target-arm queue for 3.0:

The following changes since commit 55b1f14cefcb19ce6d5e28c4c83404230888aa7e:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging (2018-07-23 14:03:14 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180723

for you to fetch changes up to 1ddc9b98c3cb89fe23a55ba924000fd645253e87:

hw/intc/exynos4210_gic: Turn instance_init into realize function (2018-07-23 15:21:27 +0100)

* spitz, exynos: fix bugs when introspecting some devices

* hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

* target/arm: Correctly handle overlapping small MPU regions

* hw/sd/bcm2835_sdhost: Fix PIO mode writes

Guenter Roeck (1):

hw/sd/bcm2835_sdhost: Fix PIO mode writes

target/arm: Correctly handle overlapping small MPU regions

Thomas Huth (3):

hw/microblaze/xlnx-zynqmp-pmu: Fix introspection problem in 'xlnx, zynqmp-pmu-soc'

hw/arm/spitz: Move problematic nand_init() code to realize function

hw/intc/exynos4210_gic: Turn instance_init into realize function

hw/arm/spitz.c | 15 ++++++++++----

hw/intc/exynos4210_gic.c | 6 +++---

hw/microblaze/xlnx-zynqmp-pmu.c | 10 ++++-----

hw/sd/bcm2835_sdhost.c | 20 ++++++++++++++----

target/arm/helper.c | 46 +++++++++++++++++++++++++++++++++++++++++

5 files changed, 80 insertions(+), 17 deletions(-)

From: Guenter Roeck <linux@roeck-us.net>

Writes in PIO mode have two requirements:

- A data interrupt must be generated after a write command has been

issued to indicate that the chip is ready to receive data.

- A block interrupt must be generated after each block to indicate

that the chip is ready to receive the next data block.

Rearrange the code to make this happen. Tested on raspi3 (in PIO mode)

and raspi2 (in DMA mode).

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 1531779837-20557-1-git-send-email-linux@roeck-us.net

hw/sd/bcm2835_sdhost.c | 20 ++++++++++++++++----

1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/hw/sd/bcm2835_sdhost.c b/hw/sd/bcm2835_sdhost.c

--- a/hw/sd/bcm2835_sdhost.c

+++ b/hw/sd/bcm2835_sdhost.c

@@ -XXX,XX +XXX,XX @@ static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s)

uint32_t value = 0;

int n;

int is_read;

+ int is_write;

is_read = (s->cmd & SDCMD_READ_CMD) != 0;

- if (s->datacnt != 0 && (!is_read || sdbus_data_ready(&s->sdbus))) {

+ is_write = (s->cmd & SDCMD_WRITE_CMD) != 0;

+ if (s->datacnt != 0 && (is_write || sdbus_data_ready(&s->sdbus))) {

if (is_read) {

n = 0;

while (s->datacnt && s->fifo_len < BCM2835_SDHOST_FIFO_LEN) {

@@ -XXX,XX +XXX,XX @@ static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s)

if (n != 0) {

bcm2835_sdhost_fifo_push(s, value);

s->status |= SDHSTS_DATA_FLAG;

+ if (s->config & SDHCFG_DATA_IRPT_EN) {

+ s->status |= SDHSTS_SDIO_IRPT;

+ }

}

- } else { /* write */

+ } else if (is_write) { /* write */

n = 0;

while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) {

if (n == 0) {

@@ -XXX,XX +XXX,XX @@ static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s)

s->edm &= ~SDEDM_FSM_MASK;

s->edm |= SDEDM_FSM_DATAMODE;

trace_bcm2835_sdhost_edm_change("datacnt 0", s->edm);

-

- if ((s->cmd & SDCMD_WRITE_CMD) &&

+ if (is_write) {

+ /* set block interrupt at end of each block transfer */

+ if (s->hbct && s->datacnt % s->hbct == 0 &&

(s->config & SDHCFG_BLOCK_IRPT_EN)) {

s->status |= SDHSTS_BLOCK_IRPT;

}

+ /* set data interrupt after each transfer */

+ s->status |= SDHSTS_DATA_FLAG;

+ if (s->config & SDHCFG_DATA_IRPT_EN) {

+ s->status |= SDHSTS_SDIO_IRPT;

+ }

2.17.1

From: Thomas Huth <thuth@redhat.com>

The instance_init function of the "exynos4210.gic" device creates a

new "arm_gic" device and immediately realizes it with qdev_init_nofail().

This will leave a lot of object in the QOM tree during introspection of

the "exynos4210.gic" device, e.g. reproducible by starting QEMU like this:

qemu-system-aarch64 -M none -nodefaults -nographic -monitor stdio

And then by running "info qom-tree" at the HMP monitor, followed by

"device_add exynos4210.gic,help" and finally checking "info qom-tree"

again.

Also note that qdev_init_nofail() can exit QEMU in case of errors - and

this must never happen during an instance_init function, otherwise QEMU

could terminate unexpectedly during introspection of a device.

Since most of the code that follows the qdev_init_nofail() depends on

the realized "gicbusdev", the easiest solution to the problem is to

turn the whole instance_init function into a realize function instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>

Message-id: 1532337784-334-1-git-send-email-thuth@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/intc/exynos4210_gic.c | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c

--- a/hw/intc/exynos4210_gic.c

+++ b/hw/intc/exynos4210_gic.c

@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_set_irq(void *opaque, int irq, int level)

qemu_set_irq(qdev_get_gpio_in(s->gic, irq), level);

-static void exynos4210_gic_init(Object *obj)

+static void exynos4210_gic_realize(DeviceState *dev, Error **errp)

{

- DeviceState *dev = DEVICE(obj);

+ Object *obj = OBJECT(dev);

Exynos4210GicState *s = EXYNOS4210_GIC(obj);

SysBusDevice *sbd = SYS_BUS_DEVICE(obj);

const char cpu_prefix[] = "exynos4210-gic-alias_cpu";

@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_class_init(ObjectClass *klass, void *data)

DeviceClass *dc = DEVICE_CLASS(klass);

dc->props = exynos4210_gic_properties;

+ dc->realize = exynos4210_gic_realize;

static const TypeInfo exynos4210_gic_info = {

.name = TYPE_EXYNOS4210_GIC,

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(Exynos4210GicState),

- .instance_init = exynos4210_gic_init,

.class_init = exynos4210_gic_class_init,

2.17.1