Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[PULL 00/16] target-arm queue
-More arm patches (mostly the SDHCI ones from Philippe)
+Patches for rc1: nothing major, just some minor bugfixes and
 code cleanups.
-thanks
 -- PMM
-The following changes since commit f521eeee3bd060b460c99e605472b7e03967db43:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20180115' into staging (2018-01-15 13:17:47 +0000)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180116
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to 60765b6ceeb4998a0d4220b3a53f1f185061da77:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  sdhci: add a 'dma' property to the sysbus devices (2018-01-16 13:28:21 +0000)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * SDHCI: cleanups and minor bug fixes
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * target/arm: minor refactor preparatory to fp16 support
+ * Minor coding style fixes
- * omap_ssd, ssi-sd, pl181, milkymist-memcard: reset the SD
+ * docs: add some notes on the sbsa-ref machine
-   card on controller reset (fixes migration failures)
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * target/arm: Handle page table walk load failures correctly
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * hw/arm/virt: Add virt-2.12 machine type
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * get_phys_addr_pmsav7: Support AP=0b111 for v7M
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
- * hw/intc/armv7m: Support byte and halfword accesses to CFSR
+ * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Andrey Smirnov (1):
+Alex Bennée (1):
-      sdhci: Implement write method of ACMD12ERRSTS register
+      docs: add some notes on the sbsa-ref machine
-Peter Maydell (8):
+AlexChen (1):
-      hw/intc/armv7m: Support byte and halfword accesses to CFSR
+      ssi: Fix bad printf format specifiers
       get_phys_addr_pmsav7: Support AP=0b111 for v7M
       hw/arm/virt: Add virt-2.12 machine type
       target/arm: Handle page table walk load failures correctly
       hw/sd/pl181: Reset SD card on controller reset
       hw/sd/milkymist-memcard: Reset SD card on controller reset
       hw/sd/ssi-sd: Reset SD card on controller reset
       hw/sd/omap_mmc: Reset SD card on controller reset
-Philippe Mathieu-Daudé (13):
+Andrew Jones (1):
-      sdhci: clean up includes
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
       sdhci: remove dead code
       sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
       sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
       sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
       sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
       sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
       sdhci: convert the DPRINT() calls into trace events
       sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
       sdhci: rename the SDHC_CAPAB register
       sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
       sdhci: fix the PCI device, using the PCI address space for DMA
       sdhci: add a 'dma' property to the sysbus devices
-Richard Henderson (2):
+Havard Skinnemoen (1):
-      target/arm: Split out vfp_expand_imm
+      tests/qtest/npcm7xx_rng-test: count runs properly
       target/arm: Add fp16 support to vfp_expand_imm
- hw/sd/sdhci-internal.h     |   7 +-
+Peter Maydell (2):
- include/hw/sd/sdhci.h      |  19 +++-
+      hw/arm/nseries: Check return value from load_image_targphys()
- target/arm/internals.h     |  10 ++
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
  hw/arm/virt.c              |  19 +++-
  hw/intc/armv7m_nvic.c      |  38 ++++---
  hw/sd/milkymist-memcard.c  |   4 +
  hw/sd/omap_mmc.c           |  14 ++-
  hw/sd/pl181.c              |   4 +
  hw/sd/sdhci.c              | 266 +++++++++++++++++++++++++++------------------
  hw/sd/ssi-sd.c             |  25 ++++-
  target/arm/helper.c        |  53 ++++++++-
  target/arm/op_helper.c     |   7 +-
  target/arm/translate-a64.c |  49 ++++++---
  hw/sd/trace-events         |  14 +++
 files changed, 362 insertions(+), 167 deletions(-)
+Philippe Mathieu-Daudé (6):
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      hw/arm/armsse: Correct expansion MPC interrupt lines
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+Richard Henderson (1):
+      target/arm: Fix neon VTBL/VTBX for len > 1
+Xinhao Zhang (3):
+      target/arm: add spaces around operator
+      target/arm: Don't use '#' flag of printf format
+      target/arm: add space before the open parenthesis '('
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-[Qemu-devel] [PULL 01/24] hw/intc/armv7m: Support byte and halfword accesses to CFSR
+Deleted patch
-The Configurable Fault Status Register for ARMv7M and v8M is
-supposed to be byte and halfword accessible, but we were only
-implementing word accesses. Add support for the other access
-sizes, which are used by the Zephyr RTOS.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reported-by: Andy Gross <andy.gross@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1512742372-31517-1-git-send-email-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 38 ++++++++++++++++++++++----------------
-file changed, 22 insertions(+), 16 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-             val |= (1 << 8);
-         }
-         return val;
--    case 0xd28: /* Configurable Fault Status.  */
--        /* The BFSR bits [15:8] are shared between security states
--         * and we store them in the NS copy
--         */
--        val = cpu->env.v7m.cfsr[attrs.secure];
--        val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
--        return val;
-     case 0xd2c: /* Hard Fault Status.  */
-         return cpu->env.v7m.hfsr;
-     case 0xd30: /* Debug Fault Status.  */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
-         nvic_irq_update(s);
-         break;
--    case 0xd28: /* Configurable Fault Status.  */
--        cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
--        if (attrs.secure) {
--            /* The BFSR bits [15:8] are shared between security states
--             * and we store them in the NS copy.
--             */
--            cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
--        }
--        break;
-     case 0xd2c: /* Hard Fault Status.  */
-         cpu->env.v7m.hfsr &= ~value; /* W1C */
-         break;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
-             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
-         }
-         break;
-+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
-+        /* The BFSR bits [15:8] are shared between security states
-+         * and we store them in the NS copy
-+         */
-+        val = s->cpu->env.v7m.cfsr[attrs.secure];
-+        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
-+        val = extract32(val, (offset - 0xd28) * 8, size * 8);
-+        break;
-     case 0xfe0 ... 0xfff: /* ID.  */
-         if (offset & 3) {
-             val = 0;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
-         }
-         nvic_irq_update(s);
-         return MEMTX_OK;
-+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
-+        /* All bits are W1C, so construct 32 bit value with 0s in
-+         * the parts not written by the access size
-+         */
-+        value <<= ((offset - 0xd28) * 8);
-+
-+        s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
-+        if (attrs.secure) {
-+            /* The BFSR bits [15:8] are shared between security states
-+             * and we store them in the NS copy.
-+             */
-+            s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
-+        }
-+        return MEMTX_OK;
-     }
-     if (size == 4) {
-         nvic_writel(s, offset, value, attrs);
---
-.7.4

-[Qemu-devel] [PULL 24/24] sdhci: add a 'dma' property to the sysbus devices
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Andrew Jones <drjones@redhat.com>
-Add a 'dma' property allowing machine creation to provide the address-space
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
-SDHCI DMA operates on.
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
 in the build when building armv7m_systick.
-[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
- from qemu/xilinx tag xilinx-v2016.1]
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
 Message-id: 20180115182436.2066-15-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h |  1 +
+ hw/arm/Kconfig | 1 +
- hw/sd/sdhci.c         | 18 +++++++++++++++++-
+file changed, 1 insertion(+)
 files changed, 18 insertions(+), 1 deletion(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/hw/arm/Kconfig
-+++ b/include/hw/sd/sdhci.h
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
-     SDBus sdbus;
-     MemoryRegion iomem;
+ config ARM_V7M
-     AddressSpace *dma_as;
+     bool
-+    MemoryRegion *dma_mr;
++    select PTIMER
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
+ config ALLWINNER_A10
-     QEMUTimer *transfer_timer;
+     bool
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static Property sdhci_sysbus_properties[] = {
      DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
      DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
                       false),
 +    DEFINE_PROP_LINK("dma", SDHCIState,
 +                     dma_mr, TYPE_MEMORY_REGION, MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_init(Object *obj)
  static void sdhci_sysbus_finalize(Object *obj)
  {
      SDHCIState *s = SYSBUS_SDHCI(obj);
 +
 +    if (s->dma_mr) {
 +        object_unparent(OBJECT(s->dma_mr));
 +    }
 +
      sdhci_uninitfn(s);
  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
          return;
      }
 -    s->dma_as = &address_space_memory;
 +    if (s->dma_mr) {
 +        address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
 +    } else {
 +        /* use system_memory() if property "dma" not set */
 +        s->dma_as = &address_space_memory;
 +    }
      sysbus_init_irq(sbd, &s->irq);
      sysbus_init_mmio(sbd, &s->iomem);
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
      SDHCIState *s = SYSBUS_SDHCI(dev);
      sdhci_common_unrealize(s, &error_abort);
 +
 +     if (s->dma_mr) {
 +        address_space_destroy(s->dma_as);
 +    }
  }
  static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 20/24] sdhci: rename the SDHC_CAPAB register
+[PULL 02/16] ssi: Fix bad printf format specifiers
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: AlexChen <alex.chen@huawei.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We should use printf format specifier "%u" instead of "%d" for
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+argument of type "unsigned int".
-Message-id: 20180115182436.2066-11-f4bug@amsat.org
 Reported-by: Euler Robot <euler.robot@huawei.com>
 Signed-off-by: Alex Chen <alex.chen@huawei.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci-internal.h | 2 +-
+ hw/ssi/imx_spi.c    | 2 +-
- hw/sd/sdhci.c          | 2 +-
+ hw/ssi/xilinx_spi.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
+--- a/hw/ssi/imx_spi.c
-+++ b/hw/sd/sdhci-internal.h
++++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
- #define SDHC_ACMD12ERRSTS              0x3C
+     case ECSPI_MSGDATA:
+         return  "ECSPI_MSGDATA";
- /* HWInit Capabilities Register 0x05E80080 */
+     default:
--#define SDHC_CAPAREG                   0x40
+-        sprintf(unknown, "%d ?", reg);
-+#define SDHC_CAPAB                     0x40
++        sprintf(unknown, "%u ?", reg);
- #define SDHC_CAN_DO_DMA                0x00400000
+         return unknown;
- #define SDHC_CAN_DO_ADMA2              0x00080000
+     }
- #define SDHC_CAN_DO_ADMA1              0x00100000
+ }
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/ssi/xilinx_spi.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/ssi/xilinx_spi.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
-     case SDHC_ACMD12ERRSTS:
+        irq chain unless things really changed.  */
-         ret = s->acmd12errsts;
+     if (pending != s->irqline) {
-         break;
+         s->irqline = pending;
--    case SDHC_CAPAREG:
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
-+    case SDHC_CAPAB:
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
-         ret = s->capareg;
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
-         break;
+         qemu_set_irq(s->irq, pending);
-     case SDHC_MAXCURR:
+     }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/24] target/arm: Handle page table walk load failures correctly
+[PULL 03/16] target/arm: add spaces around operator
-Instead of ignoring the response from address_space_ld*()
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
 (indicating an attempt to read a page table descriptor from
 an invalid physical address), use it to report the failure
 correctly.
-Since this is another couple of locations where we need to
+Fix code style. Operator needs spaces both sides.
 decide the value of the ARMMMUFaultInfo ea bit based on a
 MemTxResult, we factor out that operation into a helper
 function.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/arch_dump.c | 8 ++++----
- target/arm/helper.c    | 39 ++++++++++++++++++++++++++++++++++-----
+ target/arm/arm-semi.c  | 8 ++++----
- target/arm/op_helper.c |  7 +------
+ target/arm/helper.c    | 2 +-
-files changed, 45 insertions(+), 11 deletions(-)
+files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/arch_dump.c
-+++ b/target/arm/internals.h
++++ b/target/arm/arch_dump.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
-     return fsc;
- }
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
-+static inline bool arm_extabort_type(MemTxResult result)
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-+{
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
-+    /* The EA bit in syndromes and fault status registers is an
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
-+     * IMPDEF classification of external aborts. ARM implementations
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
-+     * usually use this to indicate AXI bus Decode error (0) or
+     }
-+     * Slave error (1); in QEMU we follow that.
-+     */
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
-+    return result != MEMTX_DECODE_ERROR;
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
-+}
+          */
-+
+         for (i = 0; i < 32; ++i) {
- /* Do a page table walk and add page to TLB if possible */
+             uint64_t tmp = note.vfp.vregs[2*i];
- bool arm_tlb_fill(CPUState *cpu, vaddr address,
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-                   MMUAccessType access_type, int mmu_idx,
+-            note.vfp.vregs[2*i+1] = tmp;
 +            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
 +            note.vfp.vregs[2 * i + 1] = tmp;
          }
      }
 diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-semi.c
 +++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          if (use_gdb_syscalls()) {
              arm_semi_open_guestfd = guestfd;
              ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
 -                                  (int)arg2+1, gdb_open_modeflags[arg1]);
 +                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
 -                                  arg0, (int)arg1+1);
 +                                  arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
-         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
+     uint32_t sum;
-                                  &txattrs, &s2prot, &s2size, fi, NULL);
+     sum = do_usad(a, b);
-         if (ret) {
+     sum += do_usad(a >> 8, b >> 8);
-+            assert(fi->type != ARMFault_None);
+-    sum += do_usad(a >> 16, b >>16);
-             fi->s2addr = addr;
++    sum += do_usad(a >> 16, b >> 16);
-             fi->stage2 = true;
+     sum += do_usad(a >> 24, b >> 24);
-             fi->s1ptw = true;
+     return sum;
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
      MemTxAttrs attrs = {};
 +    MemTxResult result = MEMTX_OK;
      AddressSpace *as;
 +    uint32_t data;
      attrs.secure = is_secure;
      as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
          return 0;
      }
      if (regime_translation_big_endian(env, mmu_idx)) {
 -        return address_space_ldl_be(as, addr, attrs, NULL);
 +        data = address_space_ldl_be(as, addr, attrs, &result);
      } else {
 -        return address_space_ldl_le(as, addr, attrs, NULL);
 +        data = address_space_ldl_le(as, addr, attrs, &result);
      }
 +    if (result == MEMTX_OK) {
 +        return data;
 +    }
 +    fi->type = ARMFault_SyncExternalOnWalk;
 +    fi->ea = arm_extabort_type(result);
 +    return 0;
  }
  static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
      MemTxAttrs attrs = {};
 +    MemTxResult result = MEMTX_OK;
      AddressSpace *as;
 +    uint32_t data;
      attrs.secure = is_secure;
      as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
          return 0;
      }
      if (regime_translation_big_endian(env, mmu_idx)) {
 -        return address_space_ldq_be(as, addr, attrs, NULL);
 +        data = address_space_ldq_be(as, addr, attrs, &result);
      } else {
 -        return address_space_ldq_le(as, addr, attrs, NULL);
 +        data = address_space_ldq_le(as, addr, attrs, &result);
 +    }
 +    if (result == MEMTX_OK) {
 +        return data;
      }
 +    fi->type = ARMFault_SyncExternalOnWalk;
 +    fi->ea = arm_extabort_type(result);
 +    return 0;
  }
  static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
      }
      desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                         mmu_idx, fi);
 +    if (fi->type != ARMFault_None) {
 +        goto do_fault;
 +    }
      type = (desc & 3);
      domain = (desc >> 5) & 0x0f;
      if (regime_el(env, mmu_idx) == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
          }
          desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                             mmu_idx, fi);
 +        if (fi->type != ARMFault_None) {
 +            goto do_fault;
 +        }
          switch (desc & 3) {
          case 0: /* Page translation fault.  */
              fi->type = ARMFault_Translation;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
      }
      desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                         mmu_idx, fi);
 +    if (fi->type != ARMFault_None) {
 +        goto do_fault;
 +    }
      type = (desc & 3);
      if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
          /* Section translation fault, or attempt to use the encoding
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
          desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                             mmu_idx, fi);
 +        if (fi->type != ARMFault_None) {
 +            goto do_fault;
 +        }
          ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
          switch (desc & 3) {
          case 0: /* Page translation fault.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          descaddr &= ~7ULL;
          nstable = extract32(tableattrs, 4, 1);
          descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
 -        if (fi->s1ptw) {
 +        if (fi->type != ARMFault_None) {
              goto do_fault;
          }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
      /* now we have a real cpu fault */
      cpu_restore_state(cs, retaddr);
 -    /* The EA bit in syndromes and fault status registers is an
 -     * IMPDEF classification of external aborts. ARM implementations
 -     * usually use this to indicate AXI bus Decode error (0) or
 -     * Slave error (1); in QEMU we follow that.
 -     */
 -    fi.ea = (response != MEMTX_DECODE_ERROR);
 +    fi.ea = arm_extabort_type(response);
      fi.type = ARMFault_SyncExternal;
      deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 10/24] target/arm: Add fp16 support to vfp_expand_imm
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Fix code style. Don't use '#' flag of printf format ('%#') in
 format strings, use '0x' prefix instead
 Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
 Signed-off-by: Kai Deng <dengkai1@huawei.com>
 Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180110063337.21538-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 5 +++++
+ target/arm/translate-a64.c | 4 ++--
-file changed, 5 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t vfp_expand_imm(int size, uint8_t imm8)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
-             (extract32(imm8, 0, 6) << 3);
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
-         imm <<= 16;
+                 break;
              default:
 -                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
 +                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                          __func__, insn, fpopcode, s->pc_curr);
                  g_assert_not_reached();
              }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      case 0x7f: /* FSQRT (vector) */
          break;
-+    case MO_16:
-+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
-+            (extract32(imm8, 0, 6) << 6);
-+        break;
      default:
+-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
++        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 23/24] sdhci: fix the PCI device, using the PCI address space for DMA
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-While SysBus devices can use the get_system_memory() address space,
+Fix code style. Space required before the open parenthesis '('.
 PCI devices should use the bus master address space for DMA.
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
 Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180115182436.2066-14-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h |  1 +
+ target/arm/translate.c | 2 +-
- hw/sd/sdhci.c         | 29 +++++++++++++++--------------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 16 insertions(+), 14 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/target/arm/translate.c
-+++ b/include/hw/sd/sdhci.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     /*< public >*/
+             - Hardware watchpoints.
-     SDBus sdbus;
+            Hardware breakpoints have already been handled and skip this code.
-     MemoryRegion iomem;
+          */
-+    AddressSpace *dma_as;
+-        switch(dc->base.is_jmp) {
++        switch (dc->base.is_jmp) {
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
+         case DISAS_NEXT:
-     QEMUTimer *transfer_timer;
+         case DISAS_TOO_MANY:
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+             gen_goto_tb(dc, 1, dc->base.pc_next);
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                      s->blkcnt--;
                  }
              }
 -            dma_memory_write(&address_space_memory, s->sdmasysad,
 +            dma_memory_write(s->dma_as, s->sdmasysad,
                               &s->fifo_buffer[begin], s->data_count - begin);
              s->sdmasysad += s->data_count - begin;
              if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                  s->data_count = block_size;
                  boundary_count -= block_size - begin;
              }
 -            dma_memory_read(&address_space_memory, s->sdmasysad,
 +            dma_memory_read(s->dma_as, s->sdmasysad,
                              &s->fifo_buffer[begin], s->data_count - begin);
              s->sdmasysad += s->data_count - begin;
              if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
          for (n = 0; n < datacnt; n++) {
              s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
          }
 -        dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer,
 -                         datacnt);
 +        dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
      } else {
 -        dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer,
 -                        datacnt);
 +        dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
          for (n = 0; n < datacnt; n++) {
              sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
          }
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
      hwaddr entry_addr = (hwaddr)s->admasysaddr;
      switch (SDHC_DMA_TYPE(s->hostctl)) {
      case SDHC_CTRL_ADMA2_32:
 -        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma2,
 +        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma2,
                          sizeof(adma2));
          adma2 = le64_to_cpu(adma2);
          /* The spec does not specify endianness of descriptor table.
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
          dscr->incr = 8;
          break;
      case SDHC_CTRL_ADMA1_32:
 -        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma1,
 +        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma1,
                          sizeof(adma1));
          adma1 = le32_to_cpu(adma1);
          dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
          }
          break;
      case SDHC_CTRL_ADMA2_64:
 -        dma_memory_read(&address_space_memory, entry_addr,
 +        dma_memory_read(s->dma_as, entry_addr,
                          (uint8_t *)(&dscr->attr), 1);
 -        dma_memory_read(&address_space_memory, entry_addr + 2,
 +        dma_memory_read(s->dma_as, entry_addr + 2,
                          (uint8_t *)(&dscr->length), 2);
          dscr->length = le16_to_cpu(dscr->length);
 -        dma_memory_read(&address_space_memory, entry_addr + 4,
 +        dma_memory_read(s->dma_as, entry_addr + 4,
                          (uint8_t *)(&dscr->addr), 8);
          dscr->attr = le64_to_cpu(dscr->attr);
          dscr->attr &= 0xfffffff8;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                          s->data_count = block_size;
                          length -= block_size - begin;
                      }
 -                    dma_memory_write(&address_space_memory, dscr.addr,
 +                    dma_memory_write(s->dma_as, dscr.addr,
                                       &s->fifo_buffer[begin],
                                       s->data_count - begin);
                      dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                          s->data_count = block_size;
                          length -= block_size - begin;
                      }
 -                    dma_memory_read(&address_space_memory, dscr.addr,
 +                    dma_memory_read(s->dma_as, dscr.addr,
                                      &s->fifo_buffer[begin],
                                      s->data_count - begin);
                      dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
      dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
      dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
      s->irq = pci_allocate_irq(dev);
 -    pci_register_bar(dev, 0, 0, &s->iomem);
 +    s->dma_as = pci_get_address_space(dev);
 +    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->iomem);
  }
  static void sdhci_pci_exit(PCIDevice *dev)
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
          return;
      }
 +    s->dma_as = &address_space_memory;
 +
      sysbus_init_irq(sbd, &s->irq);
      sysbus_init_mmio(sbd, &s->iomem);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 22/24] sdhci: Implement write method of ACMD12ERRSTS register
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+We should at least document what this machine is about.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180115182436.2066-13-f4bug@amsat.org
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
 Cc: Leif Lindholm <leif@nuviainc.com>
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 3 +++
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
-file changed, 3 insertions(+)
+ docs/system/target-arm.rst |  1 +
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
 +Arm Server Base System Architecture Reference board (``sbsa-ref``)
 +==================================================================
 +
 +While the `virt` board is a generic board platform that doesn't match
 +any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/docs/system/target-arm.rst
-+++ b/hw/sd/sdhci.c
++++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-         }
+    arm/mps2
-         sdhci_update_irq(s);
+    arm/musca
-         break;
+    arm/realview
-+    case SDHC_ACMD12ERRSTS:
++   arm/sbsa
-+        MASKED_WRITE(s->acmd12errsts, mask, value);
+    arm/versatile
-+        break;
+    arm/vexpress
+    arm/aspeed
      case SDHC_CAPAB:
      case SDHC_CAPAB + 4:
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 19/24] sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+When using a Cortex-A15, the Virt machine does not use any
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+MPCore peripherals. Remove the dependency.
-Message-id: 20180115182436.2066-10-f4bug@amsat.org
 Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201107114852.271922-1-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci-internal.h | 1 +
+ hw/arm/Kconfig | 1 -
- hw/sd/sdhci.c          | 3 +--
+file changed, 1 deletion(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
+--- a/hw/arm/Kconfig
-+++ b/hw/sd/sdhci-internal.h
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
- #define SDHC_TRNS_ACMD12               0x0004
+     imply VFIO_PLATFORM
- #define SDHC_TRNS_READ                 0x0010
+     imply VFIO_XGMAC
- #define SDHC_TRNS_MULTI                0x0020
+     imply TPM_TIS_SYSBUS
-+#define SDHC_TRNMOD_MASK               0x0037
+-    select A15MPCORE
+     select ACPI
- /* R/W Command Register 0x0 */
+     select ARM_SMMUV3
- #define SDHC_CMDREG                    0x0E
+     select GPIO_KEY
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
      (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
      (SDHC_CAPAB_TOCLKFREQ))
 -#define MASK_TRNMOD     0x0037
  #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
  static uint8_t sdhci_slotint(SDHCIState *s)
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
          if (!(s->capareg & SDHC_CAN_DO_DMA)) {
              value &= ~SDHC_TRNS_DMA;
          }
 -        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
 +        MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
          MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
          /* Writing to the upper byte of CMDREG triggers SD command generation */
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 18/24] sdhci: convert the DPRINT() calls into trace events
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-zero-initialize ADMADescr 'dscr' in sdhci_do_adma() to avoid:
+The helper function did not get updated when we reorganized
 the vector register file for SVE.  Since then, the neon dregs
 are non-sequential and cannot be simply indexed.
-  hw/sd/sdhci.c: In function ‘sdhci_do_adma’:
+At the same time, make the helper function operate on 64-bit
-  hw/sd/sdhci.c:714:29: error: ‘dscr.addr’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
+quantities so that we do not have to call it twice.
              trace_sdhci_adma("link", s->admasysaddr);
                              ^
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Fixes: c39c2b9043e
-Acked-by: Alistair Francis <alistair.francis@xilinx.com>
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
-Message-id: 20180115182436.2066-9-f4bug@amsat.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 [PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c      | 89 ++++++++++++++++++------------------------------------
+ target/arm/helper.h             |  2 +-
- hw/sd/trace-events | 14 +++++++++
+ target/arm/op_helper.c          | 23 +++++++++--------
-files changed, 44 insertions(+), 59 deletions(-)
+ target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/target/arm/helper.h
-+++ b/hw/sd/sdhci.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
- #include "sdhci-internal.h"
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
- #include "qapi/error.h"
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
- #include "qemu/log.h"
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
--
+-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
--/* host controller debug messages */
++DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
--#ifndef SDHC_DEBUG
--#define SDHC_DEBUG                        0
+ DEF_HELPER_3(shl_cc, i32, env, i32, i32)
--#endif
+ DEF_HELPER_3(shr_cc, i32, env, i32, i32)
--
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
--#define DPRINT_L1(fmt, args...) \
+index XXXXXXX..XXXXXXX 100644
--    do { \
+--- a/target/arm/op_helper.c
--        if (SDHC_DEBUG) { \
++++ b/target/arm/op_helper.c
--            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
--        } \
+     cpu_loop_exit_restore(cs, ra);
--    } while (0)
+ }
--#define DPRINT_L2(fmt, args...) \
--    do { \
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
--        if (SDHC_DEBUG > 1) { \
+-                          uint32_t maxindex)
--            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
++uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
--        } \
++                          uint64_t ireg, uint64_t def)
 -    } while (0)
 -#define ERRPRINT(fmt, args...) \
 -    do { \
 -        if (SDHC_DEBUG) { \
 -            fprintf(stderr, "QEMU SDHC ERROR: " fmt, ## args); \
 -        } \
 -    } while (0)
 +#include "trace.h"
  #define TYPE_SDHCI_BUS "sdhci-bus"
  #define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS)
@@ -XXX,XX +XXX,XX @@ static void sdhci_raise_insertion_irq(void *opaque)
  static void sdhci_set_inserted(DeviceState *dev, bool level)
  {
-     SDHCIState *s = (SDHCIState *)dev;
+-    uint32_t val, shift;
--    DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject");
+-    uint64_t *table = vn;
++    uint64_t tmp, val = 0;
-+    trace_sdhci_set_inserted(level ? "insert" : "eject");
++    uint32_t maxindex = ((desc & 3) + 1) * 8;
-     if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
++    uint32_t base_reg = desc >> 2;
-         /* Give target some time to notice card ejection */
++    uint32_t shift, index, reg;
-         timer_mod(s->insert_timer,
-@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
+-    val = 0;
-     s->acmd12errsts = 0;
+-    for (shift = 0; shift < 32; shift += 8) {
-     request.cmd = s->cmdreg >> 8;
+-        uint32_t index = (ireg >> shift) & 0xff;
-     request.arg = s->argument;
++    for (shift = 0; shift < 64; shift += 8) {
--    DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg);
++        index = (ireg >> shift) & 0xff;
-+
+         if (index < maxindex) {
-+    trace_sdhci_send_command(request.cmd, request.arg);
+-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-     rlen = sdbus_do_command(&s->sdbus, &request, response);
+-            val |= tmp << shift;
++            reg = base_reg + (index >> 3);
-     if (s->cmdreg & SDHC_CMD_RESPONSE) {
++            tmp = *aa32_vfp_dreg(env, reg);
-@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
++            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
              s->rspreg[0] = (response[0] << 24) | (response[1] << 16) |
                             (response[2] << 8)  |  response[3];
              s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
 -            DPRINT_L1("Response: RSPREG[31..0]=0x%08x\n", s->rspreg[0]);
 +            trace_sdhci_response4(s->rspreg[0]);
          } else if (rlen == 16) {
              s->rspreg[0] = (response[11] << 24) | (response[12] << 16) |
                             (response[13] << 8) |  response[14];
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
                             (response[5] << 8)  |  response[6];
              s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
                              response[2];
 -            DPRINT_L1("Response received:\n RSPREG[127..96]=0x%08x, RSPREG[95.."
 -                  "64]=0x%08x,\n RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x\n",
 -                  s->rspreg[3], s->rspreg[2], s->rspreg[1], s->rspreg[0]);
 +            trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
 +                                   s->rspreg[1], s->rspreg[0]);
          } else {
--            ERRPRINT("Timeout waiting for command response\n");
+-            val |= def & (0xff << shift);
-+            trace_sdhci_error("timeout waiting for command response");
++            tmp = def & (0xffull << shift);
-             if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
+         }
-                 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
++        val |= tmp;
                  s->norintsts |= SDHC_NIS_ERR;
@@ -XXX,XX +XXX,XX @@ static void sdhci_end_transfer(SDHCIState *s)
          request.cmd = 0x0C;
          request.arg = 0;
 -        DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg);
 +        trace_sdhci_end_transfer(request.cmd, request.arg);
          sdbus_do_command(&s->sdbus, &request, response);
          /* Auto CMD12 response goes to the upper Response register */
          s->rspreg[3] = (response[0] << 24) | (response[1] << 16) |
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
      /* first check that a valid data exists in host controller input buffer */
      if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
 -        ERRPRINT("Trying to read from empty buffer\n");
 +        trace_sdhci_error("read from empty buffer");
          return 0;
      }
+     return val;
-@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
+ }
-         s->data_count++;
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
-         /* check if we've read all valid data (blksize bytes) from buffer */
+index XXXXXXX..XXXXXXX 100644
-         if ((s->data_count) >= (s->blksize & 0x0fff)) {
+--- a/target/arm/translate-neon.c.inc
--            DPRINT_L2("All %u bytes of data have been read from input buffer\n",
++++ b/target/arm/translate-neon.c.inc
--                    s->data_count);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
-+            trace_sdhci_read_dataport(s->data_count);
-             s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
+ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-             s->data_count = 0;  /* next buff read must start at position [0] */
+ {
+-    int n;
-@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
+-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
+-    TCGv_ptr ptr1;
-     /* Check that there is free space left in a buffer */
++    TCGv_i64 val, def;
-     if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
++    TCGv_i32 desc;
--        ERRPRINT("Can't write to data buffer: buffer full\n");
-+        trace_sdhci_error("Can't write to data buffer: buffer full");
+     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-         return;
+         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
-@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
+-    n = a->len + 1;
-         s->data_count++;
+-    if ((a->vn + n) > 32) {
-         value >>= 8;
++    if ((a->vn + a->len + 1) > 32) {
-         if (s->data_count >= (s->blksize & 0x0fff)) {
+         /*
--            DPRINT_L2("write buffer filled with %u bytes of data\n",
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
--                    s->data_count);
+          * helper function running off the end of the register file.
-+            trace_sdhci_write_dataport(s->data_count);
+          */
              s->data_count = 0;
              s->prnsts &= ~SDHC_SPACE_AVAILABLE;
              if (s->prnsts & SDHC_DOING_WRITE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
  {
      unsigned int n, begin, length;
      const uint16_t block_size = s->blksize & 0x0fff;
 -    ADMADescr dscr;
 +    ADMADescr dscr = {};
      int i;
      for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
          s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
          get_adma_description(s, &dscr);
 -        DPRINT_L2("ADMA loop: addr=" TARGET_FMT_plx ", len=%d, attr=%x\n",
 -                dscr.addr, dscr.length, dscr.attr);
 +        trace_sdhci_adma_loop(dscr.addr, dscr.length, dscr.attr);
          if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
              /* Indicate that error occurred in ST_FDS state */
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
              break;
          case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
              s->admasysaddr = dscr.addr;
 -            DPRINT_L1("ADMA link: admasysaddr=0x%" PRIx64 "\n",
 -                      s->admasysaddr);
 +            trace_sdhci_adma("link", s->admasysaddr);
              break;
          default:
              s->admasysaddr += dscr.incr;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
          }
          if (dscr.attr & SDHC_ADMA_ATTR_INT) {
 -            DPRINT_L1("ADMA interrupt: admasysaddr=0x%" PRIx64 "\n",
 -                      s->admasysaddr);
 +            trace_sdhci_adma("interrupt", s->admasysaddr);
              if (s->norintstsen & SDHC_NISEN_DMA) {
                  s->norintsts |= SDHC_NIS_DMA;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
          /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
          if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                      (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
 -            DPRINT_L2("ADMA transfer completed\n");
 +            trace_sdhci_adma_transfer_completed();
              if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
                  (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                  s->blkcnt != 0)) {
 -                ERRPRINT("SD/MMC host ADMA length mismatch\n");
 +                trace_sdhci_error("SD/MMC host ADMA length mismatch");
                  s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
                          SDHC_ADMAERR_STATE_ST_TFR;
                  if (s->errintstsen & SDHC_EISEN_ADMAERR) {
 -                    ERRPRINT("Set ADMA error flag\n");
 +                    trace_sdhci_error("Set ADMA error flag");
                      s->errintsts |= SDHC_EIS_ADMAERR;
                      s->norintsts |= SDHC_NIS_ERR;
                  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
              break;
          case SDHC_CTRL_ADMA1_32:
              if (!(s->capareg & SDHC_CAN_DO_ADMA1)) {
 -                ERRPRINT("ADMA1 not supported\n");
 +                trace_sdhci_error("ADMA1 not supported");
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
              break;
          case SDHC_CTRL_ADMA2_32:
              if (!(s->capareg & SDHC_CAN_DO_ADMA2)) {
 -                ERRPRINT("ADMA2 not supported\n");
 +                trace_sdhci_error("ADMA2 not supported");
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
          case SDHC_CTRL_ADMA2_64:
              if (!(s->capareg & SDHC_CAN_DO_ADMA2) ||
                      !(s->capareg & SDHC_64_BIT_BUS_SUPPORT)) {
 -                ERRPRINT("64 bit ADMA not supported\n");
 +                trace_sdhci_error("64 bit ADMA not supported");
                  break;
              }
              sdhci_do_adma(s);
              break;
          default:
 -            ERRPRINT("Unsupported DMA type\n");
 +            trace_sdhci_error("Unsupported DMA type");
              break;
          }
      } else {
@@ -XXX,XX +XXX,XX @@ static inline bool
  sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
  {
      if ((s->data_count & 0x3) != byte_num) {
 -        ERRPRINT("Non-sequential access to Buffer Data Port register"
 -                "is prohibited\n");
 +        trace_sdhci_error("Non-sequential access to Buffer Data Port register"
 +                          "is prohibited\n");
          return false;
      }
+-    n <<= 3;
+-    tmp = tcg_temp_new_i32();
+-    if (a->op) {
+-        read_neon_element32(tmp, a->vd, 0, MO_32);
+-    } else {
+-        tcg_gen_movi_i32(tmp, 0);
+-    }
+-    tmp2 = tcg_temp_new_i32();
+-    read_neon_element32(tmp2, a->vm, 0, MO_32);
+-    ptr1 = vfp_reg_ptr(true, a->vn);
+-    tmp4 = tcg_const_i32(n);
+-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
++    desc = tcg_const_i32((a->vn << 2) | a->len);
++    def = tcg_temp_new_i64();
+     if (a->op) {
+-        read_neon_element32(tmp, a->vd, 1, MO_32);
++        read_neon_element64(def, a->vd, 0, MO_64);
+     } else {
+-        tcg_gen_movi_i32(tmp, 0);
++        tcg_gen_movi_i64(def, 0);
+     }
+-    tmp3 = tcg_temp_new_i32();
+-    read_neon_element32(tmp3, a->vm, 1, MO_32);
+-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
+-    tcg_temp_free_i32(tmp);
+-    tcg_temp_free_i32(tmp4);
+-    tcg_temp_free_ptr(ptr1);
++    val = tcg_temp_new_i64();
++    read_neon_element64(val, a->vm, 0, MO_64);
+-    write_neon_element32(tmp2, a->vd, 0, MO_32);
+-    write_neon_element32(tmp3, a->vd, 1, MO_32);
+-    tcg_temp_free_i32(tmp2);
+-    tcg_temp_free_i32(tmp3);
++    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
++    write_neon_element64(val, a->vd, 0, MO_64);
++
++    tcg_temp_free_i64(def);
++    tcg_temp_free_i64(val);
++    tcg_temp_free_i32(desc);
      return true;
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-     case  SDHC_BDATA:
-         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
-             ret = sdhci_read_dataport(s, size);
--            DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset,
--                      ret, ret);
-+            trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
-             return ret;
-         }
-         break;
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-     ret >>= (offset & 0x3) * 8;
-     ret &= (1ULL << (size * 8)) - 1;
--    DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset, ret, ret);
-+    trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
-     return ret;
  }
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-                       "not implemented\n", size, offset, value >> shift);
-         break;
-     }
--    DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
--              size, (int)offset, value >> shift, value >> shift);
-+    trace_sdhci_access("wr", size << 3, offset, "<-",
-+                       value >> shift, value >> shift);
- }
- static const MemoryRegionOps sdhci_mmio_ops = {
-diff --git a/hw/sd/trace-events b/hw/sd/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/trace-events
-+++ b/hw/sd/trace-events
-@@ -XXX,XX +XXX,XX @@
- # See docs/devel/tracing.txt for syntax documentation.
-+# hw/sd/sdhci.c
-+sdhci_set_inserted(const char *level) "card state changed: %s"
-+sdhci_send_command(uint8_t cmd, uint32_t arg) "CMD%02u ARG[0x%08x]"
-+sdhci_error(const char *msg) "%s"
-+sdhci_response4(uint32_t r0) "RSPREG[31..0]=0x%08x"
-+sdhci_response16(uint32_t r3, uint32_t r2, uint32_t r1, uint32_t r0) "RSPREG[127..96]=0x%08x, RSPREG[95..64]=0x%08x, RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x"
-+sdhci_end_transfer(uint8_t cmd, uint32_t arg) "Automatically issue CMD%02u 0x%08x"
-+sdhci_adma(const char *desc, uint32_t sysad) "%s: admasysaddr=0x%" PRIx32
-+sdhci_adma_loop(uint64_t addr, uint16_t length, uint8_t attr) "addr=0x%08" PRIx64 ", len=%d, attr=0x%x"
-+sdhci_adma_transfer_completed(void) ""
-+sdhci_access(const char *access, unsigned int size, uint64_t offset, const char *dir, uint64_t val, uint64_t val2) "%s%u: addr[0x%04" PRIx64 "] %s 0x%08" PRIx64 " (%" PRIu64 ")"
-+sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read from input buffer"
-+sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
-+
- # hw/sd/milkymist-memcard.c
- milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
- milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 17/24] sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We can use one MPC per SRAM bank, but we currently only wire the
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
-Message-id: 20180115182436.2066-8-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 7 ++++---
+ hw/arm/armsse.c | 3 ++-
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/arm/armsse.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-         ret = (SD_HOST_SPECv2_VERS << 16) | sdhci_slotint(s);
+                                         qdev_get_gpio_in(dev_splitter, 0));
-         break;
+             qdev_connect_gpio_out(dev_splitter, 0,
-     default:
+                                   qdev_get_gpio_in_named(dev_secctl,
--        ERRPRINT("bad %ub read: addr[0x%04x]\n", size, (int)offset);
+-                                                         "mpc_status", 0));
-+        qemu_log_mask(LOG_UNIMP, "SDHC rd_%ub @0x%02" HWADDR_PRIx " "
++                                                         "mpc_status",
-+                      "not implemented\n", size, offset);
++                                                         i - IOTS_NUM_EXP_MPC));
-         break;
+         }
-     }
+         qdev_connect_gpio_out(dev_splitter, 1,
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
          sdhci_update_irq(s);
          break;
      default:
 -        ERRPRINT("bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n",
 -                 size, (int)offset, value >> shift, value >> shift);
 +        qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
 +                      "not implemented\n", size, offset, value >> shift);
          break;
      }
      DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/24] sdhci: clean up includes
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The system configuration controller (SYSCFG) doesn't have
+any output IRQ (and the INTC input #71 belongs to the UART6).
+Remove the invalid code.
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
-Message-id: 20180115182436.2066-2-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci-internal.h | 4 ----
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
- include/hw/sd/sdhci.h  | 7 ++++++-
+ hw/arm/stm32f205_soc.c             | 1 -
- hw/sd/sdhci.c          | 1 +
+ hw/misc/stm32f2xx_syscfg.c         | 2 --
-files changed, 7 insertions(+), 5 deletions(-)
+files changed, 5 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/hw/sd/sdhci-internal.h
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
- #ifndef SDHCI_INTERNAL_H
+     uint32_t syscfg_exticr3;
- #define SDHCI_INTERNAL_H
+     uint32_t syscfg_exticr4;
+     uint32_t syscfg_cmpcr;
 -#include "hw/sd/sdhci.h"
 -
- /* R/W SDMA System Address register 0x0 */
+-    qemu_irq irq;
  #define SDHC_SYSAD                     0x00
@@ -XXX,XX +XXX,XX @@ enum {
      sdhc_gap_write  = 2   /* SDHC stopped at block gap during write operation */
  };
--extern const VMStateDescription sdhci_vmstate;
+ #endif /* HW_STM32F2XX_SYSCFG_H */
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f205_soc.c
 +++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
      }
      busdev = SYS_BUS_DEVICE(dev);
      sysbus_mmio_map(busdev, 0, 0x40013800);
 -    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
      /* Attach UART (uses USART registers) and USART controllers */
      for (i = 0; i < STM_NUM_USARTS; i++) {
 diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32f2xx_syscfg.c
 +++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
  {
      STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 -    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 -
- #endif
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
-index XXXXXXX..XXXXXXX 100644
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 --- a/include/hw/sd/sdhci.h
 +++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@
  #define SDHCI_H
  #include "qemu-common.h"
 -#include "hw/block/block.h"
  #include "hw/pci/pci.h"
  #include "hw/sysbus.h"
  #include "hw/sd/sd.h"
  /* SD/MMC host controller state */
  typedef struct SDHCIState {
 +    /*< private >*/
      union {
          PCIDevice pcidev;
          SysBusDevice busdev;
      };
 +
 +    /*< public >*/
      SDBus sdbus;
      MemoryRegion iomem;
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
      qemu_irq ro_cb;
      qemu_irq irq;
 +    /* Registers cleared on reset */
      uint32_t sdmasysad;    /* SDMA System Address register */
      uint16_t blksize;      /* Host DMA Buff Boundary and Transfer BlkSize Reg */
      uint16_t blkcnt;       /* Blocks count for current transfer */
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
      uint16_t acmd12errsts; /* Auto CMD12 error status register */
      uint64_t admasysaddr;  /* ADMA System Address Register */
 +    /* Read-only registers */
      uint32_t capareg;      /* Capabilities Register */
      uint32_t maxcurr;      /* Maximum Current Capabilities Register */
 +
      uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
      uint32_t buf_maxsz;
      uint16_t data_count;   /* current element in FIFO buffer */
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/dma.h"
  #include "qemu/timer.h"
  #include "qemu/bitops.h"
 +#include "hw/sd/sdhci.h"
  #include "sdhci-internal.h"
  #include "qemu/log.h"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/24] sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Now both inherited classes appear as DEVICE_CATEGORY_STORAGE.
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
 OMAP2 chip support") takes care of creating the 3 UARTs.
 Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
 extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20201107193403.436146-4-f4bug@amsat.org
-Message-id: 20180115182436.2066-5-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 18 +++++++++++++-----
+ hw/arm/nseries.c | 11 -----------
-file changed, 13 insertions(+), 5 deletions(-)
+file changed, 11 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/arm/nseries.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
-     },
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
  };
 +static void sdhci_common_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 +    dc->vmsd = &sdhci_vmstate;
 +    dc->reset = sdhci_poweron_reset;
 +}
 +
  /* --- qdev PCI --- */
  static Property sdhci_pci_properties[] = {
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_class_init(ObjectClass *klass, void *data)
      k->vendor_id = PCI_VENDOR_ID_REDHAT;
      k->device_id = PCI_DEVICE_ID_REDHAT_SDHCI;
      k->class_id = PCI_CLASS_SYSTEM_SDHCI;
 -    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->vmsd = &sdhci_vmstate;
      dc->props = sdhci_pci_properties;
 -    dc->reset = sdhci_poweron_reset;
 +
 +    sdhci_common_class_init(klass, data);
  }
- static const TypeInfo sdhci_pci_info = {
+-static void n8x0_uart_setup(struct n800_s *s)
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
+-{
 -    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
 -    /*
 -     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
 -     * here, but this code has been removed with the bluetooth backend.
 -     */
 -    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -}
 -
  static void n8x0_usb_setup(struct n800_s *s)
  {
-     DeviceClass *dc = DEVICE_CLASS(klass);
+     SysBusDevice *dev;
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
--    dc->vmsd = &sdhci_vmstate;
+     n8x0_spi_setup(s);
-     dc->props = sdhci_sysbus_properties;
+     n8x0_dss_setup(s);
-     dc->realize = sdhci_sysbus_realize;
+     n8x0_cbus_setup(s);
--    dc->reset = sdhci_poweron_reset;
+-    n8x0_uart_setup(s);
-+
+     if (machine_usb(machine)) {
-+    sdhci_common_class_init(klass, data);
+         n8x0_usb_setup(s);
- }
+     }
  static const TypeInfo sdhci_sysbus_info = {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/24] sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The MusicPal board code connects both of the IRQ outputs of the UART
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
+to the same input is not valid as it produces subtly wrong behaviour
+(for instance if both the IRQ lines are high, and then one goes
+low, the INTC input will see this as a high-to-low transition
+even though the second IRQ line should still be holding it high).
+This kind of wiring needs an explicitly created OR gate; add one.
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
-Message-id: 20180115182436.2066-7-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 22 ++++++++++++++++++++++
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 22 insertions(+)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/arm/musicpal.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/arm/musicpal.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/bitops.h"
+ #include "ui/console.h"
- #include "hw/sd/sdhci.h"
+ #include "hw/i2c/i2c.h"
- #include "sdhci-internal.h"
+ #include "hw/irq.h"
-+#include "qapi/error.h"
++#include "hw/or-irq.h"
- #include "qemu/log.h"
+ #include "hw/audio/wm8750.h"
+ #include "sysemu/block-backend.h"
- /* host controller debug messages */
+ #include "sysemu/runstate.h"
-@@ -XXX,XX +XXX,XX @@ static void sdhci_common_realize(SDHCIState *s, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-                           SDHC_REGISTERS_MAP_SIZE);
+ #define MP_TIMER4_IRQ           7
- }
+ #define MP_EHCI_IRQ             8
+ #define MP_ETH_IRQ              9
-+static void sdhci_common_unrealize(SDHCIState *s, Error **errp)
+-#define MP_UART1_IRQ            11
-+{
+-#define MP_UART2_IRQ            11
-+    /* This function is expected to be called only once for each class:
++#define MP_UART_SHARED_IRQ      11
-+     * - SysBus:    via DeviceClass->unrealize(),
+ #define MP_GPIO_IRQ             12
-+     * - PCI:       via PCIDeviceClass->exit().
+ #define MP_RTC_IRQ              28
-+     * However to avoid double-free and/or use-after-free we still nullify
+ #define MP_AUDIO_IRQ            30
-+     * this variable (better safe than sorry!). */
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+    g_free(s->fifo_buffer);
+     ARMCPU *cpu;
-+    s->fifo_buffer = NULL;
+     qemu_irq pic[32];
-+}
+     DeviceState *dev;
 +    DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
- static bool sdhci_pending_insert_vmstate_needed(void *opaque)
++    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
- {
++                   qdev_get_gpio_in(uart_orgate, 0),
-     SDHCIState *s = opaque;
+                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
+-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
- static void sdhci_pci_exit(PCIDevice *dev)
++    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
- {
++                   qdev_get_gpio_in(uart_orgate, 1),
-     SDHCIState *s = PCI_SDHCI(dev);
+                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-+
-+    sdhci_common_unrealize(s, &error_abort);
+     /* Register flash */
-     sdhci_uninitfn(s);
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
- }
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
++++ b/hw/arm/Kconfig
-     sysbus_init_mmio(sbd, &s->iomem);
+@@ -XXX,XX +XXX,XX @@ config MUSCA
- }
+ config MUSICPAL
-+static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
+     bool
-+{
++    select OR_IRQ
-+    SDHCIState *s = SYSBUS_SDHCI(dev);
+     select BITBANG_I2C
-+
+     select MARVELL_88W8618
-+    sdhci_common_unrealize(s, &error_abort);
+     select PTIMER
 +}
 +
  static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      dc->props = sdhci_sysbus_properties;
      dc->realize = sdhci_sysbus_realize;
 +    dc->unrealize = sdhci_sysbus_unrealize;
      sdhci_common_class_init(klass, data);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 21/24] sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-running qtests:
+We don't need to fill the full pic[] array if we only use
+few of the interrupt lines. Directly call qdev_get_gpio_in()
-  $ make check-qtest-arm
+when necessary.
     GTESTER check-qtest-arm
   SDHC rd_4b @0x44 not implemented
   SDHC wr_4b @0x40 <- 0x89abcdef not implemented
   SDHC wr_4b @0x44 <- 0x01234567 not implemented
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Message-id: 20180115182436.2066-12-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h |  4 ++--
+ hw/arm/musicpal.c | 25 +++++++++++++------------
- hw/sd/sdhci.c         | 23 +++++++++++++++++++----
+file changed, 13 insertions(+), 12 deletions(-)
 files changed, 21 insertions(+), 6 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/hw/arm/musicpal.c
-+++ b/include/hw/sd/sdhci.h
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-     uint64_t admasysaddr;  /* ADMA System Address Register */
+ static void musicpal_init(MachineState *machine)
      /* Read-only registers */
 -    uint32_t capareg;      /* Capabilities Register */
 -    uint32_t maxcurr;      /* Maximum Current Capabilities Register */
 +    uint64_t capareg;      /* Capabilities Register */
 +    uint64_t maxcurr;      /* Maximum Current Capabilities Register */
      uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
      uint32_t buf_maxsz;
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
          ret = s->acmd12errsts;
          break;
      case SDHC_CAPAB:
 -        ret = s->capareg;
 +        ret = (uint32_t)s->capareg;
 +        break;
 +    case SDHC_CAPAB + 4:
 +        ret = (uint32_t)(s->capareg >> 32);
          break;
      case SDHC_MAXCURR:
 -        ret = s->maxcurr;
 +        ret = (uint32_t)s->maxcurr;
 +        break;
 +    case SDHC_MAXCURR + 4:
 +        ret = (uint32_t)(s->maxcurr >> 32);
          break;
      case SDHC_ADMAERR:
          ret =  s->admaerr;
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
          }
          sdhci_update_irq(s);
          break;
 +
 +    case SDHC_CAPAB:
 +    case SDHC_CAPAB + 4:
 +    case SDHC_MAXCURR:
 +    case SDHC_MAXCURR + 4:
 +        qemu_log_mask(LOG_GUEST_ERROR, "SDHC wr_%ub @0x%02" HWADDR_PRIx
 +                      " <- 0x%08x read-only\n", size, offset, value >> shift);
 +        break;
 +
      default:
          qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
                        "not implemented\n", size, offset, value >> shift);
@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
  #define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
      /* Capabilities registers provide information on supported features
       * of this specific host controller implementation */ \
 -    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
 -    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
 +    DEFINE_PROP_UINT64("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
 +    DEFINE_PROP_UINT64("maxcurr", _state, maxcurr, 0)
  static void sdhci_initfn(SDHCIState *s)
  {
+     ARMCPU *cpu;
+-    qemu_irq pic[32];
+     DeviceState *dev;
++    DeviceState *pic;
+     DeviceState *uart_orgate;
+     DeviceState *i2c_dev;
+     DeviceState *lcd_dev;
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+                            &error_fatal);
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
+-    for (i = 0; i < 32; i++) {
+-        pic[i] = qdev_get_gpio_in(dev, i);
+-    }
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
+-                          pic[MP_TIMER4_IRQ], NULL);
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
+     /* Logically OR both UART IRQs together */
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                    qdev_get_gpio_in(uart_orgate, 0),
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+                              OBJECT(get_system_memory()), &error_fatal);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
+-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
++                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
+     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
+     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
+     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
+-                               pic[MP_GPIO_IRQ]);
++                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
+     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
+     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+                              NULL);
+     sysbus_realize_and_unref(s, &error_fatal);
+     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
+-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
++    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
+     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
+     arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/24] get_phys_addr_pmsav7: Support AP=0b111 for v7M
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
-For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111
+The nseries machines have a codepath that allows them to load a
-is an UNPREDICTABLE reserved combination. However, for v7M
+secondary bootloader.  This code wasn't checking that the
-this value is documented as having the same behaviour as 0b110:
+load_image_targphys() succeeded.  Check the return value and report
-read-only for both privileged and unprivileged. Accept this
+the error to the user.
 value on an M profile core rather than treating it as a guest
 error and a no-access page.
-Reported-by: Andy Gross <andy.gross@linaro.org>
+While we're in the vicinity, fix the comment style of the
 comment documenting what this image load is doing.
 Fixes: Coverity CID 1192904
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1512742402-31669-1-git-send-email-peter.maydell@linaro.org
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 14 ++++++++++++++
+ hw/arm/nseries.c | 15 +++++++++++----
-file changed, 14 insertions(+)
+file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/nseries.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-                 case 6:
+         /* No, wait, better start at the ROM.  */
-                     *prot |= PAGE_READ | PAGE_EXEC;
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
-                     break;
-+                case 7:
+-        /* This is intended for loading the `secondary.bin' program from
-+                    /* for v7M, same as 6; for R profile a reserved value */
++        /*
-+                    if (arm_feature(env, ARM_FEATURE_M)) {
++         * This is intended for loading the `secondary.bin' program from
-+                        *prot |= PAGE_READ | PAGE_EXEC;
+          * Nokia images (the NOLO bootloader).  The entry point seems
-+                        break;
+          * to be at OMAP2_Q2_BASE + 0x400000.
-+                    }
+          *
-+                    /* fall through */
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-                 default:
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
-                     qemu_log_mask(LOG_GUEST_ERROR,
+          *
-                                   "DRACR[%d]: Bad value for AP bits: 0x%"
+          * The code above is for loading the `zImage' file from Nokia
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+-         * images.  */
-                 case 6:
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                     *prot |= PAGE_READ | PAGE_EXEC;
+-                            machine->ram_size - 0x400000);
-                     break;
++         * images.
-+                case 7:
++         */
-+                    /* for v7M, same as 6; for R profile a reserved value */
++        if (load_image_targphys(option_rom[0].name,
-+                    if (arm_feature(env, ARM_FEATURE_M)) {
++                                OMAP2_Q2_BASE + 0x400000,
-+                        *prot |= PAGE_READ | PAGE_EXEC;
++                                machine->ram_size - 0x400000) < 0) {
-+                        break;
++            error_report("Failed to load secondary bootloader %s",
-+                    }
++                         option_rom[0].name);
-+                    /* fall through */
++            exit(EXIT_FAILURE);
-                 default:
++        }
-                     qemu_log_mask(LOG_GUEST_ERROR,
-                                   "DRACR[%d]: Bad value for AP bits: 0x%"
+         n800_setup_nolo_tags(nolo_tags);
          cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 15/24] sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+plus one. Currently, it's counting the number of times these transitions
-Message-id: 20180115182436.2066-6-f4bug@amsat.org
+do _not_ happen, plus one.
 Source:
 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
 section 2.3.4 point (3).
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 30 +++++++++++++++++++++---------
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
-file changed, 21 insertions(+), 9 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/hw/sd/sdhci.c
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
-     s->fifo_buffer = NULL;
+     pi = (double)nr_ones / nr_bits;
- }
+     for (k = 0; k < nr_bits - 1; k++) {
-+static void sdhci_common_realize(SDHCIState *s, Error **errp)
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+{
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
-+    s->buf_maxsz = sdhci_get_fifolen(s);
+     }
-+    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+     vn_obs += 1;
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
 +                          SDHC_REGISTERS_MAP_SIZE);
 +}
 +
  static bool sdhci_pending_insert_vmstate_needed(void *opaque)
  {
      SDHCIState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static Property sdhci_pci_properties[] = {
  static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
  {
      SDHCIState *s = PCI_SDHCI(dev);
 +
 +    sdhci_initfn(s);
 +    sdhci_common_realize(s, errp);
 +    if (errp && *errp) {
 +        return;
 +    }
 +
      dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
      dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
 -    sdhci_initfn(s);
 -    s->buf_maxsz = sdhci_get_fifolen(s);
 -    s->fifo_buffer = g_malloc0(s->buf_maxsz);
      s->irq = pci_allocate_irq(dev);
 -    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
 -            SDHC_REGISTERS_MAP_SIZE);
      pci_register_bar(dev, 0, 0, &s->iomem);
  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
      SDHCIState *s = SYSBUS_SDHCI(dev);
      SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 -    s->buf_maxsz = sdhci_get_fifolen(s);
 -    s->fifo_buffer = g_malloc0(s->buf_maxsz);
 +    sdhci_common_realize(s, errp);
 +    if (errp && *errp) {
 +        return;
 +    }
 +
      sysbus_init_irq(sbd, &s->irq);
 -    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
 -            SDHC_REGISTERS_MAP_SIZE);
      sysbus_init_mmio(sbd, &s->iomem);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/24] hw/arm/virt: Add virt-2.12 machine type
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-Add virt-2.12 machine type.
+Checks for UNDEF cases should go before the "is VFP enabled?" access
 check, except in special cases. Move a stray UNDEF check in the VTBL
 trans function up above the access check.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 19 +++++++++++++++++--
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 17 insertions(+), 2 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/arm/translate-neon.c.inc
-+++ b/hw/arm/virt.c
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- }
+         return false;
- type_init(machvirt_machine_init);
+     }
--static void virt_2_11_instance_init(Object *obj)
+-    if (!vfp_access_check(s)) {
-+static void virt_2_12_instance_init(Object *obj)
+-        return true;
- {
+-    }
-     VirtMachineState *vms = VIRT_MACHINE(obj);
+-
-     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+     if ((a->vn + a->len + 1) > 32) {
-@@ -XXX,XX +XXX,XX @@ static void virt_2_11_instance_init(Object *obj)
+         /*
-     vms->irqmap = a15irqmap;
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
- }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+         return false;
-+static void virt_machine_2_12_options(MachineClass *mc)
+     }
-+{
-+}
++    if (!vfp_access_check(s)) {
-+DEFINE_VIRT_MACHINE_AS_LATEST(2, 12)
++        return true;
 +    }
 +
-+#define VIRT_COMPAT_2_11 \
+     desc = tcg_const_i32((a->vn << 2) | a->len);
-+    HW_COMPAT_2_11
+     def = tcg_temp_new_i64();
-+
+     if (a->op) {
 +static void virt_2_11_instance_init(Object *obj)
 +{
 +    virt_2_12_instance_init(obj);
 +}
 +
  static void virt_machine_2_11_options(MachineClass *mc)
  {
 +    virt_machine_2_12_options(mc);
 +    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_11);
  }
 -DEFINE_VIRT_MACHINE_AS_LATEST(2, 11)
 +DEFINE_VIRT_MACHINE(2, 11)
  #define VIRT_COMPAT_2_10 \
      HW_COMPAT_2_10
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/24] hw/sd/pl181: Reset SD card on controller reset
+Deleted patch
-Since pl181 is still using the legacy SD card API, the SD
-card created by sd_init() is not plugged into any bus. This
-means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-Cc: qemu-stable@nongnu.org
-Fixes: https://bugs.launchpad.net/qemu/+bug/1739378
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-2-git-send-email-peter.maydell@linaro.org
----
- hw/sd/pl181.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/pl181.c
-+++ b/hw/sd/pl181.c
-@@ -XXX,XX +XXX,XX @@ static void pl181_reset(DeviceState *d)
-     /* We can assume our GPIO outputs have been wired up now */
-     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->card));
- }
- static void pl181_init(Object *obj)
---
-.7.4

-[Qemu-devel] [PULL 06/24] hw/sd/milkymist-memcard: Reset SD card on controller reset
+Deleted patch
-Since milkymist-memcard is still using the legacy SD card API,
-the SD card created by sd_init() is not plugged into any bus.
-This means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-3-git-send-email-peter.maydell@linaro.org
----
- hw/sd/milkymist-memcard.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/milkymist-memcard.c
-+++ b/hw/sd/milkymist-memcard.c
-@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
-     for (i = 0; i < R_MAX; i++) {
-         s->regs[i] = 0;
-     }
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->card));
- }
- static int milkymist_memcard_init(SysBusDevice *dev)
---
-.7.4

-[Qemu-devel] [PULL 07/24] hw/sd/ssi-sd: Reset SD card on controller reset
+Deleted patch
-Since ssi-sd is still using the legacy SD card API, the SD
-card created by sd_init() is not plugged into any bus. This
-means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-In the case of sd-ssi, we have to implement an entire
-reset function since there wasn't one previously, and
-that requires a QOM cast macro that got omitted when this
-device was QOMified.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-4-git-send-email-peter.maydell@linaro.org
----
- hw/sd/ssi-sd.c | 25 +++++++++++++++++++++++--
-file changed, 23 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/ssi-sd.c
-+++ b/hw/sd/ssi-sd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     SDState *sd;
- } ssi_sd_state;
-+#define TYPE_SSI_SD "ssi-sd"
-+#define SSI_SD(obj) OBJECT_CHECK(ssi_sd_state, (obj), TYPE_SSI_SD)
-+
- /* State word bits.  */
- #define SSI_SDR_LOCKED          0x0001
- #define SSI_SDR_WP_ERASE        0x0002
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
-     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
-     DriveInfo *dinfo;
--    s->mode = SSI_SD_CMD;
-     /* FIXME use a qdev drive property instead of drive_get_next() */
-     dinfo = drive_get_next(IF_SD);
-     s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
-     }
- }
-+static void ssi_sd_reset(DeviceState *dev)
-+{
-+    ssi_sd_state *s = SSI_SD(dev);
-+
-+    s->mode = SSI_SD_CMD;
-+    s->cmd = 0;
-+    memset(s->cmdarg, 0, sizeof(s->cmdarg));
-+    memset(s->response, 0, sizeof(s->response));
-+    s->arglen = 0;
-+    s->response_pos = 0;
-+    s->stopping = 0;
-+
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->sd));
-+}
-+
- static void ssi_sd_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_class_init(ObjectClass *klass, void *data)
-     k->transfer = ssi_sd_transfer;
-     k->cs_polarity = SSI_CS_LOW;
-     dc->vmsd = &vmstate_ssi_sd;
-+    dc->reset = ssi_sd_reset;
- }
- static const TypeInfo ssi_sd_info = {
--    .name          = "ssi-sd",
-+    .name          = TYPE_SSI_SD,
-     .parent        = TYPE_SSI_SLAVE,
-     .instance_size = sizeof(ssi_sd_state),
-     .class_init    = ssi_sd_class_init,
---
-.7.4

-[Qemu-devel] [PULL 08/24] hw/sd/omap_mmc: Reset SD card on controller reset
+Deleted patch
-Since omap_mmc is still using the legacy SD card API, the SD
-card created by sd_init() is not plugged into any bus. This
-means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but would mean that
-migration fails because it's only in sd_reset() that we
-set up the wpgrps_size field.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-5-git-send-email-peter.maydell@linaro.org
----
- hw/sd/omap_mmc.c | 14 ++++++++++----
-file changed, 10 insertions(+), 4 deletions(-)
-diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/omap_mmc.c
-+++ b/hw/sd/omap_mmc.c
-@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
-     host->cdet_enable = 0;
-     qemu_set_irq(host->coverswitch, host->cdet_state);
-     host->clkdiv = 0;
-+
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually. When omap_mmc is
-+     * QOMified this must move into the QOM reset function.
-+     */
-+    device_reset(DEVICE(host->card));
- }
- static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
-     s->lines = 1;    /* TODO: needs to be settable per-board */
-     s->rev = 1;
--    omap_mmc_reset(s);
--
-     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
-     memory_region_add_subregion(sysmem, base, &s->iomem);
-@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
-         exit(1);
-     }
-+    omap_mmc_reset(s);
-+
-     return s;
- }
-@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
-     s->lines = 4;
-     s->rev = 2;
--    omap_mmc_reset(s);
--
-     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
-                           omap_l4_region_size(ta, 0));
-     omap_l4_attach(ta, 0, &s->iomem);
-@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
-     s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);
-     sd_set_cb(s->card, NULL, s->cdet);
-+    omap_mmc_reset(s);
-+
-     return s;
- }
---
-.7.4

-[Qemu-devel] [PULL 09/24] target/arm: Split out vfp_expand_imm
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180110063337.21538-2-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 44 ++++++++++++++++++++++++++++----------------
-file changed, 28 insertions(+), 16 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
-     }
- }
-+/* The imm8 encodes the sign bit, enough bits to represent an exponent in
-+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
-+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
-+ */
-+static uint64_t vfp_expand_imm(int size, uint8_t imm8)
-+{
-+    uint64_t imm;
-+
-+    switch (size) {
-+    case MO_64:
-+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-+            extract32(imm8, 0, 6);
-+        imm <<= 48;
-+        break;
-+    case MO_32:
-+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-+            (extract32(imm8, 0, 6) << 3);
-+        imm <<= 16;
-+        break;
-+    default:
-+        g_assert_not_reached();
-+    }
-+    return imm;
-+}
-+
- /* Floating point immediate
-  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
-  * +---+---+---+-----------+------+---+------------+-------+------+------+
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-         return;
-     }
--    /* The imm8 encodes the sign bit, enough bits to represent
--     * an exponent in the range 01....1xx to 10....0xx,
--     * and the most significant 4 bits of the mantissa; see
--     * VFPExpandImm() in the v8 ARM ARM.
--     */
--    if (is_double) {
--        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
--            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
--            extract32(imm8, 0, 6);
--        imm <<= 48;
--    } else {
--        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
--            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
--            (extract32(imm8, 0, 6) << 3);
--        imm <<= 16;
--    }
-+    imm = vfp_expand_imm(MO_32 + is_double, imm8);
-     tcg_res = tcg_const_i64(imm);
-     write_fp_dreg(s, rd, tcg_res);
---
-.7.4

-[Qemu-devel] [PULL 12/24] sdhci: remove dead code
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-3-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/sd/sdhci.h | 2 --
- hw/sd/sdhci.c         | 2 --
-files changed, 4 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
-     QEMUTimer *transfer_timer;
--    qemu_irq eject_cb;
--    qemu_irq ro_cb;
-     qemu_irq irq;
-     /* Registers cleared on reset */
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
-     timer_free(s->insert_timer);
-     timer_del(s->transfer_timer);
-     timer_free(s->transfer_timer);
--    qemu_free_irq(s->eject_cb);
--    qemu_free_irq(s->ro_cb);
-     g_free(s->fifo_buffer);
-     s->fifo_buffer = NULL;
---
-.7.4

-[Qemu-devel] [PULL 13/24] sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Add common/sysbus/pci/sdbus comments to have clearer code blocks separation.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180115182436.2066-4-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/sd/sdhci.h |  4 +++-
- hw/sd/sdhci.c         | 25 +++++++++++++++++--------
-files changed, 20 insertions(+), 9 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     uint32_t buf_maxsz;
-     uint16_t data_count;   /* current element in FIFO buffer */
-     uint8_t  stopped_state;/* Current SDHC state */
--    bool     pending_insert_quirk;/* Quirk for Raspberry Pi card insert int */
-     bool     pending_insert_state;
-     /* Buffer Data Port Register - virtual access point to R and W buffers */
-     /* Software Reset Register - always reads as 0 */
-     /* Force Event Auto CMD12 Error Interrupt Reg - write only */
-     /* Force Event Error Interrupt Register- write only */
-     /* RO Host Controller Version Register always reads as 0x2401 */
-+
-+    /* Configurable properties */
-+    bool pending_insert_quirk; /* Quirk for Raspberry Pi card insert int */
- } SDHCIState;
- #define TYPE_PCI_SDHCI "sdhci-pci"
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qapi/error.h"
- #include "hw/hw.h"
- #include "sysemu/block-backend.h"
- #include "sysemu/blockdev.h"
-@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
-     }
- }
-+/* --- qdev common --- */
-+
-+#define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
-+    /* Capabilities registers provide information on supported features
-+     * of this specific host controller implementation */ \
-+    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
-+    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
-+
- static void sdhci_initfn(SDHCIState *s)
- {
-     qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
-     },
- };
--/* Capabilities registers provide information on supported features of this
-- * specific host controller implementation */
-+/* --- qdev PCI --- */
-+
- static Property sdhci_pci_properties[] = {
--    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
--            SDHC_CAPAB_REG_DEFAULT),
--    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
-+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
-     DEFINE_PROP_END_OF_LIST(),
- };
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_pci_info = {
-     },
- };
-+/* --- qdev SysBus --- */
-+
- static Property sdhci_sysbus_properties[] = {
--    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
--            SDHC_CAPAB_REG_DEFAULT),
--    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
-+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
-     DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
-                      false),
-     DEFINE_PROP_END_OF_LIST(),
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_sysbus_info = {
-     .class_init = sdhci_sysbus_class_init,
- };
-+/* --- qdev bus master --- */
-+
- static void sdhci_bus_class_init(ObjectClass *klass, void *data)
- {
-     SDBusClass *sbc = SD_BUS_CLASS(klass);
---
-.7.4

More arm patches (mostly the SDHCI ones from Philippe)

thanks
-- PMM

The following changes since commit f521eeee3bd060b460c99e605472b7e03967db43:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20180115' into staging (2018-01-15 13:17:47 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180116

for you to fetch changes up to 60765b6ceeb4998a0d4220b3a53f1f185061da77:

sdhci: add a 'dma' property to the sysbus devices (2018-01-16 13:28:21 +0000)

----------------------------------------------------------------
target-arm queue:
 * SDHCI: cleanups and minor bug fixes
 * target/arm: minor refactor preparatory to fp16 support
 * omap_ssd, ssi-sd, pl181, milkymist-memcard: reset the SD
   card on controller reset (fixes migration failures)
 * target/arm: Handle page table walk load failures correctly
 * hw/arm/virt: Add virt-2.12 machine type
 * get_phys_addr_pmsav7: Support AP=0b111 for v7M
 * hw/intc/armv7m: Support byte and halfword accesses to CFSR

----------------------------------------------------------------
Andrey Smirnov (1):
      sdhci: Implement write method of ACMD12ERRSTS register

Peter Maydell (8):
      hw/intc/armv7m: Support byte and halfword accesses to CFSR
      get_phys_addr_pmsav7: Support AP=0b111 for v7M
      hw/arm/virt: Add virt-2.12 machine type
      target/arm: Handle page table walk load failures correctly
      hw/sd/pl181: Reset SD card on controller reset
      hw/sd/milkymist-memcard: Reset SD card on controller reset
      hw/sd/ssi-sd: Reset SD card on controller reset
      hw/sd/omap_mmc: Reset SD card on controller reset

Philippe Mathieu-Daudé (13):
      sdhci: clean up includes
      sdhci: remove dead code
      sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
      sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
      sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
      sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
      sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
      sdhci: convert the DPRINT() calls into trace events
      sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
      sdhci: rename the SDHC_CAPAB register
      sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
      sdhci: fix the PCI device, using the PCI address space for DMA
      sdhci: add a 'dma' property to the sysbus devices

Richard Henderson (2):
      target/arm: Split out vfp_expand_imm
      target/arm: Add fp16 support to vfp_expand_imm

The Configurable Fault Status Register for ARMv7M and v8M is
supposed to be byte and halfword accessible, but we were only
implementing word accesses. Add support for the other access
sizes, which are used by the Zephyr RTOS.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Andy Gross <andy.gross@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1512742372-31517-1-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 38 ++++++++++++++++++++++----------------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             val |= (1 << 8);
         }
         return val;
-    case 0xd28: /* Configurable Fault Status.  */
-        /* The BFSR bits [15:8] are shared between security states
-         * and we store them in the NS copy
-         */
-        val = cpu->env.v7m.cfsr[attrs.secure];
-        val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
-        return val;
     case 0xd2c: /* Hard Fault Status.  */
         return cpu->env.v7m.hfsr;
     case 0xd30: /* Debug Fault Status.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
         nvic_irq_update(s);
         break;
-    case 0xd28: /* Configurable Fault Status.  */
-        cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
-        if (attrs.secure) {
-            /* The BFSR bits [15:8] are shared between security states
-             * and we store them in the NS copy.
-             */
-            cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
-        }
-        break;
     case 0xd2c: /* Hard Fault Status.  */
         cpu->env.v7m.hfsr &= ~value; /* W1C */
         break;
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
         }
         break;
+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+        /* The BFSR bits [15:8] are shared between security states
+         * and we store them in the NS copy
+         */
+        val = s->cpu->env.v7m.cfsr[attrs.secure];
+        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        val = extract32(val, (offset - 0xd28) * 8, size * 8);
+        break;
     case 0xfe0 ... 0xfff: /* ID.  */
         if (offset & 3) {
             val = 0;
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
         }
         nvic_irq_update(s);
         return MEMTX_OK;
+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+        /* All bits are W1C, so construct 32 bit value with 0s in
+         * the parts not written by the access size
+         */
+        value <<= ((offset - 0xd28) * 8);
+
+        s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
+        if (attrs.secure) {
+            /* The BFSR bits [15:8] are shared between security states
+             * and we store them in the NS copy.
+             */
+            s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
+        }
+        return MEMTX_OK;
     }
     if (size == 4) {
         nvic_writel(s, offset, value, attrs);
-- 
2.7.4

For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111
is an UNPREDICTABLE reserved combination. However, for v7M
this value is documented as having the same behaviour as 0b110:
read-only for both privileged and unprivileged. Accept this
value on an M profile core rather than treating it as a guest
error and a no-access page.

Reported-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1512742402-31669-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 6:
                     *prot |= PAGE_READ | PAGE_EXEC;
                     break;
+                case 7:
+                    /* for v7M, same as 6; for R profile a reserved value */
+                    if (arm_feature(env, ARM_FEATURE_M)) {
+                        *prot |= PAGE_READ | PAGE_EXEC;
+                        break;
+                    }
+                    /* fall through */
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
                                   "DRACR[%d]: Bad value for AP bits: 0x%"
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 6:
                     *prot |= PAGE_READ | PAGE_EXEC;
                     break;
+                case 7:
+                    /* for v7M, same as 6; for R profile a reserved value */
+                    if (arm_feature(env, ARM_FEATURE_M)) {
+                        *prot |= PAGE_READ | PAGE_EXEC;
+                        break;
+                    }
+                    /* fall through */
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
                                   "DRACR[%d]: Bad value for AP bits: 0x%"
-- 
2.7.4

Add virt-2.12 machine type.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-static void virt_2_11_instance_init(Object *obj)
+static void virt_2_12_instance_init(Object *obj)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
@@ -XXX,XX +XXX,XX @@ static void virt_2_11_instance_init(Object *obj)
     vms->irqmap = a15irqmap;
 }
 
+static void virt_machine_2_12_options(MachineClass *mc)
+{
+}
+DEFINE_VIRT_MACHINE_AS_LATEST(2, 12)
+
+#define VIRT_COMPAT_2_11 \
+    HW_COMPAT_2_11
+
+static void virt_2_11_instance_init(Object *obj)
+{
+    virt_2_12_instance_init(obj);
+}
+
 static void virt_machine_2_11_options(MachineClass *mc)
 {
+    virt_machine_2_12_options(mc);
+    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_11);
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(2, 11)
+DEFINE_VIRT_MACHINE(2, 11)
 
 #define VIRT_COMPAT_2_10 \
     HW_COMPAT_2_10
-- 
2.7.4

Instead of ignoring the response from address_space_ld*()
(indicating an attempt to read a page table descriptor from
an invalid physical address), use it to report the failure
correctly.

Since this is another couple of locations where we need to
decide the value of the ARMMMUFaultInfo ea bit based on a
MemTxResult, we factor out that operation into a helper
function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 39 ++++++++++++++++++++++++++++++++++-----
 target/arm/op_helper.c |  7 +------
 3 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     return fsc;
 }
 
+static inline bool arm_extabort_type(MemTxResult result)
+{
+    /* The EA bit in syndromes and fault status registers is an
+     * IMPDEF classification of external aborts. ARM implementations
+     * usually use this to indicate AXI bus Decode error (0) or
+     * Slave error (1); in QEMU we follow that.
+     */
+    return result != MEMTX_DECODE_ERROR;
+}
+
 /* Do a page table walk and add page to TLB if possible */
 bool arm_tlb_fill(CPUState *cpu, vaddr address,
                   MMUAccessType access_type, int mmu_idx,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
                                  &txattrs, &s2prot, &s2size, fi, NULL);
         if (ret) {
+            assert(fi->type != ARMFault_None);
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     MemTxAttrs attrs = {};
+    MemTxResult result = MEMTX_OK;
     AddressSpace *as;
+    uint32_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
         return 0;
     }
     if (regime_translation_big_endian(env, mmu_idx)) {
-        return address_space_ldl_be(as, addr, attrs, NULL);
+        data = address_space_ldl_be(as, addr, attrs, &result);
     } else {
-        return address_space_ldl_le(as, addr, attrs, NULL);
+        data = address_space_ldl_le(as, addr, attrs, &result);
     }
+    if (result == MEMTX_OK) {
+        return data;
+    }
+    fi->type = ARMFault_SyncExternalOnWalk;
+    fi->ea = arm_extabort_type(result);
+    return 0;
 }
 
 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     MemTxAttrs attrs = {};
+    MemTxResult result = MEMTX_OK;
     AddressSpace *as;
+    uint32_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
         return 0;
     }
     if (regime_translation_big_endian(env, mmu_idx)) {
-        return address_space_ldq_be(as, addr, attrs, NULL);
+        data = address_space_ldq_be(as, addr, attrs, &result);
     } else {
-        return address_space_ldq_le(as, addr, attrs, NULL);
+        data = address_space_ldq_le(as, addr, attrs, &result);
+    }
+    if (result == MEMTX_OK) {
+        return data;
     }
+    fi->type = ARMFault_SyncExternalOnWalk;
+    fi->ea = arm_extabort_type(result);
+    return 0;
 }
 
 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
     }
     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                        mmu_idx, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
     type = (desc & 3);
     domain = (desc >> 5) & 0x0f;
     if (regime_el(env, mmu_idx) == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
         }
         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                            mmu_idx, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
         switch (desc & 3) {
         case 0: /* Page translation fault.  */
             fi->type = ARMFault_Translation;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
     }
     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                        mmu_idx, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
     type = (desc & 3);
     if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
         /* Section translation fault, or attempt to use the encoding
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                            mmu_idx, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
         switch (desc & 3) {
         case 0: /* Page translation fault.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
         descaddr &= ~7ULL;
         nstable = extract32(tableattrs, 4, 1);
         descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
-        if (fi->s1ptw) {
+        if (fi->type != ARMFault_None) {
             goto do_fault;
         }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     /* now we have a real cpu fault */
     cpu_restore_state(cs, retaddr);
 
-    /* The EA bit in syndromes and fault status registers is an
-     * IMPDEF classification of external aborts. ARM implementations
-     * usually use this to indicate AXI bus Decode error (0) or
-     * Slave error (1); in QEMU we follow that.
-     */
-    fi.ea = (response != MEMTX_DECODE_ERROR);
+    fi.ea = arm_extabort_type(response);
     fi.type = ARMFault_SyncExternal;
     deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
 }
-- 
2.7.4

Since pl181 is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

Failing to do this mostly didn't affect the guest since the
guest typically does a programmed SD card reset as part of
its SD controller driver initialization, but meant that
migration failed because it's only in sd_reset() that we
set up the wpgrps_size field.

Cc: qemu-stable@nongnu.org
Fixes: https://bugs.launchpad.net/qemu/+bug/1739378
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-2-git-send-email-peter.maydell@linaro.org
---
 hw/sd/pl181.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -XXX,XX +XXX,XX @@ static void pl181_reset(DeviceState *d)
 
     /* We can assume our GPIO outputs have been wired up now */
     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->card));
 }
 
 static void pl181_init(Object *obj)
-- 
2.7.4

Since milkymist-memcard is still using the legacy SD card API,
the SD card created by sd_init() is not plugged into any bus.
This means that the controller has to reset it manually.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-3-git-send-email-peter.maydell@linaro.org
---
 hw/sd/milkymist-memcard.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
     for (i = 0; i < R_MAX; i++) {
         s->regs[i] = 0;
     }
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->card));
 }
 
 static int milkymist_memcard_init(SysBusDevice *dev)
-- 
2.7.4

Since ssi-sd is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

In the case of sd-ssi, we have to implement an entire
reset function since there wasn't one previously, and
that requires a QOM cast macro that got omitted when this
device was QOMified.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-4-git-send-email-peter.maydell@linaro.org
---
 hw/sd/ssi-sd.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     SDState *sd;
 } ssi_sd_state;
 
+#define TYPE_SSI_SD "ssi-sd"
+#define SSI_SD(obj) OBJECT_CHECK(ssi_sd_state, (obj), TYPE_SSI_SD)
+
 /* State word bits.  */
 #define SSI_SDR_LOCKED          0x0001
 #define SSI_SDR_WP_ERASE        0x0002
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
     DriveInfo *dinfo;
 
-    s->mode = SSI_SD_CMD;
     /* FIXME use a qdev drive property instead of drive_get_next() */
     dinfo = drive_get_next(IF_SD);
     s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
     }
 }
 
+static void ssi_sd_reset(DeviceState *dev)
+{
+    ssi_sd_state *s = SSI_SD(dev);
+
+    s->mode = SSI_SD_CMD;
+    s->cmd = 0;
+    memset(s->cmdarg, 0, sizeof(s->cmdarg));
+    memset(s->response, 0, sizeof(s->response));
+    s->arglen = 0;
+    s->response_pos = 0;
+    s->stopping = 0;
+
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->sd));
+}
+
 static void ssi_sd_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_class_init(ObjectClass *klass, void *data)
     k->transfer = ssi_sd_transfer;
     k->cs_polarity = SSI_CS_LOW;
     dc->vmsd = &vmstate_ssi_sd;
+    dc->reset = ssi_sd_reset;
 }
 
 static const TypeInfo ssi_sd_info = {
-    .name          = "ssi-sd",
+    .name          = TYPE_SSI_SD,
     .parent        = TYPE_SSI_SLAVE,
     .instance_size = sizeof(ssi_sd_state),
     .class_init    = ssi_sd_class_init,
-- 
2.7.4

Since omap_mmc is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

Failing to do this mostly didn't affect the guest since the
guest typically does a programmed SD card reset as part of
its SD controller driver initialization, but would mean that
migration fails because it's only in sd_reset() that we
set up the wpgrps_size field.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-5-git-send-email-peter.maydell@linaro.org
---
 hw/sd/omap_mmc.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
     host->cdet_enable = 0;
     qemu_set_irq(host->coverswitch, host->cdet_state);
     host->clkdiv = 0;
+
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually. When omap_mmc is
+     * QOMified this must move into the QOM reset function.
+     */
+    device_reset(DEVICE(host->card));
 }
 
 static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
     s->lines = 1;	/* TODO: needs to be settable per-board */
     s->rev = 1;
 
-    omap_mmc_reset(s);
-
     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
         exit(1);
     }
 
+    omap_mmc_reset(s);
+
     return s;
 }
 
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
     s->lines = 4;
     s->rev = 2;
 
-    omap_mmc_reset(s);
-
     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
     s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);
     sd_set_cb(s->card, NULL, s->cdet);
 
+    omap_mmc_reset(s);
+
     return s;
 }
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180110063337.21538-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 44 ++++++++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
+/* The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+static uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* The imm8 encodes the sign bit, enough bits to represent
-     * an exponent in the range 01....1xx to 10....0xx,
-     * and the most significant 4 bits of the mantissa; see
-     * VFPExpandImm() in the v8 ARM ARM.
-     */
-    if (is_double) {
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-    } else {
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-    }
+    imm = vfp_expand_imm(MO_32 + is_double, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 4 ----
 include/hw/sd/sdhci.h  | 7 ++++++-
 hw/sd/sdhci.c          | 1 +
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef SDHCI_INTERNAL_H
 #define SDHCI_INTERNAL_H
 
-#include "hw/sd/sdhci.h"
-
 /* R/W SDMA System Address register 0x0 */
 #define SDHC_SYSAD                     0x00
 
@@ -XXX,XX +XXX,XX @@ enum {
     sdhc_gap_write  = 2   /* SDHC stopped at block gap during write operation */
 };
 
-extern const VMStateDescription sdhci_vmstate;
-
 #endif
diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@
 #define SDHCI_H
 
 #include "qemu-common.h"
-#include "hw/block/block.h"
 #include "hw/pci/pci.h"
 #include "hw/sysbus.h"
 #include "hw/sd/sd.h"
 
 /* SD/MMC host controller state */
 typedef struct SDHCIState {
+    /*< private >*/
     union {
         PCIDevice pcidev;
         SysBusDevice busdev;
     };
+
+    /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
 
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     qemu_irq ro_cb;
     qemu_irq irq;
 
+    /* Registers cleared on reset */
     uint32_t sdmasysad;    /* SDMA System Address register */
     uint16_t blksize;      /* Host DMA Buff Boundary and Transfer BlkSize Reg */
     uint16_t blkcnt;       /* Blocks count for current transfer */
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint16_t acmd12errsts; /* Auto CMD12 error status register */
     uint64_t admasysaddr;  /* ADMA System Address Register */
 
+    /* Read-only registers */
     uint32_t capareg;      /* Capabilities Register */
     uint32_t maxcurr;      /* Maximum Current Capabilities Register */
+
     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
     uint32_t buf_maxsz;
     uint16_t data_count;   /* current element in FIFO buffer */
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
+#include "hw/sd/sdhci.h"
 #include "sdhci-internal.h"
 #include "qemu/log.h"
 
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h | 2 --
 hw/sd/sdhci.c         | 2 --
 2 files changed, 4 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
 
     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
     QEMUTimer *transfer_timer;
-    qemu_irq eject_cb;
-    qemu_irq ro_cb;
     qemu_irq irq;
 
     /* Registers cleared on reset */
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
     timer_free(s->insert_timer);
     timer_del(s->transfer_timer);
     timer_free(s->transfer_timer);
-    qemu_free_irq(s->eject_cb);
-    qemu_free_irq(s->ro_cb);
 
     g_free(s->fifo_buffer);
     s->fifo_buffer = NULL;
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add common/sysbus/pci/sdbus comments to have clearer code blocks separation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180115182436.2066-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  4 +++-
 hw/sd/sdhci.c         | 25 +++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint32_t buf_maxsz;
     uint16_t data_count;   /* current element in FIFO buffer */
     uint8_t  stopped_state;/* Current SDHC state */
-    bool     pending_insert_quirk;/* Quirk for Raspberry Pi card insert int */
     bool     pending_insert_state;
     /* Buffer Data Port Register - virtual access point to R and W buffers */
     /* Software Reset Register - always reads as 0 */
     /* Force Event Auto CMD12 Error Interrupt Reg - write only */
     /* Force Event Error Interrupt Register- write only */
     /* RO Host Controller Version Register always reads as 0x2401 */
+
+    /* Configurable properties */
+    bool pending_insert_quirk; /* Quirk for Raspberry Pi card insert int */
 } SDHCIState;
 
 #define TYPE_PCI_SDHCI "sdhci-pci"
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "hw/hw.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
     }
 }
 
+/* --- qdev common --- */
+
+#define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
+    /* Capabilities registers provide information on supported features
+     * of this specific host controller implementation */ \
+    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
+    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
+
 static void sdhci_initfn(SDHCIState *s)
 {
     qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
     },
 };
 
-/* Capabilities registers provide information on supported features of this
- * specific host controller implementation */
+/* --- qdev PCI --- */
+
 static Property sdhci_pci_properties[] = {
-    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
-            SDHC_CAPAB_REG_DEFAULT),
-    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_pci_info = {
     },
 };
 
+/* --- qdev SysBus --- */
+
 static Property sdhci_sysbus_properties[] = {
-    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
-            SDHC_CAPAB_REG_DEFAULT),
-    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
     DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
                      false),
     DEFINE_PROP_END_OF_LIST(),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_sysbus_info = {
     .class_init = sdhci_sysbus_class_init,
 };
 
+/* --- qdev bus master --- */
+
 static void sdhci_bus_class_init(ObjectClass *klass, void *data)
 {
     SDBusClass *sbc = SD_BUS_CLASS(klass);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Now both inherited classes appear as DEVICE_CATEGORY_STORAGE.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
     },
 };
 
+static void sdhci_common_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+    dc->vmsd = &sdhci_vmstate;
+    dc->reset = sdhci_poweron_reset;
+}
+
 /* --- qdev PCI --- */
 
 static Property sdhci_pci_properties[] = {
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_REDHAT;
     k->device_id = PCI_DEVICE_ID_REDHAT_SDHCI;
     k->class_id = PCI_CLASS_SYSTEM_SDHCI;
-    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
-    dc->vmsd = &sdhci_vmstate;
     dc->props = sdhci_pci_properties;
-    dc->reset = sdhci_poweron_reset;
+
+    sdhci_common_class_init(klass, data);
 }
 
 static const TypeInfo sdhci_pci_info = {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->vmsd = &sdhci_vmstate;
     dc->props = sdhci_sysbus_properties;
     dc->realize = sdhci_sysbus_realize;
-    dc->reset = sdhci_poweron_reset;
+
+    sdhci_common_class_init(klass, data);
 }
 
 static const TypeInfo sdhci_sysbus_info = {
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
     s->fifo_buffer = NULL;
 }
 
+static void sdhci_common_realize(SDHCIState *s, Error **errp)
+{
+    s->buf_maxsz = sdhci_get_fifolen(s);
+    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
+                          SDHC_REGISTERS_MAP_SIZE);
+}
+
 static bool sdhci_pending_insert_vmstate_needed(void *opaque)
 {
     SDHCIState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static Property sdhci_pci_properties[] = {
 static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
 {
     SDHCIState *s = PCI_SDHCI(dev);
+
+    sdhci_initfn(s);
+    sdhci_common_realize(s, errp);
+    if (errp && *errp) {
+        return;
+    }
+
     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
-    sdhci_initfn(s);
-    s->buf_maxsz = sdhci_get_fifolen(s);
-    s->fifo_buffer = g_malloc0(s->buf_maxsz);
     s->irq = pci_allocate_irq(dev);
-    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
-            SDHC_REGISTERS_MAP_SIZE);
     pci_register_bar(dev, 0, 0, &s->iomem);
 }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     SDHCIState *s = SYSBUS_SDHCI(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    s->buf_maxsz = sdhci_get_fifolen(s);
-    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+    sdhci_common_realize(s, errp);
+    if (errp && *errp) {
+        return;
+    }
+
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
-            SDHC_REGISTERS_MAP_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-7-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "hw/sd/sdhci.h"
 #include "sdhci-internal.h"
+#include "qapi/error.h"
 #include "qemu/log.h"
 
 /* host controller debug messages */
@@ -XXX,XX +XXX,XX @@ static void sdhci_common_realize(SDHCIState *s, Error **errp)
                           SDHC_REGISTERS_MAP_SIZE);
 }
 
+static void sdhci_common_unrealize(SDHCIState *s, Error **errp)
+{
+    /* This function is expected to be called only once for each class:
+     * - SysBus:    via DeviceClass->unrealize(),
+     * - PCI:       via PCIDeviceClass->exit().
+     * However to avoid double-free and/or use-after-free we still nullify
+     * this variable (better safe than sorry!). */
+    g_free(s->fifo_buffer);
+    s->fifo_buffer = NULL;
+}
+
 static bool sdhci_pending_insert_vmstate_needed(void *opaque)
 {
     SDHCIState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
 static void sdhci_pci_exit(PCIDevice *dev)
 {
     SDHCIState *s = PCI_SDHCI(dev);
+
+    sdhci_common_unrealize(s, &error_abort);
     sdhci_uninitfn(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
+static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
+{
+    SDHCIState *s = SYSBUS_SDHCI(dev);
+
+    sdhci_common_unrealize(s, &error_abort);
+}
+
 static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->props = sdhci_sysbus_properties;
     dc->realize = sdhci_sysbus_realize;
+    dc->unrealize = sdhci_sysbus_unrealize;
 
     sdhci_common_class_init(klass, data);
 }
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
         ret = (SD_HOST_SPECv2_VERS << 16) | sdhci_slotint(s);
         break;
     default:
-        ERRPRINT("bad %ub read: addr[0x%04x]\n", size, (int)offset);
+        qemu_log_mask(LOG_UNIMP, "SDHC rd_%ub @0x%02" HWADDR_PRIx " "
+                      "not implemented\n", size, offset);
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         sdhci_update_irq(s);
         break;
     default:
-        ERRPRINT("bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n",
-                 size, (int)offset, value >> shift, value >> shift);
+        qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
+                      "not implemented\n", size, offset, value >> shift);
         break;
     }
     DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

zero-initialize ADMADescr 'dscr' in sdhci_do_adma() to avoid:

hw/sd/sdhci.c: In function ‘sdhci_do_adma’:
  hw/sd/sdhci.c:714:29: error: ‘dscr.addr’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
             trace_sdhci_adma("link", s->admasysaddr);
                             ^

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-9-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c      | 89 ++++++++++++++++++------------------------------------
 hw/sd/trace-events | 14 +++++++++
 2 files changed, 44 insertions(+), 59 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "sdhci-internal.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
-
-/* host controller debug messages */
-#ifndef SDHC_DEBUG
-#define SDHC_DEBUG                        0
-#endif
-
-#define DPRINT_L1(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG) { \
-            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
-        } \
-    } while (0)
-#define DPRINT_L2(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG > 1) { \
-            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
-        } \
-    } while (0)
-#define ERRPRINT(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG) { \
-            fprintf(stderr, "QEMU SDHC ERROR: " fmt, ## args); \
-        } \
-    } while (0)
+#include "trace.h"
 
 #define TYPE_SDHCI_BUS "sdhci-bus"
 #define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS)
@@ -XXX,XX +XXX,XX @@ static void sdhci_raise_insertion_irq(void *opaque)
 static void sdhci_set_inserted(DeviceState *dev, bool level)
 {
     SDHCIState *s = (SDHCIState *)dev;
-    DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject");
 
+    trace_sdhci_set_inserted(level ? "insert" : "eject");
     if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
         /* Give target some time to notice card ejection */
         timer_mod(s->insert_timer,
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
     s->acmd12errsts = 0;
     request.cmd = s->cmdreg >> 8;
     request.arg = s->argument;
-    DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg);
+
+    trace_sdhci_send_command(request.cmd, request.arg);
     rlen = sdbus_do_command(&s->sdbus, &request, response);
 
     if (s->cmdreg & SDHC_CMD_RESPONSE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
             s->rspreg[0] = (response[0] << 24) | (response[1] << 16) |
                            (response[2] << 8)  |  response[3];
             s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
-            DPRINT_L1("Response: RSPREG[31..0]=0x%08x\n", s->rspreg[0]);
+            trace_sdhci_response4(s->rspreg[0]);
         } else if (rlen == 16) {
             s->rspreg[0] = (response[11] << 24) | (response[12] << 16) |
                            (response[13] << 8) |  response[14];
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
                            (response[5] << 8)  |  response[6];
             s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
                             response[2];
-            DPRINT_L1("Response received:\n RSPREG[127..96]=0x%08x, RSPREG[95.."
-                  "64]=0x%08x,\n RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x\n",
-                  s->rspreg[3], s->rspreg[2], s->rspreg[1], s->rspreg[0]);
+            trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
+                                   s->rspreg[1], s->rspreg[0]);
         } else {
-            ERRPRINT("Timeout waiting for command response\n");
+            trace_sdhci_error("timeout waiting for command response");
             if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
                 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
                 s->norintsts |= SDHC_NIS_ERR;
@@ -XXX,XX +XXX,XX @@ static void sdhci_end_transfer(SDHCIState *s)
 
         request.cmd = 0x0C;
         request.arg = 0;
-        DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg);
+        trace_sdhci_end_transfer(request.cmd, request.arg);
         sdbus_do_command(&s->sdbus, &request, response);
         /* Auto CMD12 response goes to the upper Response register */
         s->rspreg[3] = (response[0] << 24) | (response[1] << 16) |
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
 
     /* first check that a valid data exists in host controller input buffer */
     if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
-        ERRPRINT("Trying to read from empty buffer\n");
+        trace_sdhci_error("read from empty buffer");
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
         s->data_count++;
         /* check if we've read all valid data (blksize bytes) from buffer */
         if ((s->data_count) >= (s->blksize & 0x0fff)) {
-            DPRINT_L2("All %u bytes of data have been read from input buffer\n",
-                    s->data_count);
+            trace_sdhci_read_dataport(s->data_count);
             s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
             s->data_count = 0;  /* next buff read must start at position [0] */
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
 
     /* Check that there is free space left in a buffer */
     if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
-        ERRPRINT("Can't write to data buffer: buffer full\n");
+        trace_sdhci_error("Can't write to data buffer: buffer full");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
         s->data_count++;
         value >>= 8;
         if (s->data_count >= (s->blksize & 0x0fff)) {
-            DPRINT_L2("write buffer filled with %u bytes of data\n",
-                    s->data_count);
+            trace_sdhci_write_dataport(s->data_count);
             s->data_count = 0;
             s->prnsts &= ~SDHC_SPACE_AVAILABLE;
             if (s->prnsts & SDHC_DOING_WRITE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
 {
     unsigned int n, begin, length;
     const uint16_t block_size = s->blksize & 0x0fff;
-    ADMADescr dscr;
+    ADMADescr dscr = {};
     int i;
 
     for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
         s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
 
         get_adma_description(s, &dscr);
-        DPRINT_L2("ADMA loop: addr=" TARGET_FMT_plx ", len=%d, attr=%x\n",
-                dscr.addr, dscr.length, dscr.attr);
+        trace_sdhci_adma_loop(dscr.addr, dscr.length, dscr.attr);
 
         if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
             /* Indicate that error occurred in ST_FDS state */
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
             break;
         case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
             s->admasysaddr = dscr.addr;
-            DPRINT_L1("ADMA link: admasysaddr=0x%" PRIx64 "\n",
-                      s->admasysaddr);
+            trace_sdhci_adma("link", s->admasysaddr);
             break;
         default:
             s->admasysaddr += dscr.incr;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
         }
 
         if (dscr.attr & SDHC_ADMA_ATTR_INT) {
-            DPRINT_L1("ADMA interrupt: admasysaddr=0x%" PRIx64 "\n",
-                      s->admasysaddr);
+            trace_sdhci_adma("interrupt", s->admasysaddr);
             if (s->norintstsen & SDHC_NISEN_DMA) {
                 s->norintsts |= SDHC_NIS_DMA;
             }
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
         /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
         if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                     (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
-            DPRINT_L2("ADMA transfer completed\n");
+            trace_sdhci_adma_transfer_completed();
             if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
                 (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                 s->blkcnt != 0)) {
-                ERRPRINT("SD/MMC host ADMA length mismatch\n");
+                trace_sdhci_error("SD/MMC host ADMA length mismatch");
                 s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
                         SDHC_ADMAERR_STATE_ST_TFR;
                 if (s->errintstsen & SDHC_EISEN_ADMAERR) {
-                    ERRPRINT("Set ADMA error flag\n");
+                    trace_sdhci_error("Set ADMA error flag");
                     s->errintsts |= SDHC_EIS_ADMAERR;
                     s->norintsts |= SDHC_NIS_ERR;
                 }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
             break;
         case SDHC_CTRL_ADMA1_32:
             if (!(s->capareg & SDHC_CAN_DO_ADMA1)) {
-                ERRPRINT("ADMA1 not supported\n");
+                trace_sdhci_error("ADMA1 not supported");
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
             break;
         case SDHC_CTRL_ADMA2_32:
             if (!(s->capareg & SDHC_CAN_DO_ADMA2)) {
-                ERRPRINT("ADMA2 not supported\n");
+                trace_sdhci_error("ADMA2 not supported");
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
         case SDHC_CTRL_ADMA2_64:
             if (!(s->capareg & SDHC_CAN_DO_ADMA2) ||
                     !(s->capareg & SDHC_64_BIT_BUS_SUPPORT)) {
-                ERRPRINT("64 bit ADMA not supported\n");
+                trace_sdhci_error("64 bit ADMA not supported");
                 break;
             }
 
             sdhci_do_adma(s);
             break;
         default:
-            ERRPRINT("Unsupported DMA type\n");
+            trace_sdhci_error("Unsupported DMA type");
             break;
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static inline bool
 sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
 {
     if ((s->data_count & 0x3) != byte_num) {
-        ERRPRINT("Non-sequential access to Buffer Data Port register"
-                "is prohibited\n");
+        trace_sdhci_error("Non-sequential access to Buffer Data Port register"
+                          "is prohibited\n");
         return false;
     }
     return true;
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
     case  SDHC_BDATA:
         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
             ret = sdhci_read_dataport(s, size);
-            DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset,
-                      ret, ret);
+            trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
             return ret;
         }
         break;
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
 
     ret >>= (offset & 0x3) * 8;
     ret &= (1ULL << (size * 8)) - 1;
-    DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset, ret, ret);
+    trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
                       "not implemented\n", size, offset, value >> shift);
         break;
     }
-    DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
-              size, (int)offset, value >> shift, value >> shift);
+    trace_sdhci_access("wr", size << 3, offset, "<-",
+                       value >> shift, value >> shift);
 }
 
 static const MemoryRegionOps sdhci_mmio_ops = {
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# hw/sd/sdhci.c
+sdhci_set_inserted(const char *level) "card state changed: %s"
+sdhci_send_command(uint8_t cmd, uint32_t arg) "CMD%02u ARG[0x%08x]"
+sdhci_error(const char *msg) "%s"
+sdhci_response4(uint32_t r0) "RSPREG[31..0]=0x%08x"
+sdhci_response16(uint32_t r3, uint32_t r2, uint32_t r1, uint32_t r0) "RSPREG[127..96]=0x%08x, RSPREG[95..64]=0x%08x, RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x"
+sdhci_end_transfer(uint8_t cmd, uint32_t arg) "Automatically issue CMD%02u 0x%08x"
+sdhci_adma(const char *desc, uint32_t sysad) "%s: admasysaddr=0x%" PRIx32
+sdhci_adma_loop(uint64_t addr, uint16_t length, uint8_t attr) "addr=0x%08" PRIx64 ", len=%d, attr=0x%x"
+sdhci_adma_transfer_completed(void) ""
+sdhci_access(const char *access, unsigned int size, uint64_t offset, const char *dir, uint64_t val, uint64_t val2) "%s%u: addr[0x%04" PRIx64 "] %s 0x%08" PRIx64 " (%" PRIu64 ")"
+sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read from input buffer"
+sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
+
 # hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-10-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 1 +
 hw/sd/sdhci.c          | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #define SDHC_TRNS_ACMD12               0x0004
 #define SDHC_TRNS_READ                 0x0010
 #define SDHC_TRNS_MULTI                0x0020
+#define SDHC_TRNMOD_MASK               0x0037
 
 /* R/W Command Register 0x0 */
 #define SDHC_CMDREG                    0x0E
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
     (SDHC_CAPAB_TOCLKFREQ))
 
-#define MASK_TRNMOD     0x0037
 #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
 
 static uint8_t sdhci_slotint(SDHCIState *s)
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
             value &= ~SDHC_TRNS_DMA;
         }
-        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
+        MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
 
         /* Writing to the upper byte of CMDREG triggers SD command generation */
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-11-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 2 +-
 hw/sd/sdhci.c          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #define SDHC_ACMD12ERRSTS              0x3C
 
 /* HWInit Capabilities Register 0x05E80080 */
-#define SDHC_CAPAREG                   0x40
+#define SDHC_CAPAB                     0x40
 #define SDHC_CAN_DO_DMA                0x00400000
 #define SDHC_CAN_DO_ADMA2              0x00080000
 #define SDHC_CAN_DO_ADMA1              0x00100000
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
     case SDHC_ACMD12ERRSTS:
         ret = s->acmd12errsts;
         break;
-    case SDHC_CAPAREG:
+    case SDHC_CAPAB:
         ret = s->capareg;
         break;
     case SDHC_MAXCURR:
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

running qtests:

$ make check-qtest-arm
    GTESTER check-qtest-arm
  SDHC rd_4b @0x44 not implemented
  SDHC wr_4b @0x40 <- 0x89abcdef not implemented
  SDHC wr_4b @0x44 <- 0x01234567 not implemented

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-12-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  4 ++--
 hw/sd/sdhci.c         | 23 +++++++++++++++++++----
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint64_t admasysaddr;  /* ADMA System Address Register */
 
     /* Read-only registers */
-    uint32_t capareg;      /* Capabilities Register */
-    uint32_t maxcurr;      /* Maximum Current Capabilities Register */
+    uint64_t capareg;      /* Capabilities Register */
+    uint64_t maxcurr;      /* Maximum Current Capabilities Register */
 
     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
     uint32_t buf_maxsz;
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
         ret = s->acmd12errsts;
         break;
     case SDHC_CAPAB:
-        ret = s->capareg;
+        ret = (uint32_t)s->capareg;
+        break;
+    case SDHC_CAPAB + 4:
+        ret = (uint32_t)(s->capareg >> 32);
         break;
     case SDHC_MAXCURR:
-        ret = s->maxcurr;
+        ret = (uint32_t)s->maxcurr;
+        break;
+    case SDHC_MAXCURR + 4:
+        ret = (uint32_t)(s->maxcurr >> 32);
         break;
     case SDHC_ADMAERR:
         ret =  s->admaerr;
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         }
         sdhci_update_irq(s);
         break;
+
+    case SDHC_CAPAB:
+    case SDHC_CAPAB + 4:
+    case SDHC_MAXCURR:
+    case SDHC_MAXCURR + 4:
+        qemu_log_mask(LOG_GUEST_ERROR, "SDHC wr_%ub @0x%02" HWADDR_PRIx
+                      " <- 0x%08x read-only\n", size, offset, value >> shift);
+        break;
+
     default:
         qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
                       "not implemented\n", size, offset, value >> shift);
@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
 #define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
     /* Capabilities registers provide information on supported features
      * of this specific host controller implementation */ \
-    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
-    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
+    DEFINE_PROP_UINT64("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
+    DEFINE_PROP_UINT64("maxcurr", _state, maxcurr, 0)
 
 static void sdhci_initfn(SDHCIState *s)
 {
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

While SysBus devices can use the get_system_memory() address space,
PCI devices should use the bus master address space for DMA.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180115182436.2066-14-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  1 +
 hw/sd/sdhci.c         | 29 +++++++++++++++--------------
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
+    AddressSpace *dma_as;
 
     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
     QEMUTimer *transfer_timer;
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                     s->blkcnt--;
                 }
             }
-            dma_memory_write(&address_space_memory, s->sdmasysad,
+            dma_memory_write(s->dma_as, s->sdmasysad,
                              &s->fifo_buffer[begin], s->data_count - begin);
             s->sdmasysad += s->data_count - begin;
             if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                 s->data_count = block_size;
                 boundary_count -= block_size - begin;
             }
-            dma_memory_read(&address_space_memory, s->sdmasysad,
+            dma_memory_read(s->dma_as, s->sdmasysad,
                             &s->fifo_buffer[begin], s->data_count - begin);
             s->sdmasysad += s->data_count - begin;
             if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
         for (n = 0; n < datacnt; n++) {
             s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
         }
-        dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer,
-                         datacnt);
+        dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
     } else {
-        dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer,
-                        datacnt);
+        dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
         for (n = 0; n < datacnt; n++) {
             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
         }
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
     hwaddr entry_addr = (hwaddr)s->admasysaddr;
     switch (SDHC_DMA_TYPE(s->hostctl)) {
     case SDHC_CTRL_ADMA2_32:
-        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma2,
+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma2,
                         sizeof(adma2));
         adma2 = le64_to_cpu(adma2);
         /* The spec does not specify endianness of descriptor table.
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
         dscr->incr = 8;
         break;
     case SDHC_CTRL_ADMA1_32:
-        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma1,
+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma1,
                         sizeof(adma1));
         adma1 = le32_to_cpu(adma1);
         dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
         }
         break;
     case SDHC_CTRL_ADMA2_64:
-        dma_memory_read(&address_space_memory, entry_addr,
+        dma_memory_read(s->dma_as, entry_addr,
                         (uint8_t *)(&dscr->attr), 1);
-        dma_memory_read(&address_space_memory, entry_addr + 2,
+        dma_memory_read(s->dma_as, entry_addr + 2,
                         (uint8_t *)(&dscr->length), 2);
         dscr->length = le16_to_cpu(dscr->length);
-        dma_memory_read(&address_space_memory, entry_addr + 4,
+        dma_memory_read(s->dma_as, entry_addr + 4,
                         (uint8_t *)(&dscr->addr), 8);
         dscr->attr = le64_to_cpu(dscr->attr);
         dscr->attr &= 0xfffffff8;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                         s->data_count = block_size;
                         length -= block_size - begin;
                     }
-                    dma_memory_write(&address_space_memory, dscr.addr,
+                    dma_memory_write(s->dma_as, dscr.addr,
                                      &s->fifo_buffer[begin],
                                      s->data_count - begin);
                     dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                         s->data_count = block_size;
                         length -= block_size - begin;
                     }
-                    dma_memory_read(&address_space_memory, dscr.addr,
+                    dma_memory_read(s->dma_as, dscr.addr,
                                     &s->fifo_buffer[begin],
                                     s->data_count - begin);
                     dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
     s->irq = pci_allocate_irq(dev);
-    pci_register_bar(dev, 0, 0, &s->iomem);
+    s->dma_as = pci_get_address_space(dev);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->iomem);
 }
 
 static void sdhci_pci_exit(PCIDevice *dev)
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
         return;
     }
 
+    s->dma_as = &address_space_memory;
+
     sysbus_init_irq(sbd, &s->irq);
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add a 'dma' property allowing machine creation to provide the address-space
SDHCI DMA operates on.

[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
 from qemu/xilinx tag xilinx-v2016.1]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180115182436.2066-15-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  1 +
 hw/sd/sdhci.c         | 18 +++++++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1