Series comparison

-[Qemu-devel] [PULL 0/4] target-arm queue
+[PULL 0/8] target-arm queue
-A surprisingly short target-arm queue, but no point in holding
+Handful of bugfixes for rc2. None of these are particularly critical
-onto these waiting for more code to arrive :-)
+or exciting.
-thanks
 -- PMM
-The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:
+The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)
+  Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803
-for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:
+for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8:
-  target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)
+  hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: ignore writes to CONTROL.SPSEL from Thread mode
+ * hw/timer/imx_epit: Avoid assertion when CR.SWR is written
- * KVM: Enable in-kernel timers with user space gic
+ * netduino2, netduinoplus2, microbit: set system_clock_scale so that
- * aspeed: Register all watchdogs
+   SysTick running on the CPU clock works
- * hw/misc: Add Exynos4210 Pseudo Random Number Generator
+ * target/arm: Avoid maybe-uninitialized warning with gcc 4.9
  * target/arm: Fix AddPAC error indication
  * Make AIRCR.SYSRESETREQ actually reset the system for the
    microbit, mps2-*, musca-*, netduino* boards
 ----------------------------------------------------------------
-Alexander Graf (1):
+Kaige Li (1):
-      ARM: KVM: Enable in-kernel timers with user space gic
+      target/arm: Avoid maybe-uninitialized warning with gcc 4.9
-Joel Stanley (1):
+Peter Maydell (6):
-      aspeed: Register all watchdogs
+      hw/arm/netduino2, netduinoplus2: Set system_clock_scale
       include/hw/irq.h: New function qemu_irq_is_connected()
       hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
       msf2-soc, stellaris: Don't wire up SYSRESETREQ
       hw/arm/nrf51_soc: Set system_clock_scale
       hw/timer/imx_epit: Avoid assertion when CR.SWR is written
-Krzysztof Kozlowski (1):
+Richard Henderson (1):
-      hw/misc: Add Exynos4210 Pseudo Random Number Generator
+      target/arm: Fix AddPAC error indication
-Peter Maydell (1):
+ include/hw/arm/armv7m.h           |  4 +++-
-      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+ include/hw/irq.h                  | 18 ++++++++++++++++++
  hw/arm/msf2-soc.c                 | 11 -----------
  hw/arm/netduino2.c                | 10 ++++++++++
  hw/arm/netduinoplus2.c            | 10 ++++++++++
  hw/arm/nrf51_soc.c                |  5 +++++
  hw/arm/stellaris.c                | 12 ------------
  hw/intc/armv7m_nvic.c             | 17 ++++++++++++++++-
  hw/timer/imx_epit.c               | 13 ++++++++++---
  target/arm/pauth_helper.c         |  6 +++++-
  target/arm/translate-a64.c        |  2 +-
  tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 112 insertions(+), 31 deletions(-)
  create mode 100644 tests/tcg/aarch64/pauth-5.c
- hw/misc/Makefile.objs       |   2 +-
- include/hw/arm/aspeed_soc.h |   4 +-
- include/sysemu/kvm.h        |  11 ++
- target/arm/cpu.h            |   3 +
- accel/kvm/kvm-all.c         |   5 +
- accel/stubs/kvm-stub.c      |   5 +
- hw/arm/aspeed_soc.c         |  25 ++--
- hw/arm/exynos4210.c         |   4 +
- hw/intc/arm_gic.c           |   7 ++
- hw/misc/exynos4210_rng.c    | 277 ++++++++++++++++++++++++++++++++++++++++++++
- target/arm/helper.c         |  13 ++-
- target/arm/kvm.c            |  51 ++++++++
-files changed, 394 insertions(+), 13 deletions(-)
- create mode 100644 hw/misc/exynos4210_rng.c

-New patch
+[PULL 1/8] hw/arm/netduino2, netduinoplus2: Set system_clock_scale
+The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale
+global, which meant that if guest code used the systick timer in "use
+the processor clock" mode it would hang because time never advances.
+Set the global to match the documented CPU clock speed of these boards.
+Judging by the data sheet this is slightly simplistic because the
+SoC allows configuration of the SYSCLK source and frequency via the
+RCC (reset and clock control) module, but we don't model that.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1876187
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20200727162617.26227-1-peter.maydell@linaro.org
+---
+ hw/arm/netduino2.c     | 10 ++++++++++
+ hw/arm/netduinoplus2.c | 10 ++++++++++
+files changed, 20 insertions(+)
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduino2.c
++++ b/hw/arm/netduino2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/stm32f205_soc.h"
+ #include "hw/arm/boot.h"
++/* Main SYSCLK frequency in Hz (120MHz) */
++#define SYSCLK_FRQ 120000000ULL
++
+ static void netduino2_init(MachineState *machine)
+ {
+     DeviceState *dev;
++    /*
++     * TODO: ideally we would model the SoC RCC and let it handle
++     * system_clock_scale, including its ability to define different
++     * possible SYSCLK sources.
++     */
++    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
++
+     dev = qdev_new(TYPE_STM32F205_SOC);
+     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduinoplus2.c
++++ b/hw/arm/netduinoplus2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/stm32f405_soc.h"
+ #include "hw/arm/boot.h"
++/* Main SYSCLK frequency in Hz (168MHz) */
++#define SYSCLK_FRQ 168000000ULL
++
+ static void netduinoplus2_init(MachineState *machine)
+ {
+     DeviceState *dev;
++    /*
++     * TODO: ideally we would model the SoC RCC and let it handle
++     * system_clock_scale, including its ability to define different
++     * possible SYSCLK sources.
++     */
++    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
++
+     dev = qdev_new(TYPE_STM32F405_SOC);
+     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+--
+.20.1

-New patch
+[PULL 2/8] include/hw/irq.h: New function qemu_irq_is_connected()
+Mostly devices don't need to care whether one of their output
+qemu_irq lines is connected, because functions like qemu_set_irq()
+silently do nothing if there is nothing on the other end.  However
+sometimes a device might want to implement default behaviour for the
+case where the machine hasn't wired the line up to anywhere.
+Provide a function qemu_irq_is_connected() that devices can use for
+this purpose.  (The test is trivial but encapsulating it in a
+function makes it easier to see where we're doing it in case we need
+to change the implementation later.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
+---
+ include/hw/irq.h | 18 ++++++++++++++++++
+file changed, 18 insertions(+)
+diff --git a/include/hw/irq.h b/include/hw/irq.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/irq.h
++++ b/include/hw/irq.h
+@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
+    on an existing vector of qemu_irq.  */
+ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
++/**
++ * qemu_irq_is_connected: Return true if IRQ line is wired up
++ *
++ * If a qemu_irq has a device on the other (receiving) end of it,
++ * return true; otherwise return false.
++ *
++ * Usually device models don't need to care whether the machine model
++ * has wired up their outbound qemu_irq lines, because functions like
++ * qemu_set_irq() silently do nothing if there is nothing on the other
++ * end of the line. However occasionally a device model will want to
++ * provide default behaviour if its output is left floating, and
++ * it can use this function to identify when that is the case.
++ */
++static inline bool qemu_irq_is_connected(qemu_irq irq)
++{
++    return irq != NULL;
++}
++
+ #endif
+--
+.20.1

-New patch
+[PULL 3/8] hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
+The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals
+when the guest sets the SYSRESETREQ bit in the AIRCR register.  This
+matches the hardware design (where the CPU has a signal of this name
+and it is up to the SoC to connect that up to an actual reset
+mechanism), but in QEMU it mostly results in duplicated code in SoC
+objects and bugs where SoC model implementors forget to wire up the
+SYSRESETREQ line.
+Provide a default behaviour for the case where SYSRESETREQ is not
+actually connected to anything: use qemu_system_reset_request() to
+perform a system reset.  This will allow us to remove the
+implementations of SYSRESETREQ handling from the boards where that's
+exactly what it does, and also fixes the bugs in the board models
+which forgot to wire up the signal:
+ * microbit
+ * mps2-an385
+ * mps2-an505
+ * mps2-an511
+ * mps2-an521
+ * musca-a
+ * musca-b1
+ * netduino
+ * netduinoplus2
+We still allow the board to wire up the signal if it needs to, in case
+we need to model more complicated reset controller logic or to model
+buggy SoC hardware which forgot to wire up the line itself. But
+defaulting to "reset the system" is more often going to be correct
+than defaulting to "do nothing".
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
+---
+ include/hw/arm/armv7m.h |  4 +++-
+ hw/intc/armv7m_nvic.c   | 17 ++++++++++++++++-
+files changed, 19 insertions(+), 2 deletions(-)
+diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armv7m.h
++++ b/include/hw/arm/armv7m.h
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+ /* ARMv7M container object.
+  * + Unnamed GPIO input lines: external IRQ lines for the NVIC
+- * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ
++ * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ.
++ *   If this GPIO is not wired up then the NVIC will default to performing
++ *   a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET).
+  * + Property "cpu-type": CPU type to instantiate
+  * + Property "num-irq": number of external IRQ lines
+  * + Property "memory": MemoryRegion defining the physical address space
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/intc/armv7m_nvic.h"
+ #include "hw/irq.h"
+ #include "hw/qdev-properties.h"
++#include "sysemu/runstate.h"
+ #include "target/arm/cpu.h"
+ #include "exec/exec-all.h"
+ #include "exec/memop.h"
+@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
+x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
+ };
++static void signal_sysresetreq(NVICState *s)
++{
++    if (qemu_irq_is_connected(s->sysresetreq)) {
++        qemu_irq_pulse(s->sysresetreq);
++    } else {
++        /*
++         * Default behaviour if the SoC doesn't need to wire up
++         * SYSRESETREQ (eg to a system reset controller of some kind):
++         * perform a system reset via the usual QEMU API.
++         */
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
++    }
++}
++
+ static int nvic_pending_prio(NVICState *s)
+ {
+     /* return the group priority of the current pending interrupt,
+@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
+                 if (attrs.secure ||
+                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
+-                    qemu_irq_pulse(s->sysresetreq);
++                    signal_sysresetreq(s);
+                 }
+             }
+             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
+--
+.20.1

-[Qemu-devel] [PULL 3/4] ARM: KVM: Enable in-kernel timers with user space gic
+[PULL 4/8] msf2-soc, stellaris: Don't wire up SYSRESETREQ
-From: Alexander Graf <agraf@suse.de>
+The MSF2 SoC model and the Stellaris board code both wire
 SYSRESETREQ up to a function that just invokes
     qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 This is now the default action that the NVIC does if the line is
 not connected, so we can delete the handling code.
-When running with KVM enabled, you can choose between emulating the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-gic in kernel or user space. If the kernel supports in-kernel virtualization
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-of the interrupt controller, it will default to that. If not, if will
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-default to user space emulation.
+Message-id: 20200728103744.6909-4-peter.maydell@linaro.org
 ---
  hw/arm/msf2-soc.c  | 11 -----------
  hw/arm/stellaris.c | 12 ------------
 files changed, 23 deletions(-)
-Unfortunately when running in user mode gic emulation, we miss out on
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 interrupt events which are only available from kernel space, such as the timer.
 This patch leverages the new kernel/user space pending line synchronization for
 timer events. It does not handle PMU events yet.
 Signed-off-by: Alexander Graf <agraf@suse.de>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/sysemu/kvm.h   | 11 +++++++++++
  target/arm/cpu.h       |  3 +++
  accel/kvm/kvm-all.c    |  5 +++++
  accel/stubs/kvm-stub.c |  5 +++++
  hw/intc/arm_gic.c      |  7 +++++++
  target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 files changed, 82 insertions(+)
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
+--- a/hw/arm/msf2-soc.c
-+++ b/include/sysemu/kvm.h
++++ b/hw/arm/msf2-soc.c
-@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
+@@ -XXX,XX +XXX,XX @@
- int kvm_cpu_exec(CPUState *cpu);
+ #include "hw/irq.h"
- int kvm_destroy_vcpu(CPUState *cpu);
+ #include "hw/arm/msf2-soc.h"
+ #include "hw/misc/unimp.h"
-+/**
+-#include "sysemu/runstate.h"
-+ * kvm_arm_supports_user_irq
+ #include "sysemu/sysemu.h"
-+ *
-+ * Not all KVM implementations support notifications for kernel generated
+ #define MSF2_TIMER_BASE       0x40004000
-+ * interrupt events to user space. This function indicates whether the current
+@@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 };
-+ * KVM implementation does support them.
+ static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 };
-+ *
+ static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 };
-+ * Returns: true if KVM supports using kernel generated IRQs from user space
-+ */
+-static void do_sys_reset(void *opaque, int n, int level)
-+bool kvm_arm_supports_user_irq(void);
+-{
-+
+-    if (level) {
- #ifdef NEED_CPU_H
+-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
- #include "cpu.h"
+-    }
+-}
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+-
-index XXXXXXX..XXXXXXX 100644
+ static void m2sxxx_soc_initfn(Object *obj)
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      void *el_change_hook_opaque;
      int32_t node_id; /* NUMA node this CPU belongs to */
 +
 +    /* Used to synchronize KVM and QEMU in-kernel device levels */
 +    uint8_t device_irq_level;
  };
  static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
      return kvm_state->intx_set_mask;
  }
 +bool kvm_arm_supports_user_irq(void)
 +{
 +    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
 +}
 +
  #ifdef KVM_CAP_SET_GUEST_DEBUG
  struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                   target_ulong pc)
 diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/stubs/kvm-stub.c
 +++ b/accel/stubs/kvm-stub.c
@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
  {
-     abort();
+     MSF2State *s = MSF2_SOC(obj);
- }
+@@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp)
 +
 +bool kvm_arm_supports_user_irq(void)
 +{
 +    return false;
 +}
  #endif
 diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic.c
 +++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@
  #include "qom/cpu.h"
  #include "qemu/log.h"
  #include "trace.h"
 +#include "sysemu/kvm.h"
  /* #define DEBUG_GIC */
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
          return;
      }
-+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
+-    qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0,
-+        error_setg(errp, "KVM with user space irqchip only works when the "
+-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
+-
-+        return;
+     system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk;
-+    }
-+
+     for (i = 0; i < MSF2_NUM_UARTS; i++) {
-     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
      gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
+--- a/hw/arm/stellaris.c
-+++ b/target/arm/kvm.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -XXX,XX +XXX,XX @@
-      */
+ #include "hw/boards.h"
-     kvm_async_interrupts_allowed = true;
+ #include "qemu/log.h"
+ #include "exec/address-spaces.h"
-+    /*
+-#include "sysemu/runstate.h"
-+     * PSCI wakes up secondary cores, so we always need to
+ #include "sysemu/sysemu.h"
-+     * have vCPUs waiting in kernel space
+ #include "hw/arm/armv7m.h"
-+     */
+ #include "hw/char/pl011.h"
-+    kvm_halt_in_kernel_allowed = true;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
-+
+     qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
      cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
      type_register_static(&host_arm_cpu_type_info);
@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
  MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
  {
 +    ARMCPU *cpu;
 +    uint32_t switched_level;
 +
 +    if (kvm_irqchip_in_kernel()) {
 +        /*
 +         * We only need to sync timer states with user-space interrupt
 +         * controllers, so return early and save cycles if we don't.
 +         */
 +        return MEMTXATTRS_UNSPECIFIED;
 +    }
 +
 +    cpu = ARM_CPU(cs);
 +
 +    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
 +    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
 +        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
 +
 +        qemu_mutex_lock_iothread();
 +
 +        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
 +            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
 +                         !!(run->s.regs.device_irq_level &
 +                            KVM_ARM_DEV_EL1_VTIMER));
 +            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
 +        }
 +
 +        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
 +            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
 +                         !!(run->s.regs.device_irq_level &
 +                            KVM_ARM_DEV_EL1_PTIMER));
 +            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
 +        }
 +
 +        /* XXX PMU IRQ is missing */
 +
 +        if (switched_level) {
 +            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
 +                          __func__, switched_level);
 +        }
 +
 +        /* We also mark unknown levels as processed to not waste cycles */
 +        cpu->device_irq_level = run->s.regs.device_irq_level;
 +        qemu_mutex_unlock_iothread();
 +    }
 +
      return MEMTXATTRS_UNSPECIFIED;
  }
+-static
+-void do_sys_reset(void *opaque, int n, int level)
+-{
+-    if (level) {
+-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+-    }
+-}
+-
+ /* Board init.  */
+ static stellaris_board_info stellaris_boards[] = {
+   { "LM3S811EVB",
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+     /* This will exit with an error if the user passed us a bad cpu_type */
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
+-    qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
+-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
+-
+     if (board->dc1 & (1 << 16)) {
+         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
+                                     qdev_get_gpio_in(nvic, 14),
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 1/4] hw/misc: Add Exynos4210 Pseudo Random Number Generator
+[PULL 5/8] target/arm: Fix AddPAC error indication
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add emulation for Exynos4210 Pseudo Random Number Generator which could
+The definition of top_bit used in this function is one higher
-work on fixed seeds or with seeds provided by True Random Number
+than that used in the Arm ARM psuedo-code, which put the error
-Generator block inside the SoC.
+indication at top_bit - 1 at the wrong place, which meant that
 it wasn't visible to Auth.
-Implement only the fixed seeds part of it in polling mode (no
+Fixing the definition of top_bit requires more changes, because
-interrupts).
+its most common use is for the count of bits in top_bit:bot_bit,
 which would then need to be computed as top_bit - bot_bit + 1.
-Emulation tested with two independent Linux kernel exynos-rng drivers:
+For now, prefer the minimal fix to the error indication alone.
 . New kcapi-rng interface (targeting Linux v4.12),
 . Old hwrng inteface
    # echo "exynos" > /sys/class/misc/hw_random/rng_current
    # dd if=/dev/hwrng of=/dev/null bs=1 count=16
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 63ff0ca94cb
-Message-id: 20170425180609.11004-1-krzk@kernel.org
+Reported-by: Derrick McKee <derrick.mckee@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200728195706.11087-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: wrapped a few overlong lines; more efficient implementation
+[PMM: added comment about the divergence from the pseudocode]
  of exynos4210_rng_seed_ready()]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs    |   2 +-
+ target/arm/pauth_helper.c         |  6 +++++-
- hw/arm/exynos4210.c      |   4 +
+ tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++
- hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/Makefile.target |  2 +-
-files changed, 282 insertions(+), 1 deletion(-)
+files changed, 39 insertions(+), 2 deletions(-)
- create mode 100644 hw/misc/exynos4210_rng.c
+ create mode 100644 tests/tcg/aarch64/pauth-5.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/pauth_helper.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/pauth_helper.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
+@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
- obj-$(CONFIG_REALVIEW) += arm_sysctl.o
+      */
- obj-$(CONFIG_NSERIES) += cbus.o
+     test = sextract64(ptr, bot_bit, top_bit - bot_bit);
- obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
+     if (test != 0 && test != -1) {
--obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
+-        pac ^= MAKE_64BIT_MASK(top_bit - 1, 1);
-+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
++        /*
- obj-$(CONFIG_IMX) += imx_ccm.o
++         * Note that our top_bit is one greater than the pseudocode's
- obj-$(CONFIG_IMX) += imx31_ccm.o
++         * version, hence "- 2" here.
- obj-$(CONFIG_IMX) += imx25_ccm.o
++         */
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
++        pac ^= MAKE_64BIT_MASK(top_bit - 2, 1);
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
+     /*
-@@ -XXX,XX +XXX,XX @@
+diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c
  /* Clock controller SFR base address */
  #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
 +/* PRNG/HASH SFR base address */
 +#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
 +
  /* Display controllers (FIMD) */
  #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
      sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
      sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
 +    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
      /* PWM */
      sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
 diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/exynos4210_rng.c
++++ b/tests/tcg/aarch64/pauth-5.c
 @@ -XXX,XX +XXX,XX @@
-+/*
++#include <assert.h>
 + *  Exynos4210 Pseudo Random Nubmer Generator Emulation
 + *
 + *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
 + *
 + *  This program is free software; you can redistribute it and/or modify it
 + *  under the terms of the GNU General Public License as published by the
 + *  Free Software Foundation; either version 2 of the License, or
 + *  (at your option) any later version.
 + *
 + *  This program is distributed in the hope that it will be useful, but WITHOUT
 + *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + *  for more details.
 + *
 + *  You should have received a copy of the GNU General Public License along
 + *  with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#include "qemu/osdep.h"
++static int x;
 +#include "crypto/random.h"
 +#include "hw/sysbus.h"
 +#include "qemu/log.h"
 +
-+#define DEBUG_EXYNOS_RNG 0
++int main()
 +{
 +    int *p0 = &x, *p1, *p2, *p3;
 +    unsigned long salt = 0;
 +
-+#define DPRINTF(fmt, ...) \
++    /*
-+    do { \
++     * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so
-+        if (DEBUG_EXYNOS_RNG) { \
++     * a 1/128 chance of auth = pac(ptr,key,salt) producing zero.
-+            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
++     * Find a salt that creates auth != 0.
-+        } \
++     */
-+    } while (0)
++    do {
 +        salt++;
 +        asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0));
 +    } while (p0 == p1);
 +
-+#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
++    /*
-+#define EXYNOS4210_RNG(obj) \
++     * This pac must fail, because the input pointer bears an encryption,
-+    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
++     * and so is not properly extended within bits [55:47].  This will
 +     * toggle bit 54 in the output...
 +     */
 +    asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1));
 +
-+/*
++    /* ... so that the aut must fail, setting bit 53 in the output ... */
-+ * Exynos4220, PRNG, only polling mode is supported.
++    asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2));
 + */
 +
-+/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
++    /* ... which means this equality must not hold. */
-+#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
++    assert(p3 != p0);
-+#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
++    return 0;
 +/* RNG_STATUS register bitfields, reset value: 0x1 */
 +#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
 +#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
 +#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
 +#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
 +#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
 +#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
 +#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
 +#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
 +                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
 +                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
 +
 +#define EXYNOS4210_RNG_CONTROL_1                  0x0
 +#define EXYNOS4210_RNG_STATUS                    0x10
 +#define EXYNOS4210_RNG_SEED_IN                  0x140
 +#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
 +#define EXYNOS4210_RNG_PRNG                     0x160
 +#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
 +
 +#define EXYNOS4210_RNG_PRNG_NUM                 5
 +
 +#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
 +
 +typedef struct Exynos4210RngState {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +
 +    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
 +    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
 +    uint32_t seed_set;
 +
 +    /* Register values */
 +    uint32_t reg_control;
 +    uint32_t reg_status;
 +} Exynos4210RngState;
 +
 +static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
 +{
 +    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
 +
 +    /* Return true if all the seed-set bits are set. */
 +    return (s->seed_set & mask) == mask;
 +}
-+
+diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
-+static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
+index XXXXXXX..XXXXXXX 100644
-+                                    uint64_t val)
+--- a/tests/tcg/aarch64/Makefile.target
-+{
++++ b/tests/tcg/aarch64/Makefile.target
-+    /*
+@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
-+     * We actually ignore the seed and always generate true random numbers.
-+     * Theoretically this should not match the device as Exynos has
+ # Pauth Tests
-+     * a Pseudo Random Number Generator but testing shown that it always
+ ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),)
-+     * generates random numbers regardless of the seed value.
+-AARCH64_TESTS += pauth-1 pauth-2 pauth-4
-+     */
++AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5
-+    s->seed_set |= BIT(i);
+ pauth-%: CFLAGS += -march=armv8.3-a
-+
+ run-pauth-%: QEMU_OPTS += -cpu max
-+    /* If all seeds were written, update the status to reflect it */
+ run-plugin-pauth-%: QEMU_OPTS += -cpu max
 +    if (exynos4210_rng_seed_ready(s)) {
 +        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
 +    } else {
 +        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
 +    }
 +}
 +
 +static void exynos4210_rng_run_engine(Exynos4210RngState *s)
 +{
 +    Error *err = NULL;
 +    int ret;
 +
 +    /* Seed set? */
 +    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
 +        goto out;
 +    }
 +
 +    /* PRNG engine chosen? */
 +    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
 +        goto out;
 +    }
 +
 +    /* PRNG engine started? */
 +    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
 +        goto out;
 +    }
 +
 +    /* Get randoms */
 +    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
 +                               sizeof(s->randr_value), &err);
 +    if (!ret) {
 +        /* Notify that PRNG is ready */
 +        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
 +    } else {
 +        error_report_err(err);
 +    }
 +
 +out:
 +    /* Always clear start engine bit */
 +    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
 +}
 +
 +static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
 +                                    unsigned size)
 +{
 +    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
 +    uint32_t val = 0;
 +
 +    assert(size == 4);
 +
 +    switch (offset) {
 +    case EXYNOS4210_RNG_CONTROL_1:
 +        val = s->reg_control;
 +        break;
 +
 +    case EXYNOS4210_RNG_STATUS:
 +        val = s->reg_status;
 +        break;
 +
 +    case EXYNOS4210_RNG_PRNG_OFFSET(0):
 +    case EXYNOS4210_RNG_PRNG_OFFSET(1):
 +    case EXYNOS4210_RNG_PRNG_OFFSET(2):
 +    case EXYNOS4210_RNG_PRNG_OFFSET(3):
 +    case EXYNOS4210_RNG_PRNG_OFFSET(4):
 +        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
 +        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
 +                offset, val);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +    }
 +
 +    return val;
 +}
 +
 +static void exynos4210_rng_write(void *opaque, hwaddr offset,
 +                                 uint64_t val, unsigned size)
 +{
 +    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
 +
 +    assert(size == 4);
 +
 +    switch (offset) {
 +    case EXYNOS4210_RNG_CONTROL_1:
 +        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
 +        s->reg_control = val;
 +        exynos4210_rng_run_engine(s);
 +        break;
 +
 +    case EXYNOS4210_RNG_STATUS:
 +        /* For clearing status fields */
 +        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
 +        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
 +        break;
 +
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
 +        exynos4210_rng_set_seed(s,
 +                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
 +                                val);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +    }
 +}
 +
 +static const MemoryRegionOps exynos4210_rng_ops = {
 +    .read = exynos4210_rng_read,
 +    .write = exynos4210_rng_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void exynos4210_rng_reset(DeviceState *dev)
 +{
 +    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
 +
 +    s->reg_control = 0;
 +    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
 +    memset(s->randr_value, 0, sizeof(s->randr_value));
 +    s->seed_set = 0;
 +}
 +
 +static void exynos4210_rng_init(Object *obj)
 +{
 +    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
 +    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
 +                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
 +    sysbus_init_mmio(dev, &s->iomem);
 +}
 +
 +static const VMStateDescription exynos4210_rng_vmstate = {
 +    .name = TYPE_EXYNOS4210_RNG,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
 +                            EXYNOS4210_RNG_PRNG_NUM),
 +        VMSTATE_UINT32(seed_set, Exynos4210RngState),
 +        VMSTATE_UINT32(reg_status, Exynos4210RngState),
 +        VMSTATE_UINT32(reg_control, Exynos4210RngState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = exynos4210_rng_reset;
 +    dc->vmsd = &exynos4210_rng_vmstate;
 +}
 +
 +static const TypeInfo exynos4210_rng_info = {
 +    .name          = TYPE_EXYNOS4210_RNG,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210RngState),
 +    .instance_init = exynos4210_rng_init,
 +    .class_init    = exynos4210_rng_class_init,
 +};
 +
 +static void exynos4210_rng_register(void)
 +{
 +    type_register_static(&exynos4210_rng_info);
 +}
 +
 +type_init(exynos4210_rng_register)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 2/4] aspeed: Register all watchdogs
+[PULL 6/8] target/arm: Avoid maybe-uninitialized warning with gcc 4.9
-From: Joel Stanley <joel@jms.id.au>
+From: Kaige Li <likaige@loongson.cn>
-The ast2400 contains two and the ast2500 contains three watchdogs.
+GCC version 4.9.4 isn't clever enough to figure out that all
-Add this information to the AspeedSoCInfo and realise the correct number
+execution paths in disas_ldst() that use 'fn' will have initialized
-of watchdogs for that each SoC type.
+it first, and so it warns:
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+/home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’:
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+/home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
-Tested-by: Cédric Le Goater <clg@kaod.org>
+     fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
      ^
 /home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here
      AtomicThreeOpFn *fn;
                       ^
 Make it happy by initializing the variable to NULL.
 Signed-off-by: Kaige Li <likaige@loongson.cn>
 Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: Clean up commit message and note which gcc version this was]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  4 +++-
+ target/arm/translate-a64.c | 2 +-
- hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 20 insertions(+), 9 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
- #include "hw/net/ftgmac100.h"
+     bool r = extract32(insn, 22, 1);
+     bool a = extract32(insn, 23, 1);
- #define ASPEED_SPIS_NUM  2
+     TCGv_i64 tcg_rs, clean_addr;
-+#define ASPEED_WDTS_NUM  3
+-    AtomicThreeOpFn *fn;
++    AtomicThreeOpFn *fn = NULL;
- typedef struct AspeedSoCState {
-     /*< private >*/
+     if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
+         unallocated_encoding(s);
      AspeedSMCState fmc;
      AspeedSMCState spi[ASPEED_SPIS_NUM];
      AspeedSDMCState sdmc;
 -    AspeedWDTState wdt;
 +    AspeedWDTState wdt[ASPEED_WDTS_NUM];
      FTGMAC100State ftgmac100;
  } AspeedSoCState;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
      const hwaddr *spi_bases;
      const char *fmc_typename;
      const char **spi_typename;
 +    int wdts_num;
  } AspeedSoCInfo;
  typedef struct AspeedSoCClass {
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2400-a1",
          .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2400",
          .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2500-a1",
          .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2500_spi_bases,
          .fmc_typename = "aspeed.smc.ast2500-fmc",
          .spi_typename = aspeed_soc_ast2500_typenames,
 +        .wdts_num     = 3,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                                "ram-size", &error_abort);
 -    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
 -    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
 -    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
 +    for (i = 0; i < sc->info->wdts_num; i++) {
 +        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
 +        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
 +        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
 +    }
      object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
      object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
      /* Watch dog */
 -    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
 -    if (err) {
 -        error_propagate(errp, err);
 -        return;
 +    for (i = 0; i < sc->info->wdts_num; i++) {
 +        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 +                        ASPEED_SOC_WDT_BASE + i * 0x20);
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
      /* Net */
      qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
 --
-.7.4
+.20.1

-New patch
+[PULL 7/8] hw/arm/nrf51_soc: Set system_clock_scale
+The nrf51 SoC model wasn't setting the system_clock_scale
+global.which meant that if guest code used the systick timer in "use
+the processor clock" mode it would hang because time never advances.
+Set the global to match the documented CPU clock speed for this SoC.
+This SoC in fact doesn't have a SysTick timer (which is the only thing
+currently that cares about the system_clock_scale), because it's
+a configurable option in the Cortex-M0. However our Cortex-M0 and
+thus our nrf51 and our micro:bit board do provide a SysTick, so
+we ought to provide a functional one rather than a broken one.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200727193458.31250-1-peter.maydell@linaro.org
+---
+ hw/arm/nrf51_soc.c | 5 +++++
+file changed, 5 insertions(+)
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
++/* HCLK (the main CPU clock) on this SoC is always 16MHz */
++#define HCLK_FRQ 16000000
++
+ static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size)
+ {
+     qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+         return;
+     }
++    system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ;
++
+     object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
+                              &error_abort);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
+--
+.20.1

-[Qemu-devel] [PULL 4/4] target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+[PULL 8/8] hw/timer/imx_epit: Avoid assertion when CR.SWR is written
-For v7M, writes to the CONTROL register are only permitted for
+The imx_epit device has a software-controllable reset triggered by
-privileged code. However even if the code is privileged, the
+setting the SWR bit in the CR register. An error in commit cc2722ec83ad9
-write must not affect the SPSEL bit in the CONTROL register
+means that we will end up assert()ing if the guest does this, because
-if the CPU is in Thread mode (as documented in the pseudocode
+the code in imx_epit_write() starts ptimer transactions, and then
-for the MSR instruction). Implement this, instead of permitting
+imx_epit_reset() also starts ptimer transactions, triggering
-SPSEL to be written in all cases.
+"ptimer_transaction_begin: Assertion `!s->in_transaction' failed".
-This was causing mbed applications not to run, because the
+The cleanest way to avoid this double-transaction is to move the
-RTX RTOS they use relies on this behaviour.
+start-transaction for the CR write handling down below the check of
 the SWR bit.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1880424
+Fixes: cc2722ec83ad944505fe
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
+Message-id: 20200727154550.3409-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 13 ++++++++++---
+ hw/timer/imx_epit.c | 13 ++++++++++---
 file changed, 10 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/timer/imx_epit.c
-+++ b/target/arm/helper.c
++++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
      switch (offset >> 2) {
      case 0: /* CR */
 -        ptimer_transaction_begin(s->timer_cmp);
 -        ptimer_transaction_begin(s->timer_reload);
          oldcr = s->cr;
          s->cr = value & 0x03ffffff;
          if (s->cr & CR_SWR) {
              /* handle the reset */
              imx_epit_reset(DEVICE(s));
 -        } else {
 +            /*
 +             * TODO: could we 'break' here? following operations appear
 +             * to duplicate the work imx_epit_reset() already did.
 +             */
 +        }
 +
 +        ptimer_transaction_begin(s->timer_cmp);
 +        ptimer_transaction_begin(s->timer_reload);
 +
 +        if (!(s->cr & CR_SWR)) {
              imx_epit_set_freq(s);
          }
-         break;
      case 20: /* CONTROL */
 -        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
 -        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
 -                                  R_V7M_CONTROL_NPRIV_MASK);
 +        /* Writing to the SPSEL bit only has an effect if we are in
 +         * thread mode; other bits can be updated by any privileged code.
 +         * switch_v7m_sp() deals with updating the SPSEL bit in
 +         * env->v7m.control, so we only need update the others.
 +         */
 +        if (env->v7m.exception == 0) {
 +            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
 +        }
 +        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
 +        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
          break;
      default:
          qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
 --
-.7.4
+.20.1

A surprisingly short target-arm queue, but no point in holding
onto these waiting for more code to arrive :-)

thanks
-- PMM

The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711

for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:

target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: ignore writes to CONTROL.SPSEL from Thread mode
 * KVM: Enable in-kernel timers with user space gic
 * aspeed: Register all watchdogs
 * hw/misc: Add Exynos4210 Pseudo Random Number Generator

----------------------------------------------------------------
Alexander Graf (1):
      ARM: KVM: Enable in-kernel timers with user space gic

Joel Stanley (1):
      aspeed: Register all watchdogs

Krzysztof Kozlowski (1):
      hw/misc: Add Exynos4210 Pseudo Random Number Generator

Peter Maydell (1):
      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode

From: Krzysztof Kozlowski <krzk@kernel.org>

Add emulation for Exynos4210 Pseudo Random Number Generator which could
work on fixed seeds or with seeds provided by True Random Number
Generator block inside the SoC.

Implement only the fixed seeds part of it in polling mode (no
interrupts).

Emulation tested with two independent Linux kernel exynos-rng drivers:
1. New kcapi-rng interface (targeting Linux v4.12),
2. Old hwrng inteface
   # echo "exynos" > /sys/class/misc/hw_random/rng_current
   # dd if=/dev/hwrng of=/dev/null bs=1 count=16

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Message-id: 20170425180609.11004-1-krzk@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: wrapped a few overlong lines; more efficient implementation
 of exynos4210_rng_seed_ready()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs    |   2 +-
 hw/arm/exynos4210.c      |   4 +
 hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 282 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/exynos4210_rng.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
 obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 obj-$(CONFIG_NSERIES) += cbus.o
 obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
 obj-$(CONFIG_IMX) += imx_ccm.o
 obj-$(CONFIG_IMX) += imx31_ccm.o
 obj-$(CONFIG_IMX) += imx25_ccm.o
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* Clock controller SFR base address */
 #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
 
+/* PRNG/HASH SFR base address */
+#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
+
 /* Display controllers (FIMD) */
 #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
 
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
 
     sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
+    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
 
     /* PWM */
     sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/exynos4210_rng.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  Exynos4210 Pseudo Random Nubmer Generator Emulation
+ *
+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the
+ *  Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "crypto/random.h"
+#include "hw/sysbus.h"
+#include "qemu/log.h"
+
+#define DEBUG_EXYNOS_RNG 0
+
+#define DPRINTF(fmt, ...) \
+    do { \
+        if (DEBUG_EXYNOS_RNG) { \
+            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
+        } \
+    } while (0)
+
+#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
+#define EXYNOS4210_RNG(obj) \
+    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
+
+/*
+ * Exynos4220, PRNG, only polling mode is supported.
+ */
+
+/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
+#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
+#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
+/* RNG_STATUS register bitfields, reset value: 0x1 */
+#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
+#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
+#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
+#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
+#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
+#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
+#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
+#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
+
+#define EXYNOS4210_RNG_CONTROL_1                  0x0
+#define EXYNOS4210_RNG_STATUS                    0x10
+#define EXYNOS4210_RNG_SEED_IN                  0x140
+#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
+#define EXYNOS4210_RNG_PRNG                     0x160
+#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
+
+#define EXYNOS4210_RNG_PRNG_NUM                 5
+
+#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
+
+typedef struct Exynos4210RngState {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+
+    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
+    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
+    uint32_t seed_set;
+
+    /* Register values */
+    uint32_t reg_control;
+    uint32_t reg_status;
+} Exynos4210RngState;
+
+static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
+{
+    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
+
+    /* Return true if all the seed-set bits are set. */
+    return (s->seed_set & mask) == mask;
+}
+
+static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
+                                    uint64_t val)
+{
+    /*
+     * We actually ignore the seed and always generate true random numbers.
+     * Theoretically this should not match the device as Exynos has
+     * a Pseudo Random Number Generator but testing shown that it always
+     * generates random numbers regardless of the seed value.
+     */
+    s->seed_set |= BIT(i);
+
+    /* If all seeds were written, update the status to reflect it */
+    if (exynos4210_rng_seed_ready(s)) {
+        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    } else {
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    }
+}
+
+static void exynos4210_rng_run_engine(Exynos4210RngState *s)
+{
+    Error *err = NULL;
+    int ret;
+
+    /* Seed set? */
+    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine chosen? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine started? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
+        goto out;
+    }
+
+    /* Get randoms */
+    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
+                               sizeof(s->randr_value), &err);
+    if (!ret) {
+        /* Notify that PRNG is ready */
+        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
+    } else {
+        error_report_err(err);
+    }
+
+out:
+    /* Always clear start engine bit */
+    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
+}
+
+static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
+                                    unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+    uint32_t val = 0;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        val = s->reg_control;
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        val = s->reg_status;
+        break;
+
+    case EXYNOS4210_RNG_PRNG_OFFSET(0):
+    case EXYNOS4210_RNG_PRNG_OFFSET(1):
+    case EXYNOS4210_RNG_PRNG_OFFSET(2):
+    case EXYNOS4210_RNG_PRNG_OFFSET(3):
+    case EXYNOS4210_RNG_PRNG_OFFSET(4):
+        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
+        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
+                offset, val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+
+    return val;
+}
+
+static void exynos4210_rng_write(void *opaque, hwaddr offset,
+                                 uint64_t val, unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
+        s->reg_control = val;
+        exynos4210_rng_run_engine(s);
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        /* For clearing status fields */
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        break;
+
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
+        exynos4210_rng_set_seed(s,
+                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
+                                val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+}
+
+static const MemoryRegionOps exynos4210_rng_ops = {
+    .read = exynos4210_rng_read,
+    .write = exynos4210_rng_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void exynos4210_rng_reset(DeviceState *dev)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
+
+    s->reg_control = 0;
+    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
+    memset(s->randr_value, 0, sizeof(s->randr_value));
+    s->seed_set = 0;
+}
+
+static void exynos4210_rng_init(Object *obj)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
+                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
+    sysbus_init_mmio(dev, &s->iomem);
+}
+
+static const VMStateDescription exynos4210_rng_vmstate = {
+    .name = TYPE_EXYNOS4210_RNG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
+                            EXYNOS4210_RNG_PRNG_NUM),
+        VMSTATE_UINT32(seed_set, Exynos4210RngState),
+        VMSTATE_UINT32(reg_status, Exynos4210RngState),
+        VMSTATE_UINT32(reg_control, Exynos4210RngState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = exynos4210_rng_reset;
+    dc->vmsd = &exynos4210_rng_vmstate;
+}
+
+static const TypeInfo exynos4210_rng_info = {
+    .name          = TYPE_EXYNOS4210_RNG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210RngState),
+    .instance_init = exynos4210_rng_init,
+    .class_init    = exynos4210_rng_class_init,
+};
+
+static void exynos4210_rng_register(void)
+{
+    type_register_static(&exynos4210_rng_info);
+}
+
+type_init(exynos4210_rng_register)
-- 
2.7.4

From: Joel Stanley <joel@jms.id.au>

The ast2400 contains two and the ast2500 contains three watchdogs.
Add this information to the AspeedSoCInfo and realise the correct number
of watchdogs for that each SoC type.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  4 +++-
 hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/ftgmac100.h"
 
 #define ASPEED_SPIS_NUM  2
+#define ASPEED_WDTS_NUM  3
 
 typedef struct AspeedSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSMCState fmc;
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     AspeedSDMCState sdmc;
-    AspeedWDTState wdt;
+    AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100;
 } AspeedSoCState;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     const hwaddr *spi_bases;
     const char *fmc_typename;
     const char **spi_typename;
+    int wdts_num;
 } AspeedSoCInfo;
 
 typedef struct AspeedSoCClass {
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400-a1",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2500-a1",
         .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2500_spi_bases,
         .fmc_typename = "aspeed.smc.ast2500-fmc",
         .spi_typename = aspeed_soc_ast2500_typenames,
+        .wdts_num     = 3,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size", &error_abort);
 
-    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
-    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
-    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
+        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
+        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
+    }
 
     object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
     object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
 
     /* Watch dog */
-    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
-    if (err) {
-        error_propagate(errp, err);
-        return;
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+                        ASPEED_SOC_WDT_BASE + i * 0x20);
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
 
     /* Net */
     qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
-- 
2.7.4

From: Alexander Graf <agraf@suse.de>

When running with KVM enabled, you can choose between emulating the
gic in kernel or user space. If the kernel supports in-kernel virtualization
of the interrupt controller, it will default to that. If not, if will
default to user space emulation.

Unfortunately when running in user mode gic emulation, we miss out on
interrupt events which are only available from kernel space, such as the timer.
This patch leverages the new kernel/user space pending line synchronization for
timer events. It does not handle PMU events yet.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h   | 11 +++++++++++
 target/arm/cpu.h       |  3 +++
 accel/kvm/kvm-all.c    |  5 +++++
 accel/stubs/kvm-stub.c |  5 +++++
 hw/intc/arm_gic.c      |  7 +++++++
 target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 82 insertions(+)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
 int kvm_cpu_exec(CPUState *cpu);
 int kvm_destroy_vcpu(CPUState *cpu);
 
+/**
+ * kvm_arm_supports_user_irq
+ *
+ * Not all KVM implementations support notifications for kernel generated
+ * interrupt events to user space. This function indicates whether the current
+ * KVM implementation does support them.
+ *
+ * Returns: true if KVM supports using kernel generated IRQs from user space
+ */
+bool kvm_arm_supports_user_irq(void);
+
 #ifdef NEED_CPU_H
 #include "cpu.h"
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     void *el_change_hook_opaque;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
+
+    /* Used to synchronize KVM and QEMU in-kernel device levels */
+    uint8_t device_irq_level;
 };
 
 static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
     return kvm_state->intx_set_mask;
 }
 
+bool kvm_arm_supports_user_irq(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
+}
+
 #ifdef KVM_CAP_SET_GUEST_DEBUG
 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                  target_ulong pc)
diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
 {
     abort();
 }
+
+bool kvm_arm_supports_user_irq(void)
+{
+    return false;
+}
 #endif
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "qom/cpu.h"
 #include "qemu/log.h"
 #include "trace.h"
+#include "sysemu/kvm.h"
 
 /* #define DEBUG_GIC */
 
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
+        error_setg(errp, "KVM with user space irqchip only works when the "
+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
+        return;
+    }
+
     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
      */
     kvm_async_interrupts_allowed = true;
 
+    /*
+     * PSCI wakes up secondary cores, so we always need to
+     * have vCPUs waiting in kernel space
+     */
+    kvm_halt_in_kernel_allowed = true;
+
     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
 
     type_register_static(&host_arm_cpu_type_info);
@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
 
 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
 {
+    ARMCPU *cpu;
+    uint32_t switched_level;
+
+    if (kvm_irqchip_in_kernel()) {
+        /*
+         * We only need to sync timer states with user-space interrupt
+         * controllers, so return early and save cycles if we don't.
+         */
+        return MEMTXATTRS_UNSPECIFIED;
+    }
+
+    cpu = ARM_CPU(cs);
+
+    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
+    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
+        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
+
+        qemu_mutex_lock_iothread();
+
+        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_VTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
+        }
+
+        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_PTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
+        }
+
+        /* XXX PMU IRQ is missing */
+
+        if (switched_level) {
+            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
+                          __func__, switched_level);
+        }
+
+        /* We also mark unknown levels as processed to not waste cycles */
+        cpu->device_irq_level = run->s.regs.device_irq_level;
+        qemu_mutex_unlock_iothread();
+    }
+
     return MEMTXATTRS_UNSPECIFIED;
 }
 
-- 
2.7.4

For v7M, writes to the CONTROL register are only permitted for
privileged code. However even if the code is privileged, the
write must not affect the SPSEL bit in the CONTROL register
if the CPU is in Thread mode (as documented in the pseudocode
for the MSR instruction). Implement this, instead of permitting
SPSEL to be written in all cases.

This was causing mbed applications not to run, because the
RTX RTOS they use relies on this behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         }
         break;
     case 20: /* CONTROL */
-        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
-        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
-                                  R_V7M_CONTROL_NPRIV_MASK);
+        /* Writing to the SPSEL bit only has an effect if we are in
+         * thread mode; other bits can be updated by any privileged code.
+         * switch_v7m_sp() deals with updating the SPSEL bit in
+         * env->v7m.control, so we only need update the others.
+         */
+        if (env->v7m.exception == 0) {
+            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+        }
+        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
+        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
-- 
2.7.4

Handful of bugfixes for rc2. None of these are particularly critical
or exciting.

-- PMM

The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345:

Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803

for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8:

hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/timer/imx_epit: Avoid assertion when CR.SWR is written
 * netduino2, netduinoplus2, microbit: set system_clock_scale so that
   SysTick running on the CPU clock works
 * target/arm: Avoid maybe-uninitialized warning with gcc 4.9
 * target/arm: Fix AddPAC error indication
 * Make AIRCR.SYSRESETREQ actually reset the system for the
   microbit, mps2-*, musca-*, netduino* boards

----------------------------------------------------------------
Kaige Li (1):
      target/arm: Avoid maybe-uninitialized warning with gcc 4.9

Peter Maydell (6):
      hw/arm/netduino2, netduinoplus2: Set system_clock_scale
      include/hw/irq.h: New function qemu_irq_is_connected()
      hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
      msf2-soc, stellaris: Don't wire up SYSRESETREQ
      hw/arm/nrf51_soc: Set system_clock_scale
      hw/timer/imx_epit: Avoid assertion when CR.SWR is written

Richard Henderson (1):
      target/arm: Fix AddPAC error indication

include/hw/arm/armv7m.h           |  4 +++-
 include/hw/irq.h                  | 18 ++++++++++++++++++
 hw/arm/msf2-soc.c                 | 11 -----------
 hw/arm/netduino2.c                | 10 ++++++++++
 hw/arm/netduinoplus2.c            | 10 ++++++++++
 hw/arm/nrf51_soc.c                |  5 +++++
 hw/arm/stellaris.c                | 12 ------------
 hw/intc/armv7m_nvic.c             | 17 ++++++++++++++++-
 hw/timer/imx_epit.c               | 13 ++++++++++---
 target/arm/pauth_helper.c         |  6 +++++-
 target/arm/translate-a64.c        |  2 +-
 tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 13 files changed, 112 insertions(+), 31 deletions(-)
 create mode 100644 tests/tcg/aarch64/pauth-5.c

The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale
global, which meant that if guest code used the systick timer in "use
the processor clock" mode it would hang because time never advances.

Set the global to match the documented CPU clock speed of these boards.
Judging by the data sheet this is slightly simplistic because the
SoC allows configuration of the SYSCLK source and frequency via the
RCC (reset and clock control) module, but we don't model that.

Fixes: https://bugs.launchpad.net/qemu/+bug/1876187
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200727162617.26227-1-peter.maydell@linaro.org
---
 hw/arm/netduino2.c     | 10 ++++++++++
 hw/arm/netduinoplus2.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/stm32f205_soc.h"
 #include "hw/arm/boot.h"
 
+/* Main SYSCLK frequency in Hz (120MHz) */
+#define SYSCLK_FRQ 120000000ULL
+
 static void netduino2_init(MachineState *machine)
 {
     DeviceState *dev;
 
+    /*
+     * TODO: ideally we would model the SoC RCC and let it handle
+     * system_clock_scale, including its ability to define different
+     * possible SYSCLK sources.
+     */
+    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+
     dev = qdev_new(TYPE_STM32F205_SOC);
     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/stm32f405_soc.h"
 #include "hw/arm/boot.h"
 
+/* Main SYSCLK frequency in Hz (168MHz) */
+#define SYSCLK_FRQ 168000000ULL
+
 static void netduinoplus2_init(MachineState *machine)
 {
     DeviceState *dev;
 
+    /*
+     * TODO: ideally we would model the SoC RCC and let it handle
+     * system_clock_scale, including its ability to define different
+     * possible SYSCLK sources.
+     */
+    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+
     dev = qdev_new(TYPE_STM32F405_SOC);
     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-- 
2.20.1

Mostly devices don't need to care whether one of their output
qemu_irq lines is connected, because functions like qemu_set_irq()
silently do nothing if there is nothing on the other end.  However
sometimes a device might want to implement default behaviour for the
case where the machine hasn't wired the line up to anywhere.

Provide a function qemu_irq_is_connected() that devices can use for
this purpose.  (The test is trivial but encapsulating it in a
function makes it easier to see where we're doing it in case we need
to change the implementation later.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
---
 include/hw/irq.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/include/hw/irq.h b/include/hw/irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
    on an existing vector of qemu_irq.  */
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
 
+/**
+ * qemu_irq_is_connected: Return true if IRQ line is wired up
+ *
+ * If a qemu_irq has a device on the other (receiving) end of it,
+ * return true; otherwise return false.
+ *
+ * Usually device models don't need to care whether the machine model
+ * has wired up their outbound qemu_irq lines, because functions like
+ * qemu_set_irq() silently do nothing if there is nothing on the other
+ * end of the line. However occasionally a device model will want to
+ * provide default behaviour if its output is left floating, and
+ * it can use this function to identify when that is the case.
+ */
+static inline bool qemu_irq_is_connected(qemu_irq irq)
+{
+    return irq != NULL;
+}
+
 #endif
-- 
2.20.1

The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals
when the guest sets the SYSRESETREQ bit in the AIRCR register.  This
matches the hardware design (where the CPU has a signal of this name
and it is up to the SoC to connect that up to an actual reset
mechanism), but in QEMU it mostly results in duplicated code in SoC
objects and bugs where SoC model implementors forget to wire up the
SYSRESETREQ line.

Provide a default behaviour for the case where SYSRESETREQ is not
actually connected to anything: use qemu_system_reset_request() to
perform a system reset.  This will allow us to remove the
implementations of SYSRESETREQ handling from the boards where that's
exactly what it does, and also fixes the bugs in the board models
which forgot to wire up the signal:

* microbit
 * mps2-an385
 * mps2-an505
 * mps2-an511
 * mps2-an521
 * musca-a
 * musca-b1
 * netduino
 * netduinoplus2

We still allow the board to wire up the signal if it needs to, in case
we need to model more complicated reset controller logic or to model
buggy SoC hardware which forgot to wire up the line itself. But
defaulting to "reset the system" is more often going to be correct
than defaulting to "do nothing".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 +++-
 hw/intc/armv7m_nvic.c   | 17 ++++++++++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 /* ARMv7M container object.
  * + Unnamed GPIO input lines: external IRQ lines for the NVIC
- * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ
+ * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ.
+ *   If this GPIO is not wired up then the NVIC will default to performing
+ *   a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET).
  * + Property "cpu-type": CPU type to instantiate
  * + Property "num-irq": number of external IRQ lines
  * + Property "memory": MemoryRegion defining the physical address space
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/armv7m_nvic.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "sysemu/runstate.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
 #include "exec/memop.h"
@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
 };
 
+static void signal_sysresetreq(NVICState *s)
+{
+    if (qemu_irq_is_connected(s->sysresetreq)) {
+        qemu_irq_pulse(s->sysresetreq);
+    } else {
+        /*
+         * Default behaviour if the SoC doesn't need to wire up
+         * SYSRESETREQ (eg to a system reset controller of some kind):
+         * perform a system reset via the usual QEMU API.
+         */
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+    }
+}
+
 static int nvic_pending_prio(NVICState *s)
 {
     /* return the group priority of the current pending interrupt,
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
                 if (attrs.secure ||
                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
-                    qemu_irq_pulse(s->sysresetreq);
+                    signal_sysresetreq(s);
                 }
             }
             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
-- 
2.20.1

The MSF2 SoC model and the Stellaris board code both wire
SYSRESETREQ up to a function that just invokes
    qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
This is now the default action that the NVIC does if the line is
not connected, so we can delete the handling code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-4-peter.maydell@linaro.org
---
 hw/arm/msf2-soc.c  | 11 -----------
 hw/arm/stellaris.c | 12 ------------
 2 files changed, 23 deletions(-)

diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/arm/msf2-soc.h"
 #include "hw/misc/unimp.h"
-#include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
 
 #define MSF2_TIMER_BASE       0x40004000
@@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 };
 static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 };
 static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 };
 
-static void do_sys_reset(void *opaque, int n, int level)
-{
-    if (level) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-    }
-}
-
 static void m2sxxx_soc_initfn(Object *obj)
 {
     MSF2State *s = MSF2_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0,
-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-
     system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk;
 
     for (i = 0; i < MSF2_NUM_UARTS; i++) {
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/log.h"
 #include "exec/address-spaces.h"
-#include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/armv7m.h"
 #include "hw/char/pl011.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
     qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
 }
 
-static
-void do_sys_reset(void *opaque, int n, int level)
-{
-    if (level) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-    }
-}
-
 /* Board init.  */
 static stellaris_board_info stellaris_boards[] = {
   { "LM3S811EVB",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* This will exit with an error if the user passed us a bad cpu_type */
     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
 
-    qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-
     if (board->dc1 & (1 << 16)) {
         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     qdev_get_gpio_in(nvic, 14),
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The definition of top_bit used in this function is one higher
than that used in the Arm ARM psuedo-code, which put the error
indication at top_bit - 1 at the wrong place, which meant that
it wasn't visible to Auth.

Fixing the definition of top_bit requires more changes, because
its most common use is for the count of bits in top_bit:bot_bit,
which would then need to be computed as top_bit - bot_bit + 1.

For now, prefer the minimal fix to the error indication alone.

Fixes: 63ff0ca94cb
Reported-by: Derrick McKee <derrick.mckee@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200728195706.11087-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added comment about the divergence from the pseudocode]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/pauth_helper.c         |  6 +++++-
 tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/aarch64/pauth-5.c

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
      */
     test = sextract64(ptr, bot_bit, top_bit - bot_bit);
     if (test != 0 && test != -1) {
-        pac ^= MAKE_64BIT_MASK(top_bit - 1, 1);
+        /*
+         * Note that our top_bit is one greater than the pseudocode's
+         * version, hence "- 2" here.
+         */
+        pac ^= MAKE_64BIT_MASK(top_bit - 2, 1);
     }
 
     /*
diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/pauth-5.c
@@ -XXX,XX +XXX,XX @@
+#include <assert.h>
+
+static int x;
+
+int main()
+{
+    int *p0 = &x, *p1, *p2, *p3;
+    unsigned long salt = 0;
+
+    /*
+     * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so
+     * a 1/128 chance of auth = pac(ptr,key,salt) producing zero.
+     * Find a salt that creates auth != 0.
+     */
+    do {
+        salt++;
+        asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0));
+    } while (p0 == p1);
+
+    /*
+     * This pac must fail, because the input pointer bears an encryption,
+     * and so is not properly extended within bits [55:47].  This will
+     * toggle bit 54 in the output...
+     */
+    asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1));
+
+    /* ... so that the aut must fail, setting bit 53 in the output ... */
+    asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2));
+
+    /* ... which means this equality must not hold. */
+    assert(p3 != p0);
+    return 0;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 
 # Pauth Tests
 ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),)
-AARCH64_TESTS += pauth-1 pauth-2 pauth-4
+AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5
 pauth-%: CFLAGS += -march=armv8.3-a
 run-pauth-%: QEMU_OPTS += -cpu max
 run-plugin-pauth-%: QEMU_OPTS += -cpu max
-- 
2.20.1

From: Kaige Li <likaige@loongson.cn>

GCC version 4.9.4 isn't clever enough to figure out that all
execution paths in disas_ldst() that use 'fn' will have initialized
it first, and so it warns:

/home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’:
/home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
     ^
/home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here
     AtomicThreeOpFn *fn;
                      ^

Make it happy by initializing the variable to NULL.

Signed-off-by: Kaige Li <likaige@loongson.cn>
Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: Clean up commit message and note which gcc version this was]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
     bool r = extract32(insn, 22, 1);
     bool a = extract32(insn, 23, 1);
     TCGv_i64 tcg_rs, clean_addr;
-    AtomicThreeOpFn *fn;
+    AtomicThreeOpFn *fn = NULL;
 
     if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
         unallocated_encoding(s);
-- 
2.20.1

The nrf51 SoC model wasn't setting the system_clock_scale
global.which meant that if guest code used the systick timer in "use
the processor clock" mode it would hang because time never advances.

Set the global to match the documented CPU clock speed for this SoC.

This SoC in fact doesn't have a SysTick timer (which is the only thing
currently that cares about the system_clock_scale), because it's
a configurable option in the Cortex-M0. However our Cortex-M0 and
thus our nrf51 and our micro:bit board do provide a SysTick, so
we ought to provide a functional one rather than a broken one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200727193458.31250-1-peter.maydell@linaro.org
---
 hw/arm/nrf51_soc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 
 #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
 
+/* HCLK (the main CPU clock) on this SoC is always 16MHz */
+#define HCLK_FRQ 16000000
+
 static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size)
 {
     qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ;
+
     object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
                              &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
-- 
2.20.1

The imx_epit device has a software-controllable reset triggered by
setting the SWR bit in the CR register. An error in commit cc2722ec83ad9
means that we will end up assert()ing if the guest does this, because
the code in imx_epit_write() starts ptimer transactions, and then
imx_epit_reset() also starts ptimer transactions, triggering
"ptimer_transaction_begin: Assertion `!s->in_transaction' failed".

The cleanest way to avoid this double-transaction is to move the
start-transaction for the CR write handling down below the check of
the SWR bit.

Fixes: https://bugs.launchpad.net/qemu/+bug/1880424
Fixes: cc2722ec83ad944505fe
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200727154550.3409-1-peter.maydell@linaro.org
---
 hw/timer/imx_epit.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
 
     switch (offset >> 2) {
     case 0: /* CR */
-        ptimer_transaction_begin(s->timer_cmp);
-        ptimer_transaction_begin(s->timer_reload);
 
         oldcr = s->cr;
         s->cr = value & 0x03ffffff;
         if (s->cr & CR_SWR) {
             /* handle the reset */
             imx_epit_reset(DEVICE(s));
-        } else {
+            /*
+             * TODO: could we 'break' here? following operations appear
+             * to duplicate the work imx_epit_reset() already did.
+             */
+        }
+
+        ptimer_transaction_begin(s->timer_cmp);
+        ptimer_transaction_begin(s->timer_reload);
+
+        if (!(s->cr & CR_SWR)) {
             imx_epit_set_freq(s);
         }
 
-- 
2.20.1