Series comparison

-[Qemu-devel] [PULL 0/8] target-arm queue
+[PULL 00/16] target-arm queue
-target-arm queue: a smallish set of patches for rc1 tomorrow.
+Patches for rc1: nothing major, just some minor bugfixes and
-I've included the tcg patches because RTH has no others that
+code cleanups.
 would merit a pullreq.
-I haven't included Thomas Huth's 17-patch set to deal with
-the introspection crashes, to give that a little more time
-on-list for review.
-thanks
 -- PMM
-The following changes since commit 102ad0a80f5110483efd06877c29c4236be267f9:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2018-07-16' into staging (2018-07-16 15:34:38 +0100)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180716
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to 3474c98a2a2afcefa7c665f02ad2bed2a43ab0f7:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  accel/tcg: Assert that tlb fill gave us a valid TLB entry (2018-07-16 17:26:01 +0100)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * accel/tcg: Use correct test when looking in victim TLB for code
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * bcm2835_aux: Swap RX and TX interrupt assignments
+ * Minor coding style fixes
- * hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
+ * docs: add some notes on the sbsa-ref machine
- * hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * aspeed: Implement write-1-{set, clear} for AST2500 strapping
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * target/arm: Fix LD1W and LDFF1W (scalar plus vector)
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Andrew Jeffery (1):
+Alex Bennée (1):
-      aspeed: Implement write-1-{set, clear} for AST2500 strapping
+      docs: add some notes on the sbsa-ref machine
-Guenter Roeck (1):
+AlexChen (1):
-      bcm2835_aux: Swap RX and TX interrupt assignments
+      ssi: Fix bad printf format specifiers
-Peter Maydell (4):
+Andrew Jones (1):
-      hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
-      hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
-      accel/tcg: Use correct test when looking in victim TLB for code
+Havard Skinnemoen (1):
-      accel/tcg: Assert that tlb fill gave us a valid TLB entry
+      tests/qtest/npcm7xx_rng-test: count runs properly
 Peter Maydell (2):
       hw/arm/nseries: Check return value from load_image_targphys()
       target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 Philippe Mathieu-Daudé (6):
       hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
       hw/arm/armsse: Correct expansion MPC interrupt lines
       hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
       hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
       hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
       hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 Richard Henderson (1):
-      target/arm: Fix LD1W and LDFF1W (scalar plus vector)
+      target/arm: Fix neon VTBL/VTBX for len > 1
-Thomas Huth (1):
+Xinhao Zhang (3):
-      hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
+      target/arm: add spaces around operator
       target/arm: Don't use '#' flag of printf format
       target/arm: add space before the open parenthesis '('
- include/hw/misc/aspeed_scu.h |  2 ++
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
- accel/tcg/cputlb.c           |  6 +++---
+ docs/system/target-arm.rst         |  1 +
- hw/arm/bcm2836.c             |  2 ++
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
- hw/char/bcm2835_aux.c        |  4 ++--
+ target/arm/helper.h                |  2 +-
- hw/intc/arm_gic.c            | 22 +++++++++++++++++++---
+ hw/arm/armsse.c                    |  3 +-
- hw/misc/aspeed_scu.c         | 19 +++++++++++++++++--
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
- target/arm/sve_helper.c      |  4 ++--
+ hw/arm/nseries.c                   | 26 ++++++++----------
-files changed, 47 insertions(+), 12 deletions(-)
+ hw/arm/stm32f205_soc.c             |  1 -
  hw/misc/stm32f2xx_syscfg.c         |  2 --
  hw/ssi/imx_spi.c                   |  2 +-
  hw/ssi/xilinx_spi.c                |  2 +-
  target/arm/arch_dump.c             |  8 +++---
  target/arm/arm-semi.c              |  8 +++---
  target/arm/helper.c                |  2 +-
  target/arm/op_helper.c             | 23 +++++++++-------
  target/arm/translate-a64.c         |  4 +--
  target/arm/translate.c             |  2 +-
  tests/qtest/npcm7xx_rng-test.c     |  2 +-
  hw/arm/Kconfig                     |  3 +-
  target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
 files changed, 123 insertions(+), 98 deletions(-)
  create mode 100644 docs/system/arm/sbsa.rst

-New patch
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+From: Andrew Jones <drjones@redhat.com>
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
+in the build when building armv7m_systick.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
+ config ARM_V7M
+     bool
++    select PTIMER
+ config ALLWINNER_A10
+     bool
+--
+.20.1

-New patch
+[PULL 02/16] ssi: Fix bad printf format specifiers
+From: AlexChen <alex.chen@huawei.com>
+We should use printf format specifier "%u" instead of "%d" for
+argument of type "unsigned int".
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 5FA280F5.8060902@huawei.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/ssi/imx_spi.c    | 2 +-
+ hw/ssi/xilinx_spi.c | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/imx_spi.c
++++ b/hw/ssi/imx_spi.c
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+     case ECSPI_MSGDATA:
+         return  "ECSPI_MSGDATA";
+     default:
+-        sprintf(unknown, "%d ?", reg);
++        sprintf(unknown, "%u ?", reg);
+         return unknown;
+     }
+ }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/xilinx_spi.c
++++ b/hw/ssi/xilinx_spi.c
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
+        irq chain unless things really changed.  */
+     if (pending != s->irqline) {
+         s->irqline = pending;
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+         qemu_set_irq(s->irq, pending);
+     }
+--
+.20.1

-New patch
+[PULL 03/16] target/arm: add spaces around operator
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Operator needs spaces both sides.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/arch_dump.c | 8 ++++----
+ target/arm/arm-semi.c  | 8 ++++----
+ target/arm/helper.c    | 2 +-
+files changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arch_dump.c
++++ b/target/arm/arch_dump.c
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     }
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
+         for (i = 0; i < 32; ++i) {
+             uint64_t tmp = note.vfp.vregs[2*i];
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-            note.vfp.vregs[2*i+1] = tmp;
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++            note.vfp.vregs[2 * i + 1] = tmp;
+         }
+     }
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         if (use_gdb_syscalls()) {
+             arm_semi_open_guestfd = guestfd;
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
+         } else {
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
+             if (ret == (uint32_t)-1) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
+-                                  arg0, (int)arg1+1);
++                                  arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(3);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
+         } else {
+             char *s2;
+             s = lock_user_string(arg0);
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
+-                                   arg0, (int)arg1+1);
++                                   arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
+     uint32_t sum;
+     sum = do_usad(a, b);
+     sum += do_usad(a >> 8, b >> 8);
+-    sum += do_usad(a >> 16, b >>16);
++    sum += do_usad(a >> 16, b >> 16);
+     sum += do_usad(a >> 24, b >> 24);
+     return sum;
+ }
+--
+.20.1

-[Qemu-devel] [PULL 8/8] accel/tcg: Assert that tlb fill gave us a valid TLB entry
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-In commit 4b1a3e1e34ad97 we added a check for whether the TLB entry
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
 we had following a tlb_fill had the INVALID bit set.  This could
 happen in some circumstances because a stale or wrong TLB entry was
 pulled out of the victim cache.  However, after commit
 fea038553039e (which prevents stale entries being in the victim
 cache) and the previous commit (which ensures we don't incorrectly
 hit in the victim cache)) this should never be possible.
-Drop the check on TLB_INVALID_MASK from the "is this a TLB_RECHECK?"
+Fix code style. Don't use '#' flag of printf format ('%#') in
-condition, and instead assert that the tlb fill procedure has given
+format strings, use '0x' prefix instead
 us a valid TLB entry (or longjumped out with a guest exception).
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180713141636.18665-3-peter.maydell@linaro.org
 ---
- accel/tcg/cputlb.c | 4 ++--
+ target/arm/translate-a64.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/target/arm/translate-a64.c
-+++ b/accel/tcg/cputlb.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
-         if (!VICTIM_TLB_HIT(addr_code, addr)) {
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
-             tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
+                 break;
-         }
+             default:
-+        assert(tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr));
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
 +                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                          __func__, insn, fpopcode, s->pc_curr);
                  g_assert_not_reached();
              }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      case 0x7f: /* FSQRT (vector) */
          break;
      default:
 -        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
 +        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
--    if (unlikely((env->tlb_table[mmu_idx][index].addr_code &
--                  (TLB_RECHECK | TLB_INVALID_MASK)) == TLB_RECHECK)) {
-+    if (unlikely(env->tlb_table[mmu_idx][index].addr_code & TLB_RECHECK)) {
-         /*
-          * This is a TLB_RECHECK access, where the MMU protection
-          * covers a smaller range than a target page, and we must
 --
-.17.1
+.20.1

-New patch
+[PULL 05/16] target/arm: add space before the open parenthesis '('
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Space required before the open parenthesis '('.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+             - Hardware watchpoints.
+            Hardware breakpoints have already been handled and skip this code.
+          */
+-        switch(dc->base.is_jmp) {
++        switch (dc->base.is_jmp) {
+         case DISAS_NEXT:
+         case DISAS_TOO_MANY:
+             gen_goto_tb(dc, 1, dc->base.pc_next);
+--
+.20.1

-New patch
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
+From: Alex Bennée <alex.bennee@linaro.org>
+We should at least document what this machine is about.
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
+Cc: Leif Lindholm <leif@nuviainc.com>
+Cc: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+[PMM: fixed filename mismatch]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
+ docs/system/target-arm.rst |  1 +
+files changed, 33 insertions(+)
+ create mode 100644 docs/system/arm/sbsa.rst
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/docs/system/arm/sbsa.rst
+@@ -XXX,XX +XXX,XX @@
++Arm Server Base System Architecture Reference board (``sbsa-ref``)
++==================================================================
++
++While the `virt` board is a generic board platform that doesn't match
++any real hardware the `sbsa-ref` board intends to look like real
++hardware. The `Server Base System Architecture
++<https://developer.arm.com/documentation/den0029/latest>` defines a
++minimum base line of hardware support and importantly how the firmware
++reports that to any operating system. It is a static system that
++reports a very minimal DT to the firmware for non-discoverable
++information about components affected by the qemu command line (i.e.
++cpus and memory). As a result it must have a firmware specifically
++built to expect a certain hardware layout (as you would in a real
++machine).
++
++It is intended to be a machine for developing firmware and testing
++standards compliance with operating systems.
++
++Supported devices
++"""""""""""""""""
++
++The sbsa-ref board supports:
++
++  - A configurable number of AArch64 CPUs
++  - GIC version 3
++  - System bus AHCI controller
++  - System bus EHCI controller
++  - CDROM and hard disc on AHCI bus
++  - E1000E ethernet card on PCIe bus
++  - VGA display adaptor on PCIe bus
++  - A generic SBSA watchdog device
++
+diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/target-arm.rst
++++ b/docs/system/target-arm.rst
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+    arm/mps2
+    arm/musca
+    arm/realview
++   arm/sbsa
+    arm/versatile
+    arm/vexpress
+    arm/aspeed
+--
+.20.1

-New patch
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+When using a Cortex-A15, the Virt machine does not use any
+MPCore peripherals. Remove the dependency.
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201107114852.271922-1-philmd@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+     imply VFIO_PLATFORM
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
+-    select A15MPCORE
+     select ACPI
+     select ARM_SMMUV3
+     select GPIO_KEY
+--
+.20.1

-[Qemu-devel] [PULL 1/8] target/arm: Fix LD1W and LDFF1W (scalar plus vector)
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
 From: Richard Henderson <richard.henderson@linaro.org>
-'I' was being double-incremented; correctly within the inner loop
+The helper function did not get updated when we reorganized
-and incorrectly within the outer loop.
+the vector register file for SVE.  Since then, the neon dregs
 are non-sequential and cannot be simply indexed.
+At the same time, make the helper function operate on 64-bit
+quantities so that we do not have to call it twice.
+Fixes: c39c2b9043e
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+[PMM: use aa32_vfp_dreg() rather than opencoding]
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180711103957.3040-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c | 4 ++--
+ target/arm/helper.h             |  2 +-
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/op_helper.c          | 23 +++++++++--------
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/helper.h
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm,       \
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
-     intptr_t i, oprsz = simd_oprsz(desc);                               \
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
-     unsigned scale = simd_data(desc);                                   \
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
-     uintptr_t ra = GETPC();                                             \
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
--    for (i = 0; i < oprsz; i++) {                                       \
+-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
-+    for (i = 0; i < oprsz; ) {                                          \
++DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
-         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));                 \
-         do {                                                            \
+ DEF_HELPER_3(shl_cc, i32, env, i32, i32)
-             TYPEM m = 0;                                                \
+ DEF_HELPER_3(shr_cc, i32, env, i32, i32)
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm,       \
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-     uintptr_t ra = GETPC();                                             \
+index XXXXXXX..XXXXXXX 100644
-     bool first = true;                                                  \
+--- a/target/arm/op_helper.c
-     mmap_lock();                                                        \
++++ b/target/arm/op_helper.c
--    for (i = 0; i < oprsz; i++) {                                       \
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
-+    for (i = 0; i < oprsz; ) {                                          \
+     cpu_loop_exit_restore(cs, ra);
-         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));                 \
+ }
-         do {                                                            \
-             TYPEM m = 0;                                                \
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
 -                          uint32_t maxindex)
 +uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
 +                          uint64_t ireg, uint64_t def)
  {
 -    uint32_t val, shift;
 -    uint64_t *table = vn;
 +    uint64_t tmp, val = 0;
 +    uint32_t maxindex = ((desc & 3) + 1) * 8;
 +    uint32_t base_reg = desc >> 2;
 +    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
      return val;
  }
 diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
 +    tcg_temp_free_i64(def);
 +    tcg_temp_free_i64(val);
 +    tcg_temp_free_i32(desc);
      return true;
  }
 --
-.17.1
+.20.1

-New patch
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We can use one MPC per SRAM bank, but we currently only wire the
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/armsse.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                                         qdev_get_gpio_in(dev_splitter, 0));
+             qdev_connect_gpio_out(dev_splitter, 0,
+                                   qdev_get_gpio_in_named(dev_secctl,
+-                                                         "mpc_status", 0));
++                                                         "mpc_status",
++                                                         i - IOTS_NUM_EXP_MPC));
+         }
+         qdev_connect_gpio_out(dev_splitter, 1,
+--
+.20.1

-New patch
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The system configuration controller (SYSCFG) doesn't have
+any output IRQ (and the INTC input #71 belongs to the UART6).
+Remove the invalid code.
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
+ hw/arm/stm32f205_soc.c             | 1 -
+ hw/misc/stm32f2xx_syscfg.c         | 2 --
+files changed, 5 deletions(-)
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/misc/stm32f2xx_syscfg.h
++++ b/include/hw/misc/stm32f2xx_syscfg.h
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
+     uint32_t syscfg_exticr3;
+     uint32_t syscfg_exticr4;
+     uint32_t syscfg_cmpcr;
+-
+-    qemu_irq irq;
+ };
+ #endif /* HW_STM32F2XX_SYSCFG_H */
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
+     }
+     busdev = SYS_BUS_DEVICE(dev);
+     sysbus_mmio_map(busdev, 0, 0x40013800);
+-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
+     /* Attach UART (uses USART registers) and USART controllers */
+     for (i = 0; i < STM_NUM_USARTS; i++) {
+diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/stm32f2xx_syscfg.c
++++ b/hw/misc/stm32f2xx_syscfg.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
+ {
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+-
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+--
+.20.1

-[Qemu-devel] [PULL 5/8] hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-From: Thomas Huth <thuth@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-These devices are currently causing some problems when a user is trying
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-to hot-plug or introspect them during runtime. Since these devices can
+OMAP2 chip support") takes care of creating the 3 UARTs.
 not be instantiated by the user at all (they need to be wired up in code
 instead), we should mark them with user_creatable = false anyway, then we
 avoid at least the crashes with the hot-plugging. The introspection problem
 will be handled by a separate patch.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
-Message-id: 1531415537-26037-1-git-send-email-thuth@redhat.com
+extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/bcm2836.c | 2 ++
+ hw/arm/nseries.c | 11 -----------
-file changed, 2 insertions(+)
+file changed, 11 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/hw/arm/nseries.c
-+++ b/hw/arm/bcm2836.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static void bcm283x_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
-     bc->info = data;
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
      dc->realize = bcm2836_realize;
      dc->props = bcm2836_props;
 +    /* Reason: Must be wired up in code (see raspi_init() function) */
 +    dc->user_creatable = false;
  }
- static const TypeInfo bcm283x_type_info = {
+-static void n8x0_uart_setup(struct n800_s *s)
 -{
 -    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
 -    /*
 -     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
 -     * here, but this code has been removed with the bluetooth backend.
 -     */
 -    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -}
 -
  static void n8x0_usb_setup(struct n800_s *s)
  {
      SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
      n8x0_spi_setup(s);
      n8x0_dss_setup(s);
      n8x0_cbus_setup(s);
 -    n8x0_uart_setup(s);
      if (machine_usb(machine)) {
          n8x0_usb_setup(s);
      }
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 6/8] bcm2835_aux: Swap RX and TX interrupt assignments
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-From: Guenter Roeck <linux@roeck-us.net>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-RX and TX interrupt bits were reversed, resulting in an endless sequence
+The MusicPal board code connects both of the IRQ outputs of the UART
-of serial interupts in the emulated system and the following repeated
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-error message when booting Linux.
+to the same input is not valid as it produces subtly wrong behaviour
 (for instance if both the IRQ lines are high, and then one goes
 low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-serial8250: too much work for irq61
+This kind of wiring needs an explicitly created OR gate; add one.
-This results in a boot failure most of the time.
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Qemu command line used to reproduce the problem:
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
     qemu-system-aarch64 -M raspi3 -m 1024 \
     -kernel arch/arm64/boot/Image \
     --append "rdinit=/sbin/init console=ttyS1,115200"
     -initrd rootfs.cpio \
     -dtb arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dtb \
     -nographic -monitor null -serial null -serial stdio
 This is with arm64:defconfig. The root file system was generated using
 buildroot.
 NB that this error likely arises from an erratum in the
 BCM2835 datasheet where the TX and RX bits were swapped
 in the AU_MU_IER_REG description (but correct for IIR):
  https://elinux.org/BCM2835_datasheet_errata#p12
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 1529355846-25102-1-git-send-email-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: added NB about datasheet]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/bcm2835_aux.c | 4 ++--
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 2 insertions(+), 2 deletions(-)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/bcm2835_aux.c
+--- a/hw/arm/musicpal.c
-+++ b/hw/char/bcm2835_aux.c
++++ b/hw/arm/musicpal.c
 @@ -XXX,XX +XXX,XX @@
- #define AUX_MU_BAUD_REG 0x68
+ #include "ui/console.h"
+ #include "hw/i2c/i2c.h"
- /* bits in IER/IIR registers */
+ #include "hw/irq.h"
--#define TX_INT  0x1
++#include "hw/or-irq.h"
--#define RX_INT  0x2
+ #include "hw/audio/wm8750.h"
-+#define RX_INT  0x1
+ #include "sysemu/block-backend.h"
-+#define TX_INT  0x2
+ #include "sysemu/runstate.h"
+@@ -XXX,XX +XXX,XX @@
- static void bcm2835_aux_update(BCM2835AuxState *s)
+ #define MP_TIMER4_IRQ           7
- {
+ #define MP_EHCI_IRQ             8
  #define MP_ETH_IRQ              9
 -#define MP_UART1_IRQ            11
 -#define MP_UART2_IRQ            11
 +#define MP_UART_SHARED_IRQ      11
  #define MP_GPIO_IRQ             12
  #define MP_RTC_IRQ              28
  #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
      ARMCPU *cpu;
      qemu_irq pic[32];
      DeviceState *dev;
 +    DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
 +    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 0),
                     1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 -    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
 +    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 1),
                     1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
      /* Register flash */
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
  config MUSICPAL
      bool
 +    select OR_IRQ
      select BITBANG_I2C
      select MARVELL_88W8618
      select PTIMER
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 2/8] aspeed: Implement write-1-{set, clear} for AST2500 strapping
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
-From: Andrew Jeffery <andrew@aj.id.au>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The AST2500 SoC family changes the runtime behaviour of the hardware
+We don't need to fill the full pic[] array if we only use
-strapping register (SCU70) to write-1-set/write-1-clear, with
+few of the interrupt lines. Directly call qdev_get_gpio_in()
-write-1-clear implemented on the "read-only" SoC revision register
+when necessary.
 (SCU7C). For the the AST2400, the hardware strapping is
 runtime-configured with read-modify-write semantics.
-Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Message-id: 20180709143524.17480-1-andrew@aj.id.au
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_scu.h |  2 ++
+ hw/arm/musicpal.c | 25 +++++++++++++------------
- hw/misc/aspeed_scu.c         | 19 +++++++++++++++++--
+file changed, 13 insertions(+), 12 deletions(-)
 files changed, 19 insertions(+), 2 deletions(-)
-diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_scu.h
+--- a/hw/arm/musicpal.c
-+++ b/include/hw/misc/aspeed_scu.h
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
- #define AST2500_A0_SILICON_REV   0x04000303U
+ static void musicpal_init(MachineState *machine)
- #define AST2500_A1_SILICON_REV   0x04010303U
+ {
+     ARMCPU *cpu;
-+#define ASPEED_IS_AST2500(si_rev)     ((((si_rev) >> 24) & 0xff) == 0x04)
+-    qemu_irq pic[32];
-+
+     DeviceState *dev;
- extern bool is_supported_silicon_rev(uint32_t silicon_rev);
++    DeviceState *pic;
+     DeviceState *uart_orgate;
- #define ASPEED_SCU_PROT_KEY      0x1688A8A8
+     DeviceState *i2c_dev;
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+     DeviceState *lcd_dev;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
---- a/hw/misc/aspeed_scu.c
+                            &error_fatal);
-+++ b/hw/misc/aspeed_scu.c
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
-         s->regs[reg] = data;
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-         aspeed_scu_set_apb_freq(s);
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-         break;
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
--
+-    for (i = 0; i < 32; i++) {
-+    case HW_STRAP1:
+-        pic[i] = qdev_get_gpio_in(dev, i);
-+        if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
+-    }
-+            s->regs[HW_STRAP1] |= data;
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-+            return;
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+        }
+-                          pic[MP_TIMER4_IRQ], NULL);
-+        /* Jump to assignment below */
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+        break;
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
-+    case SILICON_REV:
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
-+        if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
-+            s->regs[HW_STRAP1] &= ~data;
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
-+        } else {
-+            qemu_log_mask(LOG_GUEST_ERROR,
+     /* Logically OR both UART IRQs together */
-+                          "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+                          __func__, offset);
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+        }
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+        /* Avoid assignment below, we've handled everything */
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+        return;
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-     case FREQ_CNTR_EVAL:
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-     case VGA_SCRATCH1 ... VGA_SCRATCH8:
-     case RNG_DATA:
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
--    case SILICON_REV:
+                    qdev_get_gpio_in(uart_orgate, 0),
-     case FREE_CNTR4:
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-     case FREE_CNTR4_EXT:
+                              OBJECT(get_system_memory()), &error_fatal);
-         qemu_log_mask(LOG_GUEST_ERROR,
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 4/8] hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
-The GICD_ITARGETSR implementation still has some 11MPCore behaviour
+The nseries machines have a codepath that allows them to load a
-that we were incorrectly using in our GICv1 and GICv2 implementations
+secondary bootloader.  This code wasn't checking that the
-for the case where the interrupt number is less than GIC_INTERNAL.
+load_image_targphys() succeeded.  Check the return value and report
-The desired behaviour here is:
+the error to the user.
  * for 11MPCore: RAZ/WI for irqs 0..28; read a number matching the
    CPU doing the read for irqs 29..31
  * for GICv1 and v2: RAZ/WI if uniprocessor; otherwise read a
    number matching the CPU doing the read for all irqs < 32
-Stop squashing GICD_ITARGETSR to 0 for IRQs 0..28 unless this
+While we're in the vicinity, fix the comment style of the
-is an 11MPCore GIC.
+comment documenting what this image load is doing.
-Reported-by: Jan Kiszka <jan.kiszka@web.de>
+Fixes: Coverity CID 1192904
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
 Message-id: 20180712154152.32183-3-peter.maydell@linaro.org
 ---
- hw/intc/arm_gic.c | 6 ++++--
+ hw/arm/nseries.c | 15 +++++++++++----
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/hw/arm/nseries.c
-+++ b/hw/intc/arm_gic.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-             if (irq >= s->num_irq) {
+         /* No, wait, better start at the ROM.  */
-                 goto bad_reg;
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
-             }
--            if (irq >= 29 && irq <= 31) {
+-        /* This is intended for loading the `secondary.bin' program from
-+            if (irq < 29 && s->revision == REV_11MPCORE) {
++        /*
-+                res = 0;
++         * This is intended for loading the `secondary.bin' program from
-+            } else if (irq < GIC_INTERNAL) {
+          * Nokia images (the NOLO bootloader).  The entry point seems
-                 res = cm;
+          * to be at OMAP2_Q2_BASE + 0x400000.
-             } else {
+          *
-                 res = GIC_TARGET(irq);
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
-             if (irq >= s->num_irq) {
+          *
-                 goto bad_reg;
+          * The code above is for loading the `zImage' file from Nokia
-             }
+-         * images.  */
--            if (irq < 29) {
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-+            if (irq < 29 && s->revision == REV_11MPCORE) {
+-                            machine->ram_size - 0x400000);
-                 value = 0;
++         * images.
-             } else if (irq < GIC_INTERNAL) {
++         */
-                 value = ALL_CPU_MASK;
++        if (load_image_targphys(option_rom[0].name,
 +                                OMAP2_Q2_BASE + 0x400000,
 +                                machine->ram_size - 0x400000) < 0) {
 +            error_report("Failed to load secondary bootloader %s",
 +                         option_rom[0].name);
 +            exit(EXIT_FAILURE);
 +        }
          n800_setup_nolo_tags(nolo_tags);
          cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 7/8] accel/tcg: Use correct test when looking in victim TLB for code
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-In get_page_addr_code(), we were incorrectly looking in the victim
+From: Havard Skinnemoen <hskinnemoen@google.com>
 TLB for an entry which matched the target address for reads, not
 for code accesses. This meant that we could hit on a victim TLB
 entry that indicated that the address was readable but not
 executable, and incorrectly bypass the call to tlb_fill() which
 should generate the guest MMU exception. Fix this bug.
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
+plus one. Currently, it's counting the number of times these transitions
+do _not_ happen, plus one.
+Source:
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
+section 2.3.4 point (3).
+Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
+Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180713141636.18665-2-peter.maydell@linaro.org
 ---
- accel/tcg/cputlb.c | 2 +-
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cputlb.c
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/accel/tcg/cputlb.c
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
-     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+     pi = (double)nr_ones / nr_bits;
-     mmu_idx = cpu_mmu_index(env, true);
-     if (unlikely(!tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr))) {
+     for (k = 0; k < nr_bits - 1; k++) {
--        if (!VICTIM_TLB_HIT(addr_read, addr)) {
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+        if (!VICTIM_TLB_HIT(addr_code, addr)) {
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
              tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
          }
      }
+     vn_obs += 1;
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 3/8] hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-In gic_deactivate_irq() the interrupt number comes from the guest
+Checks for UNDEF cases should go before the "is VFP enabled?" access
-(on a write to the GICC_DIR register), so we need to sanity check
+check, except in special cases. Move a stray UNDEF check in the VTBL
-that it isn't out of range before we use it as an array index.
+trans function up above the access check.
 Handle this in a similar manner to the check we do in
 gic_complete_irq() for the GICC_EOI register.
 The array overrun is not disastrous because the calling code
 uses (value & 0x3ff) to extract the interrupt field, so the
 only out-of-range values possible are 1020..1023, which allow
 overrunning only from irq_state[] into the following
 irq_target[] array which the guest can already manipulate.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 Message-id: 20180712154152.32183-2-peter.maydell@linaro.org
 ---
- hw/intc/arm_gic.c | 16 +++++++++++++++-
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 15 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/target/arm/translate-neon.c.inc
-+++ b/hw/intc/arm_gic.c
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool gic_eoi_split(GICState *s, int cpu, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- static void gic_deactivate_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
+         return false;
- {
+     }
-     int cm = 1 << cpu;
--    int group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
+-    if (!vfp_access_check(s)) {
-+    int group;
+-        return true;
-+
+-    }
-+    if (irq >= s->num_irq) {
+-
-+        /*
+     if ((a->vn + a->len + 1) > 32) {
-+         * This handles two cases:
+         /*
-+         * 1. If software writes the ID of a spurious interrupt [ie 1023]
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
-+         * to the GICC_DIR, the GIC ignores that write.
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-+         * 2. If software writes the number of a non-existent interrupt
+         return false;
-+         * this must be a subcase of "value written is not an active interrupt"
+     }
-+         * and so this is UNPREDICTABLE. We choose to ignore it.
-+         */
++    if (!vfp_access_check(s)) {
-+        return;
++        return true;
 +    }
 +
-+    group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
+     desc = tcg_const_i32((a->vn << 2) | a->len);
+     def = tcg_temp_new_i64();
-     if (!gic_eoi_split(s, cpu, attrs)) {
+     if (a->op) {
          /* This is UNPREDICTABLE; we choose to ignore it */
 --
-.17.1
+.20.1

target-arm queue: a smallish set of patches for rc1 tomorrow.
I've included the tcg patches because RTH has no others that
would merit a pullreq.

I haven't included Thomas Huth's 17-patch set to deal with
the introspection crashes, to give that a little more time
on-list for review.

thanks
-- PMM

The following changes since commit 102ad0a80f5110483efd06877c29c4236be267f9:

Merge remote-tracking branch 'remotes/armbru/tags/pull-misc-2018-07-16' into staging (2018-07-16 15:34:38 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180716

for you to fetch changes up to 3474c98a2a2afcefa7c665f02ad2bed2a43ab0f7:

accel/tcg: Assert that tlb fill gave us a valid TLB entry (2018-07-16 17:26:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * accel/tcg: Use correct test when looking in victim TLB for code
 * bcm2835_aux: Swap RX and TX interrupt assignments
 * hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false
 * hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
 * hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
 * aspeed: Implement write-1-{set, clear} for AST2500 strapping
 * target/arm: Fix LD1W and LDFF1W (scalar plus vector)

----------------------------------------------------------------
Andrew Jeffery (1):
      aspeed: Implement write-1-{set, clear} for AST2500 strapping

Guenter Roeck (1):
      bcm2835_aux: Swap RX and TX interrupt assignments

Peter Maydell (4):
      hw/intc/arm_gic: Check interrupt number in gic_deactivate_irq()
      hw/intc/arm_gic: Fix handling of GICD_ITARGETSR
      accel/tcg: Use correct test when looking in victim TLB for code
      accel/tcg: Assert that tlb fill gave us a valid TLB entry

Richard Henderson (1):
      target/arm: Fix LD1W and LDFF1W (scalar plus vector)

Thomas Huth (1):
      hw/arm/bcm2836: Mark the bcm2836 / bcm2837 devices with user_creatable = false

From: Richard Henderson <richard.henderson@linaro.org>

'I' was being double-incremented; correctly within the inner loop
and incorrectly within the outer loop.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180711103957.3040-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm,       \
     intptr_t i, oprsz = simd_oprsz(desc);                               \
     unsigned scale = simd_data(desc);                                   \
     uintptr_t ra = GETPC();                                             \
-    for (i = 0; i < oprsz; i++) {                                       \
+    for (i = 0; i < oprsz; ) {                                          \
         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));                 \
         do {                                                            \
             TYPEM m = 0;                                                \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(CPUARMState *env, void *vd, void *vg, void *vm,       \
     uintptr_t ra = GETPC();                                             \
     bool first = true;                                                  \
     mmap_lock();                                                        \
-    for (i = 0; i < oprsz; i++) {                                       \
+    for (i = 0; i < oprsz; ) {                                          \
         uint16_t pg = *(uint16_t *)(vg + H1_2(i >> 3));                 \
         do {                                                            \
             TYPEM m = 0;                                                \
-- 
2.17.1

From: Andrew Jeffery <andrew@aj.id.au>

The AST2500 SoC family changes the runtime behaviour of the hardware
strapping register (SCU70) to write-1-set/write-1-clear, with
write-1-clear implemented on the "read-only" SoC revision register
(SCU7C). For the the AST2400, the hardware strapping is
runtime-configured with read-modify-write semantics.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20180709143524.17480-1-andrew@aj.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h |  2 ++
 hw/misc/aspeed_scu.c         | 19 +++++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
 #define AST2500_A0_SILICON_REV   0x04000303U
 #define AST2500_A1_SILICON_REV   0x04010303U
 
+#define ASPEED_IS_AST2500(si_rev)     ((((si_rev) >> 24) & 0xff) == 0x04)
+
 extern bool is_supported_silicon_rev(uint32_t silicon_rev);
 
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[reg] = data;
         aspeed_scu_set_apb_freq(s);
         break;
-
+    case HW_STRAP1:
+        if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
+            s->regs[HW_STRAP1] |= data;
+            return;
+        }
+        /* Jump to assignment below */
+        break;
+    case SILICON_REV:
+        if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
+            s->regs[HW_STRAP1] &= ~data;
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
+                          __func__, offset);
+        }
+        /* Avoid assignment below, we've handled everything */
+        return;
     case FREQ_CNTR_EVAL:
     case VGA_SCRATCH1 ... VGA_SCRATCH8:
     case RNG_DATA:
-    case SILICON_REV:
     case FREE_CNTR4:
     case FREE_CNTR4_EXT:
         qemu_log_mask(LOG_GUEST_ERROR,
-- 
2.17.1

In gic_deactivate_irq() the interrupt number comes from the guest
(on a write to the GICC_DIR register), so we need to sanity check
that it isn't out of range before we use it as an array index.
Handle this in a similar manner to the check we do in
gic_complete_irq() for the GICC_EOI register.

The array overrun is not disastrous because the calling code
uses (value & 0x3ff) to extract the interrupt field, so the
only out-of-range values possible are 1020..1023, which allow
overrunning only from irq_state[] into the following
irq_target[] array which the guest can already manipulate.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180712154152.32183-2-peter.maydell@linaro.org
---
 hw/intc/arm_gic.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static bool gic_eoi_split(GICState *s, int cpu, MemTxAttrs attrs)
 static void gic_deactivate_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
 {
     int cm = 1 << cpu;
-    int group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
+    int group;
+
+    if (irq >= s->num_irq) {
+        /*
+         * This handles two cases:
+         * 1. If software writes the ID of a spurious interrupt [ie 1023]
+         * to the GICC_DIR, the GIC ignores that write.
+         * 2. If software writes the number of a non-existent interrupt
+         * this must be a subcase of "value written is not an active interrupt"
+         * and so this is UNPREDICTABLE. We choose to ignore it.
+         */
+        return;
+    }
+
+    group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
 
     if (!gic_eoi_split(s, cpu, attrs)) {
         /* This is UNPREDICTABLE; we choose to ignore it */
-- 
2.17.1

The GICD_ITARGETSR implementation still has some 11MPCore behaviour
that we were incorrectly using in our GICv1 and GICv2 implementations
for the case where the interrupt number is less than GIC_INTERNAL.
The desired behaviour here is:
 * for 11MPCore: RAZ/WI for irqs 0..28; read a number matching the
   CPU doing the read for irqs 29..31
 * for GICv1 and v2: RAZ/WI if uniprocessor; otherwise read a
   number matching the CPU doing the read for all irqs < 32

Stop squashing GICD_ITARGETSR to 0 for IRQs 0..28 unless this
is an 11MPCore GIC.

Reported-by: Jan Kiszka <jan.kiszka@web.de>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180712154152.32183-3-peter.maydell@linaro.org
---
 hw/intc/arm_gic.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             if (irq >= s->num_irq) {
                 goto bad_reg;
             }
-            if (irq >= 29 && irq <= 31) {
+            if (irq < 29 && s->revision == REV_11MPCORE) {
+                res = 0;
+            } else if (irq < GIC_INTERNAL) {
                 res = cm;
             } else {
                 res = GIC_TARGET(irq);
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
             if (irq >= s->num_irq) {
                 goto bad_reg;
             }
-            if (irq < 29) {
+            if (irq < 29 && s->revision == REV_11MPCORE) {
                 value = 0;
             } else if (irq < GIC_INTERNAL) {
                 value = ALL_CPU_MASK;
-- 
2.17.1

From: Thomas Huth <thuth@redhat.com>

These devices are currently causing some problems when a user is trying
to hot-plug or introspect them during runtime. Since these devices can
not be instantiated by the user at all (they need to be wired up in code
instead), we should mark them with user_creatable = false anyway, then we
avoid at least the crashes with the hot-plugging. The introspection problem
will be handled by a separate patch.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1531415537-26037-1-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/bcm2836.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm283x_class_init(ObjectClass *oc, void *data)
     bc->info = data;
     dc->realize = bcm2836_realize;
     dc->props = bcm2836_props;
+    /* Reason: Must be wired up in code (see raspi_init() function) */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo bcm283x_type_info = {
-- 
2.17.1

From: Guenter Roeck <linux@roeck-us.net>

RX and TX interrupt bits were reversed, resulting in an endless sequence
of serial interupts in the emulated system and the following repeated
error message when booting Linux.

serial8250: too much work for irq61

This results in a boot failure most of the time.

Qemu command line used to reproduce the problem:

qemu-system-aarch64 -M raspi3 -m 1024 \
	-kernel arch/arm64/boot/Image \
	--append "rdinit=/sbin/init console=ttyS1,115200"
	-initrd rootfs.cpio \
	-dtb arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dtb \
	-nographic -monitor null -serial null -serial stdio

This is with arm64:defconfig. The root file system was generated using
buildroot.

NB that this error likely arises from an erratum in the
BCM2835 datasheet where the TX and RX bits were swapped
in the AU_MU_IER_REG description (but correct for IIR):
 https://elinux.org/BCM2835_datasheet_errata#p12

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1529355846-25102-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added NB about datasheet]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/bcm2835_aux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -XXX,XX +XXX,XX @@
 #define AUX_MU_BAUD_REG 0x68
 
 /* bits in IER/IIR registers */
-#define TX_INT  0x1
-#define RX_INT  0x2
+#define RX_INT  0x1
+#define TX_INT  0x2
 
 static void bcm2835_aux_update(BCM2835AuxState *s)
 {
-- 
2.17.1

In get_page_addr_code(), we were incorrectly looking in the victim
TLB for an entry which matched the target address for reads, not
for code accesses. This meant that we could hit on a victim TLB
entry that indicated that the address was readable but not
executable, and incorrectly bypass the call to tlb_fill() which
should generate the guest MMU exception. Fix this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180713141636.18665-2-peter.maydell@linaro.org
---
 accel/tcg/cputlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
     index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     mmu_idx = cpu_mmu_index(env, true);
     if (unlikely(!tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr))) {
-        if (!VICTIM_TLB_HIT(addr_read, addr)) {
+        if (!VICTIM_TLB_HIT(addr_code, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
         }
     }
-- 
2.17.1

In commit 4b1a3e1e34ad97 we added a check for whether the TLB entry
we had following a tlb_fill had the INVALID bit set.  This could
happen in some circumstances because a stale or wrong TLB entry was
pulled out of the victim cache.  However, after commit
68fea038553039e (which prevents stale entries being in the victim
cache) and the previous commit (which ensures we don't incorrectly
hit in the victim cache)) this should never be possible.

Drop the check on TLB_INVALID_MASK from the "is this a TLB_RECHECK?"
condition, and instead assert that the tlb fill procedure has given
us a valid TLB entry (or longjumped out with a guest exception).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180713141636.18665-3-peter.maydell@linaro.org
---
 accel/tcg/cputlb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
         if (!VICTIM_TLB_HIT(addr_code, addr)) {
             tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
         }
+        assert(tlb_hit(env->tlb_table[mmu_idx][index].addr_code, addr));
     }
 
-    if (unlikely((env->tlb_table[mmu_idx][index].addr_code &
-                  (TLB_RECHECK | TLB_INVALID_MASK)) == TLB_RECHECK)) {
+    if (unlikely(env->tlb_table[mmu_idx][index].addr_code & TLB_RECHECK)) {
         /*
          * This is a TLB_RECHECK access, where the MMU protection
          * covers a smaller range than a target page, and we must
-- 
2.17.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1