so it
-can be made const for code safeness.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/exynos4210_gic.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ enum ExtInt {
-  * which is INTG16 in Internal Interrupt Combiner.
-  */
--static uint32_t
-+static const uint32_t
- combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-     /* int combiner groups 16-19 */
-     { }, { }, { }, { },
---
-.7.4

-[Qemu-devel] [PULL 09/17] hw/misc/exynos4210_pmu: Add support for system poweroff
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-On all Exynos-based boards, the system powers down itself by driving
-PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
-Handle writing to respective PMU register to fix power off failure:
-    reboot: Power down
-    Unable to poweroff system
-    shutdown: 31 output lines suppressed due to ratelimiting
-    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000
-    CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
-    Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
-    [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
-    [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
-    [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
-    [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
-    [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
-    [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)
-Additionally the initial value of PS_HOLD has to be changed because
-recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
-When the register is kept at reset value, the kernel will not issue a
-write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
-so mimic its existence here.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
-file changed, 19 insertions(+), 1 deletion(-)
-diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/exynos4210_pmu.c
-+++ b/hw/misc/exynos4210_pmu.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "hw/sysbus.h"
-+#include "sysemu/sysemu.h"
- #ifndef DEBUG_PMU
- #define DEBUG_PMU           0
-@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
-     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
-     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
-     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
--    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
-+    /*
-+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
-+     * DATA bit high, set usually by bootloader, keeps system on.
-+     */
-+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
-     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
-     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
-     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
-     uint32_t reg[PMU_NUM_OF_REGISTERS];
- } Exynos4210PmuState;
-+static void exynos4210_pmu_poweroff(void)
-+{
-+    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
-+    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
-+}
-+
- static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
-                                     unsigned size)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
-             PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
-                     (uint32_t)offset, (uint32_t)val);
-             s->reg[i] = val;
-+            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
-+                /*
-+                 * We are interested only in setting data bit
-+                 * of PS_HOLD_CONTROL register to indicate power off request.
-+                 */
-+                exynos4210_pmu_poweroff();
-+            }
-             return;
-         }
-         reg_p++;
---
-.7.4

-[Qemu-devel] [PULL 10/17] timer.h: Provide better monotonic time
+Deleted patch
-From: Pranith Kumar <bobby.prani@gmail.com>
-Tested and confirmed that the stretch i386 debian qcow2 image on a
-raspberry pi 2 works.
-Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
-Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/timer.h | 5 ++---
-file changed, 2 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/timer.h b/include/qemu/timer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/timer.h
-+++ b/include/qemu/timer.h
-@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
- /* The host CPU doesn't have an easily accessible cycle counter.
-    Just return a monotonically increasing value.  This will be
-    totally wrong, but hopefully better than nothing.  */
--static inline int64_t cpu_get_host_ticks (void)
-+static inline int64_t cpu_get_host_ticks(void)
- {
--    static int64_t ticks = 0;
--    return ticks++;
-+    return get_clock();
- }
- #endif
---
-.7.4

-[Qemu-devel] [PULL 11/17] hw/misc: add a TMP42{1, 2, 3} device model
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Largely inspired by the TMP105 temperature sensor, here is a model for
-the TMP42{1,2,3} temperature sensors.
-Specs can be found here :
-    http://www.ti.com/lit/gpn/tmp421
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/Makefile.objs           |   1 +
- hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
- default-configs/arm-softmmu.mak |   1 +
-files changed, 404 insertions(+)
- create mode 100644 hw/misc/tmp421.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@
- common-obj-$(CONFIG_APPLESMC) += applesmc.o
- common-obj-$(CONFIG_MAX111X) += max111x.o
- common-obj-$(CONFIG_TMP105) += tmp105.o
-+common-obj-$(CONFIG_TMP421) += tmp421.o
- common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
- common-obj-$(CONFIG_SGA) += sga.o
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
-diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/tmp421.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Texas Instruments TMP421 temperature sensor.
-+ *
-+ * Copyright (c) 2016 IBM Corporation.
-+ *
-+ * Largely inspired by :
-+ *
-+ * Texas Instruments TMP105 temperature sensor.
-+ *
-+ * Copyright (C) 2008 Nokia Corporation
-+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 or
-+ * (at your option) version 3 of the License.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/hw.h"
-+#include "hw/i2c/i2c.h"
-+#include "qapi/error.h"
-+#include "qapi/visitor.h"
-+
-+/* Manufacturer / Device ID's */
-+#define TMP421_MANUFACTURER_ID          0x55
-+#define TMP421_DEVICE_ID                0x21
-+#define TMP422_DEVICE_ID                0x22
-+#define TMP423_DEVICE_ID                0x23
-+
-+typedef struct DeviceInfo {
-+    int model;
-+    const char *name;
-+} DeviceInfo;
-+
-+static const DeviceInfo devices[] = {
-+    { TMP421_DEVICE_ID, "tmp421" },
-+    { TMP422_DEVICE_ID, "tmp422" },
-+    { TMP423_DEVICE_ID, "tmp423" },
-+};
-+
-+typedef struct TMP421State {
-+    /*< private >*/
-+    I2CSlave i2c;
-+    /*< public >*/
-+
-+    int16_t temperature[4];
-+
-+    uint8_t status;
-+    uint8_t config[2];
-+    uint8_t rate;
-+
-+    uint8_t len;
-+    uint8_t buf[2];
-+    uint8_t pointer;
-+
-+} TMP421State;
-+
-+typedef struct TMP421Class {
-+    I2CSlaveClass parent_class;
-+    DeviceInfo *dev;
-+} TMP421Class;
-+
-+#define TYPE_TMP421 "tmp421-generic"
-+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
-+
-+#define TMP421_CLASS(klass) \
-+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
-+#define TMP421_GET_CLASS(obj) \
-+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
-+
-+/* the TMP421 registers */
-+#define TMP421_STATUS_REG               0x08
-+#define    TMP421_STATUS_BUSY             (1 << 7)
-+#define TMP421_CONFIG_REG_1             0x09
-+#define    TMP421_CONFIG_RANGE            (1 << 2)
-+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
-+#define TMP421_CONFIG_REG_2             0x0A
-+#define    TMP421_CONFIG_RC               (1 << 2)
-+#define    TMP421_CONFIG_LEN              (1 << 3)
-+#define    TMP421_CONFIG_REN              (1 << 4)
-+#define    TMP421_CONFIG_REN2             (1 << 5)
-+#define    TMP421_CONFIG_REN3             (1 << 6)
-+
-+#define TMP421_CONVERSION_RATE_REG      0x0B
-+#define TMP421_ONE_SHOT                 0x0F
-+
-+#define TMP421_RESET                    0xFC
-+#define TMP421_MANUFACTURER_ID_REG      0xFE
-+#define TMP421_DEVICE_ID_REG            0xFF
-+
-+#define TMP421_TEMP_MSB0                0x00
-+#define TMP421_TEMP_MSB1                0x01
-+#define TMP421_TEMP_MSB2                0x02
-+#define TMP421_TEMP_MSB3                0x03
-+#define TMP421_TEMP_LSB0                0x10
-+#define TMP421_TEMP_LSB1                0x11
-+#define TMP421_TEMP_LSB2                0x12
-+#define TMP421_TEMP_LSB3                0x13
-+
-+static const int32_t mins[2] = { -40000, -55000 };
-+static const int32_t maxs[2] = { 127000, 150000 };
-+
-+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
-+                                   void *opaque, Error **errp)
-+{
-+    TMP421State *s = TMP421(obj);
-+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-+    int offset = ext_range * 64 * 256;
-+    int64_t value;
-+    int tempid;
-+
-+    if (sscanf(name, "temperature%d", &tempid) != 1) {
-+        error_setg(errp, "error reading %s: %m", name);
-+        return;
-+    }
-+
-+    if (tempid >= 4 || tempid < 0) {
-+        error_setg(errp, "error reading %s", name);
-+        return;
-+    }
-+
-+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
-+
-+    visit_type_int(v, name, &value, errp);
-+}
-+
-+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
-+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
-+ */
-+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
-+                                   void *opaque, Error **errp)
-+{
-+    TMP421State *s = TMP421(obj);
-+    Error *local_err = NULL;
-+    int64_t temp;
-+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-+    int offset = ext_range * 64 * 256;
-+    int tempid;
-+
-+    visit_type_int(v, name, &temp, &local_err);
-+    if (local_err) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
-+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
-+                   temp / 1000, temp % 1000);
-+        return;
-+    }
-+
-+    if (sscanf(name, "temperature%d", &tempid) != 1) {
-+        error_setg(errp, "error reading %s: %m", name);
-+        return;
-+    }
-+
-+    if (tempid >= 4 || tempid < 0) {
-+        error_setg(errp, "error reading %s", name);
-+        return;
-+    }
-+
-+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
-+}
-+
-+static void tmp421_read(TMP421State *s)
-+{
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
-+
-+    s->len = 0;
-+
-+    switch (s->pointer) {
-+    case TMP421_MANUFACTURER_ID_REG:
-+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
-+        break;
-+    case TMP421_DEVICE_ID_REG:
-+        s->buf[s->len++] = sc->dev->model;
-+        break;
-+    case TMP421_CONFIG_REG_1:
-+        s->buf[s->len++] = s->config[0];
-+        break;
-+    case TMP421_CONFIG_REG_2:
-+        s->buf[s->len++] = s->config[1];
-+        break;
-+    case TMP421_CONVERSION_RATE_REG:
-+        s->buf[s->len++] = s->rate;
-+        break;
-+    case TMP421_STATUS_REG:
-+        s->buf[s->len++] = s->status;
-+        break;
-+
-+        /* FIXME: check for channel enablement in config registers */
-+    case TMP421_TEMP_MSB0:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB1:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB2:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB3:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB0:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB1:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB2:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB3:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-+        break;
-+    }
-+}
-+
-+static void tmp421_reset(I2CSlave *i2c);
-+
-+static void tmp421_write(TMP421State *s)
-+{
-+    switch (s->pointer) {
-+    case TMP421_CONVERSION_RATE_REG:
-+        s->rate = s->buf[0];
-+        break;
-+    case TMP421_CONFIG_REG_1:
-+        s->config[0] = s->buf[0];
-+        break;
-+    case TMP421_CONFIG_REG_2:
-+        s->config[1] = s->buf[0];
-+        break;
-+    case TMP421_RESET:
-+        tmp421_reset(I2C_SLAVE(s));
-+        break;
-+    }
-+}
-+
-+static int tmp421_rx(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (s->len < 2) {
-+        return s->buf[s->len++];
-+    } else {
-+        return 0xff;
-+    }
-+}
-+
-+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (s->len == 0) {
-+        /* first byte is the register pointer for a read or write
-+         * operation */
-+        s->pointer = data;
-+        s->len++;
-+    } else if (s->len == 1) {
-+        /* second byte is the data to write. The device only supports
-+         * one byte writes */
-+        s->buf[0] = data;
-+        tmp421_write(s);
-+    }
-+
-+    return 0;
-+}
-+
-+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (event == I2C_START_RECV) {
-+        tmp421_read(s);
-+    }
-+
-+    s->len = 0;
-+    return 0;
-+}
-+
-+static const VMStateDescription vmstate_tmp421 = {
-+    .name = "TMP421",
-+    .version_id = 0,
-+    .minimum_version_id = 0,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT8(len, TMP421State),
-+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
-+        VMSTATE_UINT8(pointer, TMP421State),
-+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
-+        VMSTATE_UINT8(status, TMP421State),
-+        VMSTATE_UINT8(rate, TMP421State),
-+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
-+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void tmp421_reset(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
-+
-+    memset(s->temperature, 0, sizeof(s->temperature));
-+    s->pointer = 0;
-+
-+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
-+
-+     /* resistance correction and channel enablement */
-+    switch (sc->dev->model) {
-+    case TMP421_DEVICE_ID:
-+        s->config[1] = 0x1c;
-+        break;
-+    case TMP422_DEVICE_ID:
-+        s->config[1] = 0x3c;
-+        break;
-+    case TMP423_DEVICE_ID:
-+        s->config[1] = 0x7c;
-+        break;
-+    }
-+
-+    s->rate = 0x7;       /* 8Hz */
-+    s->status = 0;
-+}
-+
-+static int tmp421_init(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    tmp421_reset(&s->i2c);
-+
-+    return 0;
-+}
-+
-+static void tmp421_initfn(Object *obj)
-+{
-+    object_property_add(obj, "temperature0", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature1", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature2", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature3", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+}
-+
-+static void tmp421_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
-+    TMP421Class *sc = TMP421_CLASS(klass);
-+
-+    k->init = tmp421_init;
-+    k->event = tmp421_event;
-+    k->recv = tmp421_rx;
-+    k->send = tmp421_tx;
-+    dc->vmsd = &vmstate_tmp421;
-+    sc->dev = (DeviceInfo *) data;
-+}
-+
-+static const TypeInfo tmp421_info = {
-+    .name          = TYPE_TMP421,
-+    .parent        = TYPE_I2C_SLAVE,
-+    .instance_size = sizeof(TMP421State),
-+    .class_size    = sizeof(TMP421Class),
-+    .instance_init = tmp421_initfn,
-+    .abstract      = true,
-+};
-+
-+static void tmp421_register_types(void)
-+{
-+    int i;
-+
-+    type_register_static(&tmp421_info);
-+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
-+        TypeInfo ti = {
-+            .name       = devices[i].name,
-+            .parent     = TYPE_TMP421,
-+            .class_init = tmp421_class_init,
-+            .class_data = (void *) &devices[i],
-+        };
-+        type_register(&ti);
-+    }
-+}
-+
-+type_init(tmp421_register_types)
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
-+++ b/default-configs/arm-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
- CONFIG_TSC2005=y
- CONFIG_LM832X=y
- CONFIG_TMP105=y
-+CONFIG_TMP421=y
- CONFIG_STELLARIS=y
- CONFIG_STELLARIS_INPUT=y
- CONFIG_STELLARIS_ENET=y
---
-.7.4

-[Qemu-devel] [PULL 12/17] aspeed: add a temp sensor device on I2C bus 3
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Temperatures can be changed from the monitor with :
-    (qemu) qom-set /machine/unattached/device[2] temperature0 12000
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
- static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    DeviceState *dev;
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-      * enough to provide basic RTC features. Alarms will be missing */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+
-+    /* add a TMP423 temperature sensor */
-+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
-+                           "tmp423", 0x4c);
-+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
-+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
-+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
-+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
- }
- static void palmetto_bmc_init(MachineState *machine)
---
-.7.4

-[Qemu-devel] [PULL 13/17] timer/aspeed: fix timer enablement when a reload is not set
+[PULL 1/2] target/arm: PTE bit GP only applies to stage1
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-When a timer is enabled before a reload value is set, the controller
+Only perform the extract of GP during the stage1 walk.
 waits for a reload value to be set before starting decrementing. This
 fix tries to cover that case by changing the timer expiry only when
 a reload value is valid.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
+ target/arm/ptw.c | 10 +++++-----
-file changed, 29 insertions(+), 8 deletions(-)
+file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
+--- a/target/arm/ptw.c
-+++ b/hw/timer/aspeed_timer.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-             next = seq[1];
+         result->f.attrs.secure = false;
          } else if (now < seq[2]) {
              next = seq[2];
 -        } else {
 +        } else if (t->reload) {
              reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
              t->start = now - ((now - t->start) % reload_ns);
 +        } else {
 +            /* no reload value, return 0 */
 +            break;
          }
      }
-     return next;
+-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
- }
+-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
+-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-+static void aspeed_timer_mod(AspeedTimer *t)
+-    }
-+{
+-
-+    uint64_t next = calculate_next(t);
+     if (regime_is_stage2(mmu_idx)) {
-+    if (next) {
+         result->cacheattrs.is_s2_format = true;
-+        timer_mod(&t->timer, next);
+         result->cacheattrs.attrs = extract32(attrs, 2, 4);
-+    }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-+}
+         assert(attrindx <= 7);
          result->cacheattrs.is_s2_format = false;
          result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 +
- static void aspeed_timer_expire(void *opaque)
++        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
- {
++        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-     AspeedTimer *t = opaque;
++            result->f.guarded = extract64(attrs, 50, 1); /* GP */
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
++        }
          qemu_set_irq(t->irq, t->level);
      }
--    timer_mod(&t->timer, calculate_next(t));
+     /*
 +    aspeed_timer_mod(t);
  }
  static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
                                     uint32_t value)
  {
      AspeedTimer *t;
 +    uint32_t old_reload;
      trace_aspeed_timer_set_value(timer, reg, value);
      t = &s->timers[timer];
      switch (reg) {
 +    case TIMER_REG_RELOAD:
 +        old_reload = t->reload;
 +        t->reload = value;
 +
 +        /* If the reload value was not previously set, or zero, and
 +         * the current value is valid, try to start the timer if it is
 +         * enabled.
 +         */
 +        if (old_reload || !t->reload) {
 +            break;
 +        }
 +
      case TIMER_REG_STATUS:
          if (timer_enabled(t)) {
              uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
              uint32_t rate = calculate_rate(t);
              t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
 -            timer_mod(&t->timer, calculate_next(t));
 +            aspeed_timer_mod(t);
          }
          break;
 -    case TIMER_REG_RELOAD:
 -        t->reload = value;
 -        break;
      case TIMER_REG_MATCH_FIRST:
      case TIMER_REG_MATCH_SECOND:
          t->match[reg - 2] = value;
          if (timer_enabled(t)) {
 -            timer_mod(&t->timer, calculate_next(t));
 +            aspeed_timer_mod(t);
          }
          break;
      default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
      trace_aspeed_timer_ctrl_enable(t->id, enable);
      if (enable) {
          t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        timer_mod(&t->timer, calculate_next(t));
 +        aspeed_timer_mod(t);
      } else {
          timer_del(&t->timer);
      }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 14/17] kvm-all: Pass an error object to kvm_device_access
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-In some circumstances, we don't want to abort if the
-kvm_device_access fails. This will be the case during ITS
-migration, in case the ITS table save/restore fails because
-the guest did not program the vITS correctly. So let's pass an
-error object to the function and return the ioctl value. New
-callers will be able to make a decision upon this returned
-value.
-Existing callers pass &error_abort which will cause the
-function to abort on failure.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Juan Quintela <quintela@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
-[PMM: wrapped long line]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/sysemu/kvm.h        | 11 +++++++----
- hw/intc/arm_gic_kvm.c       |  9 +++++----
- hw/intc/arm_gicv3_its_kvm.c |  2 +-
- hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
- kvm-all.c                   | 14 ++++++++------
-files changed, 28 insertions(+), 22 deletions(-)
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
-+++ b/include/sysemu/kvm.h
-@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
-  * @attr: the attribute of that group to set or get
-  * @val: pointer to a storage area for the value
-  * @write: true for set and false for get operation
-+ * @errp: error object handle
-  *
-- * This function is not allowed to fail. Use kvm_device_check_attr()
-- * in order to check for the availability of optional attributes.
-+ * Returns: 0 on success
-+ *          < 0 on error
-+ * Use kvm_device_check_attr() in order to check for the availability
-+ * of optional attributes.
-  */
--void kvm_device_access(int fd, int group, uint64_t attr,
--                       void *val, bool write);
-+int kvm_device_access(int fd, int group, uint64_t attr,
-+                      void *val, bool write, Error **errp);
- /**
-  * kvm_create_device - create a KVM device for the device control API
-diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic_kvm.c
-+++ b/hw/intc/arm_gic_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
-                             uint32_t *val, bool write)
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
--                      KVM_VGIC_ATTR(offset, cpu), val, write);
-+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
- }
- static void kvm_gicc_access(GICState *s, int offset, int cpu,
-                             uint32_t *val, bool write)
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
--                      KVM_VGIC_ATTR(offset, cpu), val, write);
-+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
- }
- #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
-         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
-             uint32_t numirqs = s->num_irq;
-             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
--                              &numirqs, true);
-+                              &numirqs, true, &error_abort);
-         }
-         /* Tell the kernel to complete VGIC initialization now */
-         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                                   KVM_DEV_ARM_VGIC_CTRL_INIT)) {
-             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
-+                              &error_abort);
-         }
-     } else if (ret != -ENODEV && ret != -ENOTSUP) {
-         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
-diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-     /* explicit init of the ITS */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
-     /* register the base address */
-     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
-diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
-+++ b/hw/intc/arm_gicv3_kvm.c
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
-                       KVM_VGIC_ATTR(offset, 0),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
-                       KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
- {
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
-                       KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
--                      val, write);
-+                      val, write, &error_abort);
- }
- static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
-@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
-                       KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
-                       (VGIC_LEVEL_INFO_LINE_LEVEL <<
-                        KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
--                      val, write);
-+                      val, write, &error_abort);
- }
- /* Loop through each distributor IRQ related register; since bits
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-     /* Initialize to actual HW supported configuration */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
-                       KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
--                      &c->icc_ctlr_el1[GICV3_NS], false);
-+                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
-     c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
- }
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
-     }
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
--                      0, &s->num_irq, true);
-+                      0, &s->num_irq, true, &error_abort);
-     /* Tell the kernel to complete VGIC initialization now */
-     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
--                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
-+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
-     kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
-                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
-diff --git a/kvm-all.c b/kvm-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/kvm-all.c
-+++ b/kvm-all.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/option.h"
- #include "qemu/config-file.h"
- #include "qemu/error-report.h"
-+#include "qapi/error.h"
- #include "hw/hw.h"
- #include "hw/pci/msi.h"
- #include "hw/pci/msix.h"
-@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
-     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
- }
--void kvm_device_access(int fd, int group, uint64_t attr,
--                       void *val, bool write)
-+int kvm_device_access(int fd, int group, uint64_t attr,
-+                      void *val, bool write, Error **errp)
- {
-     struct kvm_device_attr kvmattr;
-     int err;
-@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
-                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
-                            &kvmattr);
-     if (err < 0) {
--        error_report("KVM_%s_DEVICE_ATTR failed: %s",
--                     write ? "SET" : "GET", strerror(-err));
--        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
--        abort();
-+        error_setg_errno(errp, -err,
-+                         "KVM_%s_DEVICE_ATTR failed: Group %d "
-+                         "attr 0x%016" PRIx64,
-+                         write ? "SET" : "GET", group, attr);
-     }
-+    return err;
- }
- /* Return 1 on success, 0 on failure */
---
-.7.4

-[Qemu-devel] [PULL 15/17] hw/intc/arm_gicv3_its: Implement state save/restore
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-We need to handle both registers and ITS tables. While
-register handling is standard, ITS table handling is more
-challenging since the kernel API is devised so that the
-tables are flushed into guest RAM and not in vmstate buffers.
-Flushing the ITS tables on device pre_save() is too late
-since the guest RAM is already saved at this point.
-Table flushing needs to happen when we are sure the vcpus
-are stopped and before the last dirty page saving. The
-right point is RUN_STATE_FINISH_MIGRATE but sometimes the
-VM gets stopped before migration launch so let's simply
-flush the tables each time the VM gets stopped.
-For regular ITS registers we just can use vmstate pre_save()
-and post_load() callbacks.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/intc/arm_gicv3_its_common.h |   8 +++
- hw/intc/arm_gicv3_its_common.c         |  10 ++++
- hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
-files changed, 123 insertions(+)
-diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_its_common.h
-+++ b/include/hw/intc/arm_gicv3_its_common.h
-@@ -XXX,XX +XXX,XX @@
- #define ITS_TRANS_SIZE   0x10000
- #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
-+#define GITS_CTLR        0x0
-+#define GITS_IIDR        0x4
-+#define GITS_CBASER      0x80
-+#define GITS_CWRITER     0x88
-+#define GITS_CREADR      0x90
-+#define GITS_BASER       0x100
-+
- struct GICv3ITSState {
-     SysBusDevice parent_obj;
-@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
-     /* Registers */
-     uint32_t ctlr;
-+    uint32_t iidr;
-     uint64_t cbaser;
-     uint64_t cwriter;
-     uint64_t creadr;
-diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_common.c
-+++ b/hw/intc/arm_gicv3_its_common.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
-     .pre_save = gicv3_its_pre_save,
-     .post_load = gicv3_its_post_load,
-     .unmigratable = true,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(ctlr, GICv3ITSState),
-+        VMSTATE_UINT32(iidr, GICv3ITSState),
-+        VMSTATE_UINT64(cbaser, GICv3ITSState),
-+        VMSTATE_UINT64(cwriter, GICv3ITSState),
-+        VMSTATE_UINT64(creadr, GICv3ITSState),
-+        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
-+        VMSTATE_END_OF_LIST()
-+    },
- };
- static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
-     s->cbaser = 0;
-     s->cwriter = 0;
-     s->creadr = 0;
-+    s->iidr = 0;
-     memset(&s->baser, 0, sizeof(s->baser));
-     gicv3_its_post_load(s, 0);
-diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
-     return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
- }
-+/**
-+ * vm_change_state_handler - VM change state callback aiming at flushing
-+ * ITS tables into guest RAM
-+ *
-+ * The tables get flushed to guest RAM whenever the VM gets stopped.
-+ */
-+static void vm_change_state_handler(void *opaque, int running,
-+                                    RunState state)
-+{
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
-+    Error *err = NULL;
-+    int ret;
-+
-+    if (running) {
-+        return;
-+    }
-+
-+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
-+    if (err) {
-+        error_report_err(err);
-+    }
-+    if (ret < 0 && ret != -EFAULT) {
-+        abort();
-+    }
-+}
-+
- static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
- {
-     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-     kvm_msi_use_devid = true;
-     kvm_gsi_direct_mapping = false;
-     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-+
-+    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
- }
- static void kvm_arm_its_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
-                              &error_abort);
- }
-+/**
-+ * kvm_arm_its_pre_save - handles the saving of ITS registers.
-+ * ITS tables are flushed into guest RAM separately and earlier,
-+ * through the VM change state handler, since at the moment pre_save()
-+ * is called, the guest RAM has already been saved.
-+ */
-+static void kvm_arm_its_pre_save(GICv3ITSState *s)
-+{
-+    int i;
-+
-+    for (i = 0; i < 8; i++) {
-+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                          GITS_BASER + i * 8, &s->baser[i], false,
-+                          &error_abort);
-+    }
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CTLR, &s->ctlr, false, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CBASER, &s->cbaser, false, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CREADR, &s->creadr, false, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CWRITER, &s->cwriter, false, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_IIDR, &s->iidr, false, &error_abort);
-+}
-+
-+/**
-+ * kvm_arm_its_post_load - Restore both the ITS registers and tables
-+ */
-+static void kvm_arm_its_post_load(GICv3ITSState *s)
-+{
-+    int i;
-+
-+    if (!s->iidr) {
-+        return;
-+    }
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_IIDR, &s->iidr, true, &error_abort);
-+
-+    /*
-+     * must be written before GITS_CREADR since GITS_CBASER write
-+     * access resets GITS_CREADR.
-+     */
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CBASER, &s->cbaser, true, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CREADR, &s->creadr, true, &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CWRITER, &s->cwriter, true, &error_abort);
-+
-+
-+    for (i = 0; i < 8; i++) {
-+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                          GITS_BASER + i * 8, &s->baser[i], true,
-+                          &error_abort);
-+    }
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
-+                      &error_abort);
-+
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-+                      GITS_CTLR, &s->ctlr, true, &error_abort);
-+}
-+
- static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
-     dc->realize = kvm_arm_its_realize;
-     icc->send_msi = kvm_its_send_msi;
-+    icc->pre_save = kvm_arm_its_pre_save;
-+    icc->post_load = kvm_arm_its_post_load;
- }
- static const TypeInfo kvm_arm_its_info = {
---
-.7.4

-[Qemu-devel] [PULL 16/17] hw/intc/arm_gicv3_kvm: Implement pending table save
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-This patch adds the flush of the LPI pending bits into the
-redistributor pending tables. This happens on VM stop.
-There is no explicit restore as the tables are implicitly sync'ed
-on ITS table restore and on LPI enable at redistributor level.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
-file changed, 34 insertions(+)
-diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
-+++ b/hw/intc/arm_gicv3_kvm.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "qemu/error-report.h"
- #include "sysemu/kvm.h"
-+#include "sysemu/sysemu.h"
- #include "kvm_arm.h"
- #include "gicv3_internal.h"
- #include "vgic_common.h"
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
-     REGINFO_SENTINEL
- };
-+/**
-+ * vm_change_state_handler - VM change state callback aiming at flushing
-+ * RDIST pending tables into guest RAM
-+ *
-+ * The tables get flushed to guest RAM whenever the VM gets stopped.
-+ */
-+static void vm_change_state_handler(void *opaque, int running,
-+                                    RunState state)
-+{
-+    GICv3State *s = (GICv3State *)opaque;
-+    Error *err = NULL;
-+    int ret;
-+
-+    if (running) {
-+        return;
-+    }
-+
-+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
-+                           NULL, true, &err);
-+    if (err) {
-+        error_report_err(err);
-+    }
-+    if (ret < 0 && ret != -EFAULT) {
-+        abort();
-+    }
-+}
-+
-+
- static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
- {
-     GICv3State *s = KVM_ARM_GICV3(dev);
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
-             return;
-         }
-     }
-+    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
-+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
-+    }
- }
- static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
---
-.7.4

-[Qemu-devel] [PULL 17/17] hw/intc/arm_gicv3_its: Allow save/restore
+[PULL 2/2] target/arm: Copy guarded bit in combine_cacheattrs
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We change the restoration priority of both the GICv3 and ITS. The
+The guarded bit comes from the stage1 walk.
 GICv3 must be restored before the ITS and the ITS needs to be restored
 before PCIe devices since it translates their MSI transactions.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Fixes: Coverity CID 1507929
-Reviewed-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/migration/vmstate.h    |  2 ++
+ target/arm/ptw.c | 1 +
- hw/intc/arm_gicv3_common.c     |  1 +
+file changed, 1 insertion(+)
  hw/intc/arm_gicv3_its_common.c |  2 +-
  hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 files changed, 16 insertions(+), 13 deletions(-)
-diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/target/arm/ptw.c
-+++ b/include/migration/vmstate.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
- typedef enum {
-     MIG_PRI_DEFAULT = 0,
+     assert(!s1.is_s2_format);
-     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
+     ret.is_s2_format = false;
-+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
++    ret.guarded = s1.guarded;
-+    MIG_PRI_GICV3,              /* Must happen before the ITS */
-     MIG_PRI_MAX,
+     if (s1.attrs == 0xf0) {
- } MigrationPriority;
+         tagged = true;
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
      .minimum_version_id = 1,
      .pre_save = gicv3_pre_save,
      .post_load = gicv3_post_load,
 +    .priority = MIG_PRI_GICV3,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(gicd_ctlr, GICv3State),
          VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
      .name = "arm_gicv3_its",
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
 -    .unmigratable = true,
 +    .priority = MIG_PRI_GICV3_ITS,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(ctlr, GICv3ITSState),
          VMSTATE_UINT32(iidr, GICv3ITSState),
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
      Error *local_err = NULL;
 -    /*
 -     * Block migration of a KVM GICv3 ITS device: the API for saving and
 -     * restoring the state in the kernel is not yet available
 -     */
 -    error_setg(&s->migration_blocker, "vITS migration is not implemented");
 -    migrate_add_blocker(s->migration_blocker, &local_err);
 -    if (local_err) {
 -        error_propagate(errp, local_err);
 -        error_free(s->migration_blocker);
 -        return;
 -    }
 -
      s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
      if (s->dev_fd < 0) {
          error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      gicv3_its_init_mmio(s, NULL);
 +    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
 +        GITS_CTLR)) {
 +        error_setg(&s->migration_blocker, "This operating system kernel "
 +                   "does not support vITS migration");
 +        migrate_add_blocker(s->migration_blocker, &local_err);
 +        if (local_err) {
 +            error_propagate(errp, local_err);
 +            error_free(s->migration_blocker);
 +            return;
 +        }
 +    }
 +
      kvm_msi_use_devid = true;
      kvm_gsi_direct_mapping = false;
      kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 --
-.7.4
+.34.1

Target-arm queue...

thanks
-- PMM

The following changes since commit 735286a4f88255e1463d42ce28d8d14181fd32d4:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170613' into staging (2017-06-13 13:51:29 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170613

for you to fetch changes up to 252a7a6a968c279a4636a86b0559ba3a930a90b5:

hw/intc/arm_gicv3_its: Allow save/restore (2017-06-13 14:57:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * vITS: Support save/restore
 * timer/aspeed: Fix timer enablement when reload is not set
 * aspped: add temperature sensor device
 * timer.h: Provide better monotonic time on ARM hosts
 * exynos4210: various cleanups
 * exynos4210: support system poweroff

----------------------------------------------------------------
Cédric Le Goater (3):
      hw/misc: add a TMP42{1, 2, 3} device model
      aspeed: add a temp sensor device on I2C bus 3
      timer/aspeed: fix timer enablement when a reload is not set

Eric Auger (4):
      kvm-all: Pass an error object to kvm_device_access
      hw/intc/arm_gicv3_its: Implement state save/restore
      hw/intc/arm_gicv3_kvm: Implement pending table save
      hw/intc/arm_gicv3_its: Allow save/restore

Krzysztof Kozlowski (9):
      hw/intc/exynos4210_gic: Use more meaningful name for local variable
      hw/timer/exynos4210_mct: Fix checkpatch style errors
      hw/timer/exynos4210_mct: Cleanup indentation and empty new lines
      hw/timer/exynos4210_mct: Remove unused defines
      hw/arm/exynos: Move DRAM initialization next boards
      hw/arm/exynos: Declare local variables in some order
      hw/arm/exynos: Use type define instead of hard-coded a9mpcore_priv string
      hw/intc/exynos4210_gic: Constify array of combiner interrupts
      hw/misc/exynos4210_pmu: Add support for system poweroff

Pranith Kumar (1):
      timer.h: Provide better monotonic time

From: Krzysztof Kozlowski <krzk@kernel.org>

There are to SysBusDevice variables in exynos4210_gic_realize()
function: one for the device itself and second for arm_gic device.  Add
a prefix "gic" to the second one so it will be easier to understand the
code.

While at it, put local uninitialized 'i' variable at the end, next to
other uninitialized ones.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/exynos4210_gic.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
     DeviceState *dev = DEVICE(obj);
     Exynos4210GicState *s = EXYNOS4210_GIC(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    uint32_t i;
     const char cpu_prefix[] = "exynos4210-gic-alias_cpu";
     const char dist_prefix[] = "exynos4210-gic-alias_dist";
     char cpu_alias_name[sizeof(cpu_prefix) + 3];
     char dist_alias_name[sizeof(cpu_prefix) + 3];
-    SysBusDevice *busdev;
+    SysBusDevice *gicbusdev;
+    uint32_t i;
 
     s->gic = qdev_create(NULL, "arm_gic");
     qdev_prop_set_uint32(s->gic, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(s->gic, "num-irq", EXYNOS4210_GIC_NIRQ);
     qdev_init_nofail(s->gic);
-    busdev = SYS_BUS_DEVICE(s->gic);
+    gicbusdev = SYS_BUS_DEVICE(s->gic);
 
     /* Pass through outbound IRQ lines from the GIC */
-    sysbus_pass_irq(sbd, busdev);
+    sysbus_pass_irq(sbd, gicbusdev);
 
     /* Pass through inbound GPIO lines to the GIC */
     qdev_init_gpio_in(dev, exynos4210_gic_set_irq,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
         memory_region_init_alias(&s->cpu_alias[i], obj,
                                  cpu_alias_name,
-                                 sysbus_mmio_get_region(busdev, 1),
+                                 sysbus_mmio_get_region(gicbusdev, 1),
                                  0,
                                  EXYNOS4210_GIC_CPU_REGION_SIZE);
         memory_region_add_subregion(&s->cpu_container,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_init(Object *obj)
         sprintf(dist_alias_name, "%s%x", dist_prefix, i);
         memory_region_init_alias(&s->dist_alias[i], obj,
                                  dist_alias_name,
-                                 sysbus_mmio_get_region(busdev, 0),
+                                 sysbus_mmio_get_region(gicbusdev, 0),
                                  0,
                                  EXYNOS4210_GIC_DIST_REGION_SIZE);
         memory_region_add_subregion(&s->dist_container,
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Fix checkpatch errors:
1. ERROR: spaces required around that '+' (ctx:VxV)
2. ERROR: spaces required around that '&' (ctx:VxV)

No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 {
     uint32_t freq = s->freq;
     s->freq = 24000000 /
-            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg)+1) *
+            ((MCT_CFG_GET_PRESCALER(s->reg_mct_cfg) + 1) *
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset&0x4) {
+    if (offset & 0x4) {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
     } else {
         s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Statements under 'case' were in some places wrongly indented bringing
confusion and making the code less readable.  Remove also few unneeded
blank lines.  No functional changes.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 45 ++++++++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        value = UINT32_MAX & (s->g_timer.reg.comp[index] >> shift);
     break;
 
     case G_TCON:
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_mct_read(void *opaque, hwaddr offset,
         lt_i = GET_L_TIMER_IDX(offset);
 
         value = exynos4210_lfrc_get_count(&s->l_timer[lt_i]);
-
         break;
 
     case L0_TCON: case L1_TCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
     case G_COMP_L(0): case G_COMP_L(1): case G_COMP_L(2): case G_COMP_L(3):
     case G_COMP_U(0): case G_COMP_U(1): case G_COMP_U(2): case G_COMP_U(3):
-    index = GET_G_COMP_IDX(offset);
-    shift = 8 * (offset & 0x4);
-    s->g_timer.reg.comp[index] =
-            (s->g_timer.reg.comp[index] &
-            (((uint64_t)UINT32_MAX << 32) >> shift)) +
-            (value << shift);
+        index = GET_G_COMP_IDX(offset);
+        shift = 8 * (offset & 0x4);
+        s->g_timer.reg.comp[index] =
+                (s->g_timer.reg.comp[index] &
+                (((uint64_t)UINT32_MAX << 32) >> shift)) +
+                (value << shift);
 
-    DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
+        DPRINTF("comparator %d write 0x%llx val << %d\n", index, value, shift);
 
-    if (offset & 0x4) {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
-    } else {
-        s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-    }
+        if (offset & 0x4) {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_U(index);
+        } else {
+            s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
+        }
 
-    exynos4210_gfrc_restart(s);
-    break;
+        exynos4210_gfrc_restart(s);
+        break;
 
     case G_TCON:
         old_val = s->g_timer.reg.tcon;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case G_INT_ENB:
-
         /* Raise IRQ if transition from disabled to enabled and CSTAT pending */
         for (i = 0; i < MCT_GT_CMP_NUM; i++) {
             if ((value & G_INT_ENABLE(i)) > (s->g_timer.reg.tcon &
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_TCNTB: case L1_TCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         break;
 
     case L0_ICNTB: case L1_ICNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         if (icntb_max[lt_i] < value) {
             icntb_max[lt_i] = value;
         }
-DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
-        lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
+        DPRINTF("local timer[%d] ICNTB write %llx; max=%x, min=%x\n\n",
+                lt_i, value, icntb_max[lt_i], icntb_min[lt_i]);
 #endif
-break;
+        break;
 
     case L0_FRCNTB: case L1_FRCNTB:
-
         lt_i = GET_L_TIMER_IDX(offset);
         index = GET_L_TIMER_CNT_REG_IDX(offset, lt_i);
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Before QOM-ifying the Exynos4 SoC model, move the DRAM initialization
from exynos4210.c to exynos4_boards.c because DRAM is board specific,
not SoC.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  5 +----
 hw/arm/exynos4210.c         | 20 +-----------------
 hw/arm/exynos4_boards.c     | 50 ++++++++++++++++++++++++++++++++++++++-------
 3 files changed, 45 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     MemoryRegion iram_mem;
     MemoryRegion irom_mem;
     MemoryRegion irom_alias_mem;
-    MemoryRegion dram0_mem;
-    MemoryRegion dram1_mem;
     MemoryRegion boot_secondary;
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size);
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return mp_affinity;
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-        unsigned long ram_size)
+Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    unsigned long mem_size;
     DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     memory_region_add_subregion(system_mem, EXYNOS4210_IRAM_BASE_ADDR,
                                 &s->iram_mem);
 
-    /* DRAM */
-    mem_size = ram_size;
-    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
-        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
-                mem_size - EXYNOS4210_DRAM_MAX_SIZE, &error_fatal);
-        vmstate_register_ram_global(&s->dram1_mem);
-        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
-                &s->dram1_mem);
-        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
-    }
-    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
-                           &error_fatal);
-    vmstate_register_ram_global(&s->dram0_mem);
-    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
-            &s->dram0_mem);
-
    /* PMU.
     * The only reason of existence at the moment is that secondary CPU boot
     * loader uses PMU INFORM5 register as a holding pen.
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
     EXYNOS4_NUM_OF_BOARDS
 } Exynos4BoardType;
 
+typedef struct Exynos4BoardState {
+    Exynos4210State *soc;
+    MemoryRegion dram0_mem;
+    MemoryRegion dram1_mem;
+} Exynos4BoardState;
+
 static int exynos4_board_id[EXYNOS4_NUM_OF_BOARDS] = {
     [EXYNOS4_BOARD_NURI]     = 0xD33,
     [EXYNOS4_BOARD_SMDKC210] = 0xB16,
@@ -XXX,XX +XXX,XX @@ static void lan9215_init(uint32_t base, qemu_irq irq)
     }
 }
 
-static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
-                                                   Exynos4BoardType board_type)
+static void exynos4_boards_init_ram(Exynos4BoardState *s,
+                                    MemoryRegion *system_mem,
+                                    unsigned long ram_size)
+{
+    unsigned long mem_size = ram_size;
+
+    if (mem_size > EXYNOS4210_DRAM_MAX_SIZE) {
+        memory_region_init_ram(&s->dram1_mem, NULL, "exynos4210.dram1",
+                               mem_size - EXYNOS4210_DRAM_MAX_SIZE,
+                               &error_fatal);
+        vmstate_register_ram_global(&s->dram1_mem);
+        memory_region_add_subregion(system_mem, EXYNOS4210_DRAM1_BASE_ADDR,
+                                    &s->dram1_mem);
+        mem_size = EXYNOS4210_DRAM_MAX_SIZE;
+    }
+
+    memory_region_init_ram(&s->dram0_mem, NULL, "exynos4210.dram0", mem_size,
+                           &error_fatal);
+    vmstate_register_ram_global(&s->dram0_mem);
+    memory_region_add_subregion(system_mem, EXYNOS4210_DRAM0_BASE_ADDR,
+                                &s->dram0_mem);
+}
+
+static Exynos4BoardState *
+exynos4_boards_init_common(MachineState *machine,
+                           Exynos4BoardType board_type)
 {
+    Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
     MachineClass *mc = MACHINE_GET_CLASS(machine);
 
     if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
@@ -XXX,XX +XXX,XX @@ static Exynos4210State *exynos4_boards_init_common(MachineState *machine,
             machine->kernel_cmdline,
             machine->initrd_filename);
 
-    return exynos4210_init(get_system_memory(),
-            exynos4_board_ram_size[board_type]);
+    exynos4_boards_init_ram(s, get_system_memory(),
+                            exynos4_board_ram_size[board_type]);
+
+    s->soc = exynos4210_init(get_system_memory());
+
+    return s;
 }
 
 static void nuri_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static void nuri_init(MachineState *machine)
 
 static void smdkc210_init(MachineState *machine)
 {
-    Exynos4210State *s = exynos4_boards_init_common(machine,
-                                                    EXYNOS4_BOARD_SMDKC210);
+    Exynos4BoardState *s = exynos4_boards_init_common(machine,
+                                                      EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Bring some more readability by declaring local function variables: first
initialized ones and then the rest (with reversed-christmas-tree order).

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
 
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
-    int i, n;
     Exynos4210State *s = g_new(Exynos4210State, 1);
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
-    DeviceState *dev;
     SysBusDevice *busdev;
     ObjectClass *cpu_oc;
+    DeviceState *dev;
+    int i, n;
 
     cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, "cortex-a9");
     assert(cpu_oc);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Use a define for a9mpcore_priv device type name instead of hard-coded
string.

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "hw/cpu/a9mpcore.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     }
 
     /* Private memory region and Internal GIC */
-    dev = qdev_create(NULL, "a9mpcore_priv");
+    dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV);
     qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
     qdev_init_nofail(dev);
     busdev = SYS_BUS_DEVICE(dev);
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

On all Exynos-based boards, the system powers down itself by driving
PS_HOLD signal low - eight bit in PS_HOLD_CONTROL register of PMU.
Handle writing to respective PMU register to fix power off failure:

reboot: Power down
    Unable to poweroff system
    shutdown: 31 output lines suppressed due to ratelimiting
    Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000000

CPU: 0 PID: 1 Comm: shutdown Not tainted 4.11.0-rc8 #846
    Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
    [<c031050c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
    [<c030ba6c>] (show_stack) from [<c05b2800>] (dump_stack+0x88/0x9c)
    [<c05b2800>] (dump_stack) from [<c03d3140>] (panic+0xdc/0x268)
    [<c03d3140>] (panic) from [<c0343614>] (do_exit+0xa90/0xab4)
    [<c0343614>] (do_exit) from [<c035f2dc>] (SyS_reboot+0x164/0x1d0)
    [<c035f2dc>] (SyS_reboot) from [<c0307c80>] (ret_fast_syscall+0x0/0x3c)

Additionally the initial value of PS_HOLD has to be changed because
recent Linux kernel (v4.12-rc1) uses regmap cache for this access.
When the register is kept at reset value, the kernel will not issue a
write to it.  Usually the bootloader sets the eight bit of PS_HOLD high
so mimic its existence here.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/exynos4210_pmu.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/hw/misc/exynos4210_pmu.c b/hw/misc/exynos4210_pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/exynos4210_pmu.c
+++ b/hw/misc/exynos4210_pmu.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
+#include "sysemu/sysemu.h"
 
 #ifndef DEBUG_PMU
 #define DEBUG_PMU           0
@@ -XXX,XX +XXX,XX @@ static const Exynos4210PmuReg exynos4210_pmu_regs[] = {
     {"PAD_RETENTION_MMCB_OPTION", PAD_RETENTION_MMCB_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIA_OPTION", PAD_RETENTION_EBIA_OPTION, 0x00000000},
     {"PAD_RETENTION_EBIB_OPTION", PAD_RETENTION_EBIB_OPTION, 0x00000000},
-    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200},
+    /*
+     * PS_HOLD_CONTROL: reset value and manually toggle high the DATA bit.
+     * DATA bit high, set usually by bootloader, keeps system on.
+     */
+    {"PS_HOLD_CONTROL", PS_HOLD_CONTROL, 0x00005200 | BIT(8)},
     {"XUSBXTI_CONFIGURATION", XUSBXTI_CONFIGURATION, 0x00000001},
     {"XUSBXTI_STATUS", XUSBXTI_STATUS, 0x00000001},
     {"XUSBXTI_DURATION", XUSBXTI_DURATION, 0xFFF00000},
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210PmuState {
     uint32_t reg[PMU_NUM_OF_REGISTERS];
 } Exynos4210PmuState;
 
+static void exynos4210_pmu_poweroff(void)
+{
+    PRINT_DEBUG("QEMU PMU: PS_HOLD bit down, powering off\n");
+    qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+}
+
 static uint64_t exynos4210_pmu_read(void *opaque, hwaddr offset,
                                     unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pmu_write(void *opaque, hwaddr offset,
             PRINT_DEBUG_EXTEND("%s <0x%04x> <- 0x%04x\n", reg_p->name,
                     (uint32_t)offset, (uint32_t)val);
             s->reg[i] = val;
+            if ((offset == PS_HOLD_CONTROL) && ((val & BIT(8)) == 0)) {
+                /*
+                 * We are interested only in setting data bit
+                 * of PS_HOLD_CONTROL register to indicate power off request.
+                 */
+                exynos4210_pmu_poweroff();
+            }
             return;
         }
         reg_p++;
-- 
2.7.4

From: Pranith Kumar <bobby.prani@gmail.com>

Tested and confirmed that the stretch i386 debian qcow2 image on a
raspberry pi 2 works.

Fixes: LP#: 893208 <https://bugs.launchpad.net/qemu/+bug/893208/>
Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20170418191817.10430-1-bobby.prani@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/timer.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -XXX,XX +XXX,XX @@ static inline int64_t cpu_get_host_ticks(void)
 /* The host CPU doesn't have an easily accessible cycle counter.
    Just return a monotonically increasing value.  This will be
    totally wrong, but hopefully better than nothing.  */
-static inline int64_t cpu_get_host_ticks (void)
+static inline int64_t cpu_get_host_ticks(void)
 {
-    static int64_t ticks = 0;
-    return ticks++;
+    return get_clock();
 }
 #endif
 
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for
the TMP42{1,2,3} temperature sensors.

Specs can be found here :

http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-2-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 hw/misc/tmp421.c                | 402 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 404 insertions(+)
 create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
 common-obj-$(CONFIG_MAX111X) += max111x.o
 common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_TMP421) += tmp421.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Texas Instruments TMP421 temperature sensor.
+ *
+ * Copyright (c) 2016 IBM Corporation.
+ *
+ * Largely inspired by :
+ *
+ * Texas Instruments TMP105 temperature sensor.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/i2c/i2c.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+
+/* Manufacturer / Device ID's */
+#define TMP421_MANUFACTURER_ID          0x55
+#define TMP421_DEVICE_ID                0x21
+#define TMP422_DEVICE_ID                0x22
+#define TMP423_DEVICE_ID                0x23
+
+typedef struct DeviceInfo {
+    int model;
+    const char *name;
+} DeviceInfo;
+
+static const DeviceInfo devices[] = {
+    { TMP421_DEVICE_ID, "tmp421" },
+    { TMP422_DEVICE_ID, "tmp422" },
+    { TMP423_DEVICE_ID, "tmp423" },
+};
+
+typedef struct TMP421State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    int16_t temperature[4];
+
+    uint8_t status;
+    uint8_t config[2];
+    uint8_t rate;
+
+    uint8_t len;
+    uint8_t buf[2];
+    uint8_t pointer;
+
+} TMP421State;
+
+typedef struct TMP421Class {
+    I2CSlaveClass parent_class;
+    DeviceInfo *dev;
+} TMP421Class;
+
+#define TYPE_TMP421 "tmp421-generic"
+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
+
+#define TMP421_CLASS(klass) \
+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
+#define TMP421_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
+
+/* the TMP421 registers */
+#define TMP421_STATUS_REG               0x08
+#define    TMP421_STATUS_BUSY             (1 << 7)
+#define TMP421_CONFIG_REG_1             0x09
+#define    TMP421_CONFIG_RANGE            (1 << 2)
+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
+#define TMP421_CONFIG_REG_2             0x0A
+#define    TMP421_CONFIG_RC               (1 << 2)
+#define    TMP421_CONFIG_LEN              (1 << 3)
+#define    TMP421_CONFIG_REN              (1 << 4)
+#define    TMP421_CONFIG_REN2             (1 << 5)
+#define    TMP421_CONFIG_REN3             (1 << 6)
+
+#define TMP421_CONVERSION_RATE_REG      0x0B
+#define TMP421_ONE_SHOT                 0x0F
+
+#define TMP421_RESET                    0xFC
+#define TMP421_MANUFACTURER_ID_REG      0xFE
+#define TMP421_DEVICE_ID_REG            0xFF
+
+#define TMP421_TEMP_MSB0                0x00
+#define TMP421_TEMP_MSB1                0x01
+#define TMP421_TEMP_MSB2                0x02
+#define TMP421_TEMP_MSB3                0x03
+#define TMP421_TEMP_LSB0                0x10
+#define TMP421_TEMP_LSB1                0x11
+#define TMP421_TEMP_LSB2                0x12
+#define TMP421_TEMP_LSB3                0x13
+
+static const int32_t mins[2] = { -40000, -55000 };
+static const int32_t maxs[2] = { 127000, 150000 };
+
+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int64_t value;
+    int tempid;
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
+
+    visit_type_int(v, name, &value, errp);
+}
+
+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+ */
+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    Error *local_err = NULL;
+    int64_t temp;
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int tempid;
+
+    visit_type_int(v, name, &temp, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
+                   temp / 1000, temp % 1000);
+        return;
+    }
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
+}
+
+static void tmp421_read(TMP421State *s)
+{
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    s->len = 0;
+
+    switch (s->pointer) {
+    case TMP421_MANUFACTURER_ID_REG:
+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
+        break;
+    case TMP421_DEVICE_ID_REG:
+        s->buf[s->len++] = sc->dev->model;
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->buf[s->len++] = s->config[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->buf[s->len++] = s->config[1];
+        break;
+    case TMP421_CONVERSION_RATE_REG:
+        s->buf[s->len++] = s->rate;
+        break;
+    case TMP421_STATUS_REG:
+        s->buf[s->len++] = s->status;
+        break;
+
+        /* FIXME: check for channel enablement in config registers */
+    case TMP421_TEMP_MSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    }
+}
+
+static void tmp421_reset(I2CSlave *i2c);
+
+static void tmp421_write(TMP421State *s)
+{
+    switch (s->pointer) {
+    case TMP421_CONVERSION_RATE_REG:
+        s->rate = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->config[0] = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->config[1] = s->buf[0];
+        break;
+    case TMP421_RESET:
+        tmp421_reset(I2C_SLAVE(s));
+        break;
+    }
+}
+
+static int tmp421_rx(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len < 2) {
+        return s->buf[s->len++];
+    } else {
+        return 0xff;
+    }
+}
+
+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len == 0) {
+        /* first byte is the register pointer for a read or write
+         * operation */
+        s->pointer = data;
+        s->len++;
+    } else if (s->len == 1) {
+        /* second byte is the data to write. The device only supports
+         * one byte writes */
+        s->buf[0] = data;
+        tmp421_write(s);
+    }
+
+    return 0;
+}
+
+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (event == I2C_START_RECV) {
+        tmp421_read(s);
+    }
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription vmstate_tmp421 = {
+    .name = "TMP421",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, TMP421State),
+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
+        VMSTATE_UINT8(pointer, TMP421State),
+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
+        VMSTATE_UINT8(status, TMP421State),
+        VMSTATE_UINT8(rate, TMP421State),
+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tmp421_reset(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    memset(s->temperature, 0, sizeof(s->temperature));
+    s->pointer = 0;
+
+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
+
+     /* resistance correction and channel enablement */
+    switch (sc->dev->model) {
+    case TMP421_DEVICE_ID:
+        s->config[1] = 0x1c;
+        break;
+    case TMP422_DEVICE_ID:
+        s->config[1] = 0x3c;
+        break;
+    case TMP423_DEVICE_ID:
+        s->config[1] = 0x7c;
+        break;
+    }
+
+    s->rate = 0x7;       /* 8Hz */
+    s->status = 0;
+}
+
+static int tmp421_init(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    tmp421_reset(&s->i2c);
+
+    return 0;
+}
+
+static void tmp421_initfn(Object *obj)
+{
+    object_property_add(obj, "temperature0", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature1", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature2", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature3", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+}
+
+static void tmp421_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    TMP421Class *sc = TMP421_CLASS(klass);
+
+    k->init = tmp421_init;
+    k->event = tmp421_event;
+    k->recv = tmp421_rx;
+    k->send = tmp421_tx;
+    dc->vmsd = &vmstate_tmp421;
+    sc->dev = (DeviceInfo *) data;
+}
+
+static const TypeInfo tmp421_info = {
+    .name          = TYPE_TMP421,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(TMP421State),
+    .class_size    = sizeof(TMP421Class),
+    .instance_init = tmp421_initfn,
+    .abstract      = true,
+};
+
+static void tmp421_register_types(void)
+{
+    int i;
+
+    type_register_static(&tmp421_info);
+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
+        TypeInfo ti = {
+            .name       = devices[i].name,
+            .parent     = TYPE_TMP421,
+            .class_init = tmp421_class_init,
+            .class_data = (void *) &devices[i],
+        };
+        type_register(&ti);
+    }
+}
+
+type_init(tmp421_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
 CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
+CONFIG_TMP421=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Temperatures can be changed from the monitor with :

(qemu) qom-set /machine/unattached/device[2] temperature0 12000

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1496739230-32109-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    DeviceState *dev;
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+
+    /* add a TMP423 temperature sensor */
+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
+                           "tmp423", 0x4c);
+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
 static void palmetto_bmc_init(MachineState *machine)
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

When a timer is enabled before a reload value is set, the controller
waits for a reload value to be set before starting decrementing. This
fix tries to cover that case by changing the timer expiry only when
a reload value is valid.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 1496739312-32304-1-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/aspeed_timer.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
             next = seq[1];
         } else if (now < seq[2]) {
             next = seq[2];
-        } else {
+        } else if (t->reload) {
             reload_ns = muldiv64(t->reload, NANOSECONDS_PER_SECOND, rate);
             t->start = now - ((now - t->start) % reload_ns);
+        } else {
+            /* no reload value, return 0 */
+            break;
         }
     }
 
     return next;
 }
 
+static void aspeed_timer_mod(AspeedTimer *t)
+{
+    uint64_t next = calculate_next(t);
+    if (next) {
+        timer_mod(&t->timer, next);
+    }
+}
+
 static void aspeed_timer_expire(void *opaque)
 {
     AspeedTimer *t = opaque;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
         qemu_set_irq(t->irq, t->level);
     }
 
-    timer_mod(&t->timer, calculate_next(t));
+    aspeed_timer_mod(t);
 }
 
 static uint64_t aspeed_timer_get_value(AspeedTimer *t, int reg)
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
                                    uint32_t value)
 {
     AspeedTimer *t;
+    uint32_t old_reload;
 
     trace_aspeed_timer_set_value(timer, reg, value);
     t = &s->timers[timer];
     switch (reg) {
+    case TIMER_REG_RELOAD:
+        old_reload = t->reload;
+        t->reload = value;
+
+        /* If the reload value was not previously set, or zero, and
+         * the current value is valid, try to start the timer if it is
+         * enabled.
+         */
+        if (old_reload || !t->reload) {
+            break;
+        }
+
     case TIMER_REG_STATUS:
         if (timer_enabled(t)) {
             uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_set_value(AspeedTimerCtrlState *s, int timer, int reg,
             uint32_t rate = calculate_rate(t);
 
             t->start += muldiv64(delta, NANOSECONDS_PER_SECOND, rate);
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
-    case TIMER_REG_RELOAD:
-        t->reload = value;
-        break;
     case TIMER_REG_MATCH_FIRST:
     case TIMER_REG_MATCH_SECOND:
         t->match[reg - 2] = value;
         if (timer_enabled(t)) {
-            timer_mod(&t->timer, calculate_next(t));
+            aspeed_timer_mod(t);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_ctrl_enable(AspeedTimer *t, bool enable)
     trace_aspeed_timer_ctrl_enable(t->id, enable);
     if (enable) {
         t->start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        timer_mod(&t->timer, calculate_next(t));
+        aspeed_timer_mod(t);
     } else {
         timer_del(&t->timer);
     }
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

In some circumstances, we don't want to abort if the
kvm_device_access fails. This will be the case during ITS
migration, in case the ITS table save/restore fails because
the guest did not program the vITS correctly. So let's pass an
error object to the function and return the ioctl value. New
callers will be able to make a decision upon this returned
value.

Existing callers pass &error_abort which will cause the
function to abort on failure.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-id: 1497023553-18411-2-git-send-email-eric.auger@redhat.com
[PMM: wrapped long line]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h        | 11 +++++++----
 hw/intc/arm_gic_kvm.c       |  9 +++++----
 hw/intc/arm_gicv3_its_kvm.c |  2 +-
 hw/intc/arm_gicv3_kvm.c     | 14 +++++++-------
 kvm-all.c                   | 14 ++++++++------
 5 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int fd, uint32_t group, uint64_t attr);
  * @attr: the attribute of that group to set or get
  * @val: pointer to a storage area for the value
  * @write: true for set and false for get operation
+ * @errp: error object handle
  *
- * This function is not allowed to fail. Use kvm_device_check_attr()
- * in order to check for the availability of optional attributes.
+ * Returns: 0 on success
+ *          < 0 on error
+ * Use kvm_device_check_attr() in order to check for the availability
+ * of optional attributes.
  */
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write);
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp);
 
 /**
  * kvm_create_device - create a KVM device for the device control API
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_gicd_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 static void kvm_gicc_access(GICState *s, int offset, int cpu,
                             uint32_t *val, bool write)
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_REGS,
-                      KVM_VGIC_ATTR(offset, cpu), val, write);
+                      KVM_VGIC_ATTR(offset, cpu), val, write, &error_abort);
 }
 
 #define for_each_irq_reg(_ctr, _max_irq, _field_width) \
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) {
             uint32_t numirqs = s->num_irq;
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0,
-                              &numirqs, true);
+                              &numirqs, true, &error_abort);
         }
         /* Tell the kernel to complete VGIC initialization now */
         if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
                                   KVM_DEV_ARM_VGIC_CTRL_INIT)) {
             kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                              KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
+                              &error_abort);
         }
     } else if (ret != -ENODEV && ret != -ENOTSUP) {
         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     /* explicit init of the ITS */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     /* register the base address */
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicd_access(GICv3State *s, int offset,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_DIST_REGS,
                       KVM_VGIC_ATTR(offset, 0),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicr_access(GICv3State *s, int offset, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_REDIST_REGS,
                       KVM_VGIC_ATTR(offset, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gicc_access(GICv3State *s, uint64_t reg, int cpu,
 {
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(reg, s->cpu[cpu].gicr_typer),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
@@ -XXX,XX +XXX,XX @@ static inline void kvm_gic_line_level_access(GICv3State *s, int irq, int cpu,
                       KVM_VGIC_ATTR(irq, s->cpu[cpu].gicr_typer) |
                       (VGIC_LEVEL_INFO_LINE_LEVEL <<
                        KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT),
-                      val, write);
+                      val, write, &error_abort);
 }
 
 /* Loop through each distributor IRQ related register; since bits
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     /* Initialize to actual HW supported configuration */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
                       KVM_VGIC_ATTR(ICC_CTLR_EL1, cpu->mp_affinity),
-                      &c->icc_ctlr_el1[GICV3_NS], false);
+                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
 
     c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     }
 
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_NR_IRQS,
-                      0, &s->num_irq, true);
+                      0, &s->num_irq, true, &error_abort);
 
     /* Tell the kernel to complete VGIC initialization now */
     kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true);
+                      KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true, &error_abort);
 
     kvm_arm_register_device(&s->iomem_dist, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd);
diff --git a/kvm-all.c b/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
@@ -XXX,XX +XXX,XX @@ int kvm_device_check_attr(int dev_fd, uint32_t group, uint64_t attr)
     return kvm_device_ioctl(dev_fd, KVM_HAS_DEVICE_ATTR, &attribute) ? 0 : 1;
 }
 
-void kvm_device_access(int fd, int group, uint64_t attr,
-                       void *val, bool write)
+int kvm_device_access(int fd, int group, uint64_t attr,
+                      void *val, bool write, Error **errp)
 {
     struct kvm_device_attr kvmattr;
     int err;
@@ -XXX,XX +XXX,XX @@ void kvm_device_access(int fd, int group, uint64_t attr,
                            write ? KVM_SET_DEVICE_ATTR : KVM_GET_DEVICE_ATTR,
                            &kvmattr);
     if (err < 0) {
-        error_report("KVM_%s_DEVICE_ATTR failed: %s",
-                     write ? "SET" : "GET", strerror(-err));
-        error_printf("Group %d attr 0x%016" PRIx64 "\n", group, attr);
-        abort();
+        error_setg_errno(errp, -err,
+                         "KVM_%s_DEVICE_ATTR failed: Group %d "
+                         "attr 0x%016" PRIx64,
+                         write ? "SET" : "GET", group, attr);
     }
+    return err;
 }
 
 /* Return 1 on success, 0 on failure */
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We need to handle both registers and ITS tables. While
register handling is standard, ITS table handling is more
challenging since the kernel API is devised so that the
tables are flushed into guest RAM and not in vmstate buffers.

Flushing the ITS tables on device pre_save() is too late
since the guest RAM is already saved at this point.

Table flushing needs to happen when we are sure the vcpus
are stopped and before the last dirty page saving. The
right point is RUN_STATE_FINISH_MIGRATE but sometimes the
VM gets stopped before migration launch so let's simply
flush the tables each time the VM gets stopped.

For regular ITS registers we just can use vmstate pre_save()
and post_load() callbacks.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-3-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gicv3_its_common.h |   8 +++
 hw/intc/arm_gicv3_its_common.c         |  10 ++++
 hw/intc/arm_gicv3_its_kvm.c            | 105 +++++++++++++++++++++++++++++++++
 3 files changed, 123 insertions(+)

diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
+#define GITS_CTLR        0x0
+#define GITS_IIDR        0x4
+#define GITS_CBASER      0x80
+#define GITS_CWRITER     0x88
+#define GITS_CREADR      0x90
+#define GITS_BASER       0x100
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
     /* Registers */
     uint32_t ctlr;
+    uint32_t iidr;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .unmigratable = true,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(ctlr, GICv3ITSState),
+        VMSTATE_UINT32(iidr, GICv3ITSState),
+        VMSTATE_UINT64(cbaser, GICv3ITSState),
+        VMSTATE_UINT64(cwriter, GICv3ITSState),
+        VMSTATE_UINT64(creadr, GICv3ITSState),
+        VMSTATE_UINT64_ARRAY(baser, GICv3ITSState, 8),
+        VMSTATE_END_OF_LIST()
+    },
 };
 
 static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_common_reset(DeviceState *dev)
     s->cbaser = 0;
     s->cwriter = 0;
     s->creadr = 0;
+    s->iidr = 0;
     memset(&s->baser, 0, sizeof(s->baser));
 
     gicv3_its_post_load(s, 0);
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
     return kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 }
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * ITS tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 {
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+
+    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 static void kvm_arm_its_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_init(Object *obj)
                              &error_abort);
 }
 
+/**
+ * kvm_arm_its_pre_save - handles the saving of ITS registers.
+ * ITS tables are flushed into guest RAM separately and earlier,
+ * through the VM change state handler, since at the moment pre_save()
+ * is called, the guest RAM has already been saved.
+ */
+static void kvm_arm_its_pre_save(GICv3ITSState *s)
+{
+    int i;
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], false,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, false, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, false, &error_abort);
+}
+
+/**
+ * kvm_arm_its_post_load - Restore both the ITS registers and tables
+ */
+static void kvm_arm_its_post_load(GICv3ITSState *s)
+{
+    int i;
+
+    if (!s->iidr) {
+        return;
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_IIDR, &s->iidr, true, &error_abort);
+
+    /*
+     * must be written before GITS_CREADR since GITS_CBASER write
+     * access resets GITS_CREADR.
+     */
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CBASER, &s->cbaser, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CREADR, &s->creadr, true, &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CWRITER, &s->cwriter, true, &error_abort);
+
+
+    for (i = 0; i < 8; i++) {
+        kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                          GITS_BASER + i * 8, &s->baser[i], true,
+                          &error_abort);
+    }
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_RESTORE_TABLES, NULL, true,
+                      &error_abort);
+
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+                      GITS_CTLR, &s->ctlr, true, &error_abort);
+}
+
 static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_class_init(ObjectClass *klass, void *data)
 
     dc->realize = kvm_arm_its_realize;
     icc->send_msi = kvm_its_send_msi;
+    icc->pre_save = kvm_arm_its_pre_save;
+    icc->post_load = kvm_arm_its_post_load;
 }
 
 static const TypeInfo kvm_arm_its_info = {
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

This patch adds the flush of the LPI pending bits into the
redistributor pending tables. This happens on VM stop.

There is no explicit restore as the tables are implicitly sync'ed
on ITS table restore and on LPI enable at redistributor level.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1497023553-18411-4-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
+#include "sysemu/sysemu.h"
 #include "kvm_arm.h"
 #include "gicv3_internal.h"
 #include "vgic_common.h"
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gicv3_cpuif_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+/**
+ * vm_change_state_handler - VM change state callback aiming at flushing
+ * RDIST pending tables into guest RAM
+ *
+ * The tables get flushed to guest RAM whenever the VM gets stopped.
+ */
+static void vm_change_state_handler(void *opaque, int running,
+                                    RunState state)
+{
+    GICv3State *s = (GICv3State *)opaque;
+    Error *err = NULL;
+    int ret;
+
+    if (running) {
+        return;
+    }
+
+    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                           KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
+                           NULL, true, &err);
+    if (err) {
+        error_report_err(err);
+    }
+    if (ret < 0 && ret != -EFAULT) {
+        abort();
+    }
+}
+
+
 static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
 {
     GICv3State *s = KVM_ARM_GICV3(dev);
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                              KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+    }
 }
 
 static void kvm_arm_gicv3_class_init(ObjectClass *klass, void *data)
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

We change the restoration priority of both the GICv3 and ITS. The
GICv3 must be restored before the ITS and the ITS needs to be restored
before PCIe devices since it translates their MSI transactions.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 1497023553-18411-5-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/migration/vmstate.h    |  2 ++
 hw/intc/arm_gicv3_common.c     |  1 +
 hw/intc/arm_gicv3_its_common.c |  2 +-
 hw/intc/arm_gicv3_its_kvm.c    | 24 ++++++++++++------------
 4 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ enum VMStateFlags {
 typedef enum {
     MIG_PRI_DEFAULT = 0,
     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
+    MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
+    MIG_PRI_GICV3,              /* Must happen before the ITS */
     MIG_PRI_MAX,
 } MigrationPriority;
 
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
     .minimum_version_id = 1,
     .pre_save = gicv3_pre_save,
     .post_load = gicv3_post_load,
+    .priority = MIG_PRI_GICV3,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(gicd_ctlr, GICv3State),
         VMSTATE_UINT32_ARRAY(gicd_statusr, GICv3State, 2),
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
-    .unmigratable = true,
+    .priority = MIG_PRI_GICV3_ITS,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(ctlr, GICv3ITSState),
         VMSTATE_UINT32(iidr, GICv3ITSState),
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
     Error *local_err = NULL;
 
-    /*
-     * Block migration of a KVM GICv3 ITS device: the API for saving and
-     * restoring the state in the kernel is not yet available
-     */
-    error_setg(&s->migration_blocker, "vITS migration is not implemented");
-    migrate_add_blocker(s->migration_blocker, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        error_free(s->migration_blocker);
-        return;
-    }
-
     s->dev_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_ITS, false);
     if (s->dev_fd < 0) {
         error_setg_errno(errp, -s->dev_fd, "error creating in-kernel ITS");
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, NULL);
 
+    if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
+        GITS_CTLR)) {
+        error_setg(&s->migration_blocker, "This operating system kernel "
+                   "does not support vITS migration");
+        migrate_add_blocker(s->migration_blocker, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            error_free(s->migration_blocker);
+            return;
+        }
+    }
+
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-- 
2.7.4

This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
we were using uninitialized data for the guarded bit when
combining stage 1 and stage 2 attrs.

thanks
-- PMM

The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:

Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410

for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:

target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)

----------------------------------------------------------------
target-arm: Fix bug where we weren't initializing
            guarded bit state when combining S1/S2 attrs

----------------------------------------------------------------
Richard Henderson (2):
      target/arm: PTE bit GP only applies to stage1
      target/arm: Copy guarded bit in combine_cacheattrs

target/arm/ptw.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Only perform the extract of GP during the stage1 walk.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.attrs.secure = false;
     }
 
-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-    }
-
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
+
+        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
+        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
+            result->f.guarded = extract64(attrs, 50, 1); /* GP */
+        }
     }
 
     /*
-- 
2.34.1