Series comparison

-[Qemu-devel] [PULL 00/10] target-arm queue
+[PULL 00/16] target-arm queue
-Some Arm bugfixes for rc2...
+Patches for rc1: nothing major, just some minor bugfixes and
 code cleanups.
-thanks
 -- PMM
-The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * various MAINTAINERS file updates
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * hw/block/onenand: use qemu_log_mask() for reporting
+ * Minor coding style fixes
- * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
+ * docs: add some notes on the sbsa-ref machine
-   on the n800 and n810 machine models
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * target/arm: fix smc incorrectly trapping to EL3 when secure is off
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * hw/arm/stm32f205: Fix the UART and Timer region size
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * target/arm: read ID registers for KVM guests so they can be
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
-   used to gate "is feature X present" checks
+ * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Luc Michel (1):
+Alex Bennée (1):
-      target/arm: fix smc incorrectly trapping to EL3 when secure is off
+      docs: add some notes on the sbsa-ref machine
-Peter Maydell (3):
+AlexChen (1):
-      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
+      ssi: Fix bad printf format specifiers
       hw/block/onenand: use qemu_log_mask() for reporting
       MAINTAINERS: list myself as maintainer for various Arm boards
-Richard Henderson (4):
+Andrew Jones (1):
-      target/arm: Install ARMISARegisters from kvm host
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
       target/arm: Fill in ARMISARegisters for kvm64
       target/arm: Introduce read_sys_reg32 for kvm32
       target/arm: Fill in ARMISARegisters for kvm32
-Seth Kintigh (1):
+Havard Skinnemoen (1):
-      hw/arm/stm32f205: Fix the UART and Timer region size
+      tests/qtest/npcm7xx_rng-test: count runs properly
-Thomas Huth (1):
+Peter Maydell (2):
-      MAINTAINERS: Add entries for missing ARM boards
+      hw/arm/nseries: Check return value from load_image_targphys()
       target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
- target/arm/kvm_arm.h       |   1 +
+Philippe Mathieu-Daudé (6):
- hw/block/onenand.c         |  24 +++++-----
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- hw/char/stm32f2xx_usart.c  |   2 +-
+      hw/arm/armsse: Correct expansion MPC interrupt lines
- hw/timer/stm32f2xx_timer.c |   2 +-
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
- target/arm/kvm.c           |   1 +
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
- target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
- target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  target/arm/op_helper.c     |  54 +++++++++++++++++++----
  MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
 files changed, 293 insertions(+), 64 deletions(-)
+Richard Henderson (1):
+      target/arm: Fix neon VTBL/VTBX for len > 1
+Xinhao Zhang (3):
+      target/arm: add spaces around operator
+      target/arm: Don't use '#' flag of printf format
+      target/arm: add space before the open parenthesis '('
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-New patch
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+From: Andrew Jones <drjones@redhat.com>
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
+in the build when building armv7m_systick.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
+ config ARM_V7M
+     bool
++    select PTIMER
+ config ALLWINNER_A10
+     bool
+--
+.20.1

-[Qemu-devel] [PULL 06/10] hw/arm/stm32f205: Fix the UART and Timer region size
+[PULL 02/16] ssi: Fix bad printf format specifiers
-From: Seth Kintigh <skintigh@gmail.com>
+From: AlexChen <alex.chen@huawei.com>
-The UART and timer devices for the stm32f205 were being created
+We should use printf format specifier "%u" instead of "%d" for
-with memory regions that were too large. Use the size specified
+argument of type "unsigned int".
 in the chip datasheet.
-The old sizes were so large that the devices would overlap with
+Reported-by: Euler Robot <euler.robot@huawei.com>
-each other in the SoC memory map, so this fixes a bug that
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
-caused odd behavior and/or crashes when trying to set up multiple
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-UARTs.
+Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Seth Kintigh <skintigh@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: rephrased commit message to follow our usual standard]
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/stm32f2xx_usart.c  | 2 +-
+ hw/ssi/imx_spi.c    | 2 +-
- hw/timer/stm32f2xx_timer.c | 2 +-
+ hw/ssi/xilinx_spi.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/stm32f2xx_usart.c
+--- a/hw/ssi/imx_spi.c
-+++ b/hw/char/stm32f2xx_usart.c
++++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
-     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+     case ECSPI_MSGDATA:
+         return  "ECSPI_MSGDATA";
-     memory_region_init_io(&s->mmio, obj, &stm32f2xx_usart_ops, s,
+     default:
--                          TYPE_STM32F2XX_USART, 0x2000);
+-        sprintf(unknown, "%d ?", reg);
-+                          TYPE_STM32F2XX_USART, 0x400);
++        sprintf(unknown, "%u ?", reg);
-     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+         return unknown;
      }
  }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
 diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/stm32f2xx_timer.c
+--- a/hw/ssi/xilinx_spi.c
-+++ b/hw/timer/stm32f2xx_timer.c
++++ b/hw/ssi/xilinx_spi.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_timer_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
-     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+        irq chain unless things really changed.  */
+     if (pending != s->irqline) {
-     memory_region_init_io(&s->iomem, obj, &stm32f2xx_timer_ops, s,
+         s->irqline = pending;
--                          "stm32f2xx_timer", 0x4000);
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
-+                          "stm32f2xx_timer", 0x400);
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
-     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+         qemu_set_irq(s->irq, pending);
-     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
+     }
 --
-.19.1
+.20.1

-New patch
+[PULL 03/16] target/arm: add spaces around operator
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Operator needs spaces both sides.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/arch_dump.c | 8 ++++----
+ target/arm/arm-semi.c  | 8 ++++----
+ target/arm/helper.c    | 2 +-
+files changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arch_dump.c
++++ b/target/arm/arch_dump.c
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     }
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
+         for (i = 0; i < 32; ++i) {
+             uint64_t tmp = note.vfp.vregs[2*i];
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-            note.vfp.vregs[2*i+1] = tmp;
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++            note.vfp.vregs[2 * i + 1] = tmp;
+         }
+     }
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         if (use_gdb_syscalls()) {
+             arm_semi_open_guestfd = guestfd;
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
+         } else {
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
+             if (ret == (uint32_t)-1) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
+-                                  arg0, (int)arg1+1);
++                                  arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(3);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
+         } else {
+             char *s2;
+             s = lock_user_string(arg0);
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
+-                                   arg0, (int)arg1+1);
++                                   arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
+     uint32_t sum;
+     sum = do_usad(a, b);
+     sum += do_usad(a >> 8, b >> 8);
+-    sum += do_usad(a >> 16, b >>16);
++    sum += do_usad(a >> 16, b >> 16);
+     sum += do_usad(a >> 24, b >> 24);
+     return sum;
+ }
+--
+.20.1

-[Qemu-devel] [PULL 07/10] target/arm: fix smc incorrectly trapping to EL3 when secure is off
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-From: Luc Michel <luc.michel@greensocs.com>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-This commit fixes a case where the CPU would try to go to EL3 when
+Fix code style. Don't use '#' flag of printf format ('%#') in
-executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
+format strings, use '0x' prefix instead
 case is raised when the PSCI conduit is set to smc, but the smc
 instruction does not lead to a valid PSCI call.
-QEMU crashes with an assertion failure latter on because of incoherent
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-mmu_idx.
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 This commit refactors the pre_smc helper by enumerating all the possible
 way of handling an scm instruction, and covering the previously missing
 case leading to the crash.
 The following minimal test would crash before this commit:
 .global _start
     .text
 _start:
     ldr x0, =0xdeadbeef  ; invalid PSCI call
     smc #0
 run with the following command line:
 aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                       -o test test.s
 qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                     -cpu cortex-a57 -kernel test
 Signed-off-by: Luc Michel <luc.michel@greensocs.com>
 Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/op_helper.c | 54 +++++++++++++++++++++++++++++++++++-------
+ target/arm/translate-a64.c | 4 ++--
-file changed, 46 insertions(+), 8 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/op_helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
-     ARMCPU *cpu = arm_env_get_cpu(env);
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
-     int cur_el = arm_current_el(env);
+                 break;
-     bool secure = arm_is_secure(env);
+             default:
--    bool smd = env->cp15.scr_el3 & SCR_SMD;
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-+    bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
-+
+                         __func__, insn, fpopcode, s->pc_curr);
-+    /*
+                 g_assert_not_reached();
-+     * SMC behaviour is summarized in the following table.
+             }
-+     * This helper handles the "Trap to EL2" and "Undef insn" cases.
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
-+     * The "Trap to EL3" and "PSCI call" cases are handled in the exception
+     case 0x7f: /* FSQRT (vector) */
-+     * helper.
+         break;
-+     *
+     default:
-+     *  -> ARM_FEATURE_EL3 and !SMD
+-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
-+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
++        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
-+     *
+         g_assert_not_reached();
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Trap to EL3
 +     *  Conduit not SMC          Trap to EL2         Trap to EL3
 +     *
 +     *
 +     *  -> ARM_FEATURE_EL3 and SMD
 +     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
 +     *
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Undef insn
 +     *  Conduit not SMC          Trap to EL2         Undef insn
 +     *
 +     *
 +     *  -> !ARM_FEATURE_EL3
 +     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
 +     *
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Undef insn
 +     *  Conduit not SMC          Undef insn          Undef insn
 +     */
 +
      /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
       * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
       *  extensions, SMD only applies to NS state.
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
       * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
       * so we need not special case this here.
       */
 -    bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 +    bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
 +                                                     : smd_flag && !secure;
      if (!arm_feature(env, ARM_FEATURE_EL3) &&
          cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
           * to forbid its EL1 from making PSCI calls into QEMU's
           * "firmware" via HCR.TSC, so for these purposes treat
           * PSCI-via-SMC as implying an EL3.
 +         * This handles the very last line of the previous table.
           */
 -        undef = true;
 -    } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 +        raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 +                        exception_target_el(env));
 +    }
 +
 +    if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
          /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
           * We also want an EL2 guest to be able to forbid its EL1 from
           * making PSCI calls into QEMU's "firmware" via HCR.TSC.
 +         * This handles all the "Trap to EL2" cases of the previous table.
           */
          raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
      }
--    /* If PSCI is enabled and this looks like a valid PSCI call then
--     * suppress the UNDEF -- we'll catch the SMC exception and
--     * implement the PSCI call behaviour there.
-+    /* Catch the two remaining "Undef insn" cases of the previous table:
-+     *    - PSCI conduit is SMC but we don't have a valid PCSI call,
-+     *    - We don't have EL3 or SMD is set.
-      */
--    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
-+    if (!arm_is_psci_call(cpu, EXCP_SMC) &&
-+        (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
-         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
-                         exception_target_el(env));
-     }
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 08/10] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-An off-by-one error in a switch case in onenand_read() allowed
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
 a misbehaving guest to read off the end of a block of memory.
-NB: the onenand device is used only by the "n800" and "n810"
+Fix code style. Space required before the open parenthesis '('.
 machines, which are usable only with TCG, not KVM, so this is
 not a security issue.
-Reported-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/block/onenand.c | 2 +-
+ target/arm/translate.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/block/onenand.c b/hw/block/onenand.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/onenand.c
+--- a/target/arm/translate.c
-+++ b/hw/block/onenand.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     int offset = addr >> s->shift;
+             - Hardware watchpoints.
+            Hardware breakpoints have already been handled and skip this code.
-     switch (offset) {
+          */
--    case 0x0000 ... 0xc000:
+-        switch(dc->base.is_jmp) {
-+    case 0x0000 ... 0xbffe:
++        switch (dc->base.is_jmp) {
-         return lduw_le_p(s->boot[0] + addr);
+         case DISAS_NEXT:
+         case DISAS_TOO_MANY:
-     case 0xf000:    /* Manufacturer ID */
+             gen_goto_tb(dc, 1, dc->base.pc_next);
 --
-.19.1
+.20.1

-New patch
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
+From: Alex Bennée <alex.bennee@linaro.org>
+We should at least document what this machine is about.
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
+Cc: Leif Lindholm <leif@nuviainc.com>
+Cc: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+[PMM: fixed filename mismatch]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
+ docs/system/target-arm.rst |  1 +
+files changed, 33 insertions(+)
+ create mode 100644 docs/system/arm/sbsa.rst
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/docs/system/arm/sbsa.rst
+@@ -XXX,XX +XXX,XX @@
++Arm Server Base System Architecture Reference board (``sbsa-ref``)
++==================================================================
++
++While the `virt` board is a generic board platform that doesn't match
++any real hardware the `sbsa-ref` board intends to look like real
++hardware. The `Server Base System Architecture
++<https://developer.arm.com/documentation/den0029/latest>` defines a
++minimum base line of hardware support and importantly how the firmware
++reports that to any operating system. It is a static system that
++reports a very minimal DT to the firmware for non-discoverable
++information about components affected by the qemu command line (i.e.
++cpus and memory). As a result it must have a firmware specifically
++built to expect a certain hardware layout (as you would in a real
++machine).
++
++It is intended to be a machine for developing firmware and testing
++standards compliance with operating systems.
++
++Supported devices
++"""""""""""""""""
++
++The sbsa-ref board supports:
++
++  - A configurable number of AArch64 CPUs
++  - GIC version 3
++  - System bus AHCI controller
++  - System bus EHCI controller
++  - CDROM and hard disc on AHCI bus
++  - E1000E ethernet card on PCIe bus
++  - VGA display adaptor on PCIe bus
++  - A generic SBSA watchdog device
++
+diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/target-arm.rst
++++ b/docs/system/target-arm.rst
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+    arm/mps2
+    arm/musca
+    arm/realview
++   arm/sbsa
+    arm/versatile
+    arm/vexpress
+    arm/aspeed
+--
+.20.1

-New patch
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+When using a Cortex-A15, the Virt machine does not use any
+MPCore peripherals. Remove the dependency.
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201107114852.271922-1-philmd@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+     imply VFIO_PLATFORM
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
+-    select A15MPCORE
+     select ACPI
+     select ARM_SMMUV3
+     select GPIO_KEY
+--
+.20.1

-[Qemu-devel] [PULL 03/10] target/arm: Introduce read_sys_reg32 for kvm32
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
 From: Richard Henderson <richard.henderson@linaro.org>
-Assert that the value to be written is the correct size.
+The helper function did not get updated when we reorganized
-No change in functionality here, just mirroring the same
+the vector register file for SVE.  Since then, the neon dregs
-function from kvm64.
+are non-sequential and cannot be simply indexed.
+At the same time, make the helper function operate on 64-bit
+quantities so that we do not have to call it twice.
+Fixes: c39c2b9043e
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
+[PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm32.c | 41 ++++++++++++++++-------------------------
+ target/arm/helper.h             |  2 +-
-file changed, 16 insertions(+), 25 deletions(-)
+ target/arm/op_helper.c          | 23 +++++++++--------
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm32.c
+--- a/target/arm/helper.h
-+++ b/target/arm/kvm32.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ static inline void set_feature(uint64_t *features, int feature)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
-     *features |= 1ULL << feature;
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
  DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
  DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
 -DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
-+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-+{
+-                          uint32_t maxindex)
-+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
++uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
-+
++                          uint64_t ireg, uint64_t def)
 +    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32);
 +    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +}
 +
  bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
  {
-     /* Identify the feature bits corresponding to the host CPU, and
+-    uint32_t val, shift;
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+-    uint64_t *table = vn;
-      * we have to create a scratch VM, create a single CPU inside it,
++    uint64_t tmp, val = 0;
-      * and then query that CPU for the relevant ID registers.
++    uint32_t maxindex = ((desc & 3) + 1) * 8;
-      */
++    uint32_t base_reg = desc >> 2;
--    int i, ret, fdarray[3];
++    uint32_t shift, index, reg;
-+    int err = 0, fdarray[3];
-     uint32_t midr, id_pfr0, mvfr1;
+-    val = 0;
-     uint64_t features = 0;
+-    for (shift = 0; shift < 32; shift += 8) {
-+
+-        uint32_t index = (ireg >> shift) & 0xff;
-     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
++    for (shift = 0; shift < 64; shift += 8) {
-      * we know these will only support creating one kind of guest CPU,
++        index = (ireg >> shift) & 0xff;
-      * which is its preferred CPU type.
+         if (index < maxindex) {
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-         QEMU_KVM_ARM_TARGET_NONE
+-            val |= tmp << shift;
-     };
++            reg = base_reg + (index >> 3);
-     struct kvm_vcpu_init init;
++            tmp = *aa32_vfp_dreg(env, reg);
--    struct kvm_one_reg idregs[] = {
++            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
--        {
+         } else {
--            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
+-            val |= def & (0xff << shift);
--            | ENCODE_CP_REG(15, 0, 0, 0, 0, 0, 0),
++            tmp = def & (0xffull << shift);
--            .addr = (uintptr_t)&midr,
+         }
--        },
++        val |= tmp;
--        {
+     }
--            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
+     return val;
--            | ENCODE_CP_REG(15, 0, 0, 0, 1, 0, 0),
+ }
--            .addr = (uintptr_t)&id_pfr0,
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
--        },
+index XXXXXXX..XXXXXXX 100644
--        {
+--- a/target/arm/translate-neon.c.inc
--            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
++++ b/target/arm/translate-neon.c.inc
--            | KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1,
+@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
--            .addr = (uintptr_t)&mvfr1,
--        },
+ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
--    };
+ {
+-    int n;
-     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
+-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-      */
+         return true;
-     ahcf->dtb_compatible = "arm,arm-v7";
+     }
--    for (i = 0; i < ARRAY_SIZE(idregs); i++) {
+-    n = a->len + 1;
--        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &idregs[i]);
+-    if ((a->vn + n) > 32) {
--        if (ret) {
++    if ((a->vn + a->len + 1) > 32) {
--            break;
+         /*
--        }
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
--    }
+          * helper function running off the end of the register file.
-+    err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
+          */
 +    err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
 +    err |= read_sys_reg32(fdarray[2], &mvfr1,
 +                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
 +                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
 -    if (ret) {
 +    if (err < 0) {
          return false;
      }
+-    n <<= 3;
+-    tmp = tcg_temp_new_i32();
+-    if (a->op) {
+-        read_neon_element32(tmp, a->vd, 0, MO_32);
+-    } else {
+-        tcg_gen_movi_i32(tmp, 0);
+-    }
+-    tmp2 = tcg_temp_new_i32();
+-    read_neon_element32(tmp2, a->vm, 0, MO_32);
+-    ptr1 = vfp_reg_ptr(true, a->vn);
+-    tmp4 = tcg_const_i32(n);
+-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
++    desc = tcg_const_i32((a->vn << 2) | a->len);
++    def = tcg_temp_new_i64();
+     if (a->op) {
+-        read_neon_element32(tmp, a->vd, 1, MO_32);
++        read_neon_element64(def, a->vd, 0, MO_64);
+     } else {
+-        tcg_gen_movi_i32(tmp, 0);
++        tcg_gen_movi_i64(def, 0);
+     }
+-    tmp3 = tcg_temp_new_i32();
+-    read_neon_element32(tmp3, a->vm, 1, MO_32);
+-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
+-    tcg_temp_free_i32(tmp);
+-    tcg_temp_free_i32(tmp4);
+-    tcg_temp_free_ptr(ptr1);
++    val = tcg_temp_new_i64();
++    read_neon_element64(val, a->vm, 0, MO_64);
+-    write_neon_element32(tmp2, a->vd, 0, MO_32);
+-    write_neon_element32(tmp3, a->vd, 1, MO_32);
+-    tcg_temp_free_i32(tmp2);
+-    tcg_temp_free_i32(tmp3);
++    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
++    write_neon_element64(val, a->vd, 0, MO_64);
++
++    tcg_temp_free_i64(def);
++    tcg_temp_free_i64(val);
++    tcg_temp_free_i32(desc);
+     return true;
+ }
 --
-.19.1
+.20.1

-New patch
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We can use one MPC per SRAM bank, but we currently only wire the
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/armsse.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                                         qdev_get_gpio_in(dev_splitter, 0));
+             qdev_connect_gpio_out(dev_splitter, 0,
+                                   qdev_get_gpio_in_named(dev_secctl,
+-                                                         "mpc_status", 0));
++                                                         "mpc_status",
++                                                         i - IOTS_NUM_EXP_MPC));
+         }
+         qdev_connect_gpio_out(dev_splitter, 1,
+--
+.20.1

-New patch
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The system configuration controller (SYSCFG) doesn't have
+any output IRQ (and the INTC input #71 belongs to the UART6).
+Remove the invalid code.
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
+ hw/arm/stm32f205_soc.c             | 1 -
+ hw/misc/stm32f2xx_syscfg.c         | 2 --
+files changed, 5 deletions(-)
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/misc/stm32f2xx_syscfg.h
++++ b/include/hw/misc/stm32f2xx_syscfg.h
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
+     uint32_t syscfg_exticr3;
+     uint32_t syscfg_exticr4;
+     uint32_t syscfg_cmpcr;
+-
+-    qemu_irq irq;
+ };
+ #endif /* HW_STM32F2XX_SYSCFG_H */
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
+     }
+     busdev = SYS_BUS_DEVICE(dev);
+     sysbus_mmio_map(busdev, 0, 0x40013800);
+-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
+     /* Attach UART (uses USART registers) and USART controllers */
+     for (i = 0; i < STM_NUM_USARTS; i++) {
+diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/stm32f2xx_syscfg.c
++++ b/hw/misc/stm32f2xx_syscfg.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
+ {
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+-
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+--
+.20.1

-[Qemu-devel] [PULL 04/10] target/arm: Fill in ARMISARegisters for kvm32
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
+OMAP2 chip support") takes care of creating the 3 UARTs.
 Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
 extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm32.c | 40 +++++++++++++++++++++++++++++++++++-----
+ hw/arm/nseries.c | 11 -----------
-file changed, 35 insertions(+), 5 deletions(-)
+file changed, 11 deletions(-)
-diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm32.c
+--- a/hw/arm/nseries.c
-+++ b/target/arm/kvm32.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
-      * and then query that CPU for the relevant ID registers.
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
-      */
+ }
-     int err = 0, fdarray[3];
--    uint32_t midr, id_pfr0, mvfr1;
+-static void n8x0_uart_setup(struct n800_s *s)
-+    uint32_t midr, id_pfr0;
+-{
-     uint64_t features = 0;
+-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
+-    /*
-     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
+-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+-     * here, but this code has been removed with the bluetooth backend.
+-     */
-     err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
+-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-     err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
+-}
--    err |= read_sys_reg32(fdarray[2], &mvfr1,
+-
-+
+ static void n8x0_usb_setup(struct n800_s *s)
-+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+ {
-+                          ARM_CP15_REG32(0, 0, 2, 0));
+     SysBusDevice *dev;
-+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-+                          ARM_CP15_REG32(0, 0, 2, 1));
+     n8x0_spi_setup(s);
-+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+     n8x0_dss_setup(s);
-+                          ARM_CP15_REG32(0, 0, 2, 2));
+     n8x0_cbus_setup(s);
-+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+-    n8x0_uart_setup(s);
-+                          ARM_CP15_REG32(0, 0, 2, 3));
+     if (machine_usb(machine)) {
-+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+         n8x0_usb_setup(s);
 +                          ARM_CP15_REG32(0, 0, 2, 4));
 +    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
 +                          ARM_CP15_REG32(0, 0, 2, 5));
 +    if (read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
 +                       ARM_CP15_REG32(0, 0, 2, 7))) {
 +        /*
 +         * Older kernels don't support reading ID_ISAR6. This register was
 +         * only introduced in ARMv8, so we can assume that it is zero on a
 +         * CPU that a kernel this old is running on.
 +         */
 +        ahcf->isar.id_isar6 = 0;
 +    }
 +
 +    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
 +                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
 +                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR0);
 +    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
                            KVM_REG_ARM | KVM_REG_SIZE_U32 |
                            KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
 +    /*
 +     * FIXME: There is not yet a way to read MVFR2.
 +     * Fortunately there is not yet anything in there that affects migration.
 +     */
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      if (extract32(id_pfr0, 12, 4) == 1) {
          set_feature(&features, ARM_FEATURE_THUMB2EE);
      }
 -    if (extract32(mvfr1, 20, 4) == 1) {
 +    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
          set_feature(&features, ARM_FEATURE_VFP_FP16);
      }
 -    if (extract32(mvfr1, 12, 4) == 1) {
 +    if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
          set_feature(&features, ARM_FEATURE_NEON);
      }
 -    if (extract32(mvfr1, 28, 4) == 1) {
 +    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
          /* FMAC support implies VFPv4 */
          set_feature(&features, ARM_FEATURE_VFP4);
      }
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 05/10] MAINTAINERS: Add entries for missing ARM boards
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-From: Thomas Huth <thuth@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
+The MusicPal board code connects both of the IRQ outputs of the UART
-"raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-While we're at it, also adjust the "i.MX31" section a little bit,
+to the same input is not valid as it produces subtly wrong behaviour
-so that the wildcards there do not match anymore for unrelated files
+(for instance if both the IRQ lines are high, and then one goes
-(e.g. the new hw/misc/imx6ul_ccm.c file).
+low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+This kind of wiring needs an explicitly created OR gate; add one.
-Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
 Inspired-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 65 insertions(+), 5 deletions(-)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/musicpal.c
-+++ b/MAINTAINERS
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
+@@ -XXX,XX +XXX,XX @@
- S: Odd Fixes
+ #include "ui/console.h"
- F: hw/arm/gumstix.c
+ #include "hw/i2c/i2c.h"
+ #include "hw/irq.h"
--i.MX31
++#include "hw/or-irq.h"
-+i.MX31 (kzm)
+ #include "hw/audio/wm8750.h"
- M: Peter Chubb <peter.chubb@nicta.com.au>
+ #include "sysemu/block-backend.h"
- L: qemu-arm@nongnu.org
+ #include "sysemu/runstate.h"
--S: Odd fixes
+@@ -XXX,XX +XXX,XX @@
--F: hw/*/imx*
+ #define MP_TIMER4_IRQ           7
--F: include/hw/*/imx*
+ #define MP_EHCI_IRQ             8
-+S: Odd Fixes
+ #define MP_ETH_IRQ              9
- F: hw/arm/kzm.c
+-#define MP_UART1_IRQ            11
--F: include/hw/arm/fsl-imx31.h
+-#define MP_UART2_IRQ            11
-+F: hw/*/imx_*
++#define MP_UART_SHARED_IRQ      11
-+F: hw/*/*imx31*
+ #define MP_GPIO_IRQ             12
-+F: include/hw/*/imx_*
+ #define MP_RTC_IRQ              28
-+F: include/hw/*/*imx31*
+ #define MP_AUDIO_IRQ            30
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
- Integrator CP
+     ARMCPU *cpu;
- M: Peter Maydell <peter.maydell@linaro.org>
+     qemu_irq pic[32];
-@@ -XXX,XX +XXX,XX @@ S: Maintained
+     DeviceState *dev;
- F: hw/arm/integratorcp.c
++    DeviceState *uart_orgate;
- F: hw/misc/arm_integrator_debug.c
+     DeviceState *i2c_dev;
+     DeviceState *lcd_dev;
-+MCIMX6UL EVK / i.MX6ul
+     DeviceState *key_dev;
-+M: Peter Maydell <peter.maydell@linaro.org>
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+L: qemu-arm@nongnu.org
+                           pic[MP_TIMER4_IRQ], NULL);
-+S: Odd Fixes
-+F: hw/arm/mcimx6ul-evk.c
+-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
-+F: hw/arm/fsl-imx6ul.c
++    /* Logically OR both UART IRQs together */
-+F: hw/misc/imx6ul_ccm.c
++    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+F: include/hw/arm/fsl-imx6ul.h
++    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+F: include/hw/misc/imx6ul_ccm.h
++    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
-+MCIMX7D SABRE / i.MX7
++    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+M: Peter Maydell <peter.maydell@linaro.org>
++                   qdev_get_gpio_in(uart_orgate, 0),
-+R: Andrey Smirnov <andrew.smirnov@gmail.com>
+                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-+L: qemu-arm@nongnu.org
+-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
-+S: Odd Fixes
++    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
-+F: hw/arm/mcimx7d-sabre.c
++                   qdev_get_gpio_in(uart_orgate, 1),
-+F: hw/arm/fsl-imx7.c
+                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-+F: include/hw/arm/fsl-imx7.h
-+F: hw/pci-host/designware.c
+     /* Register flash */
-+F: include/hw/pci-host/designware.h
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-+
+index XXXXXXX..XXXXXXX 100644
- MPS2
+--- a/hw/arm/Kconfig
- M: Peter Maydell <peter.maydell@linaro.org>
++++ b/hw/arm/Kconfig
- L: qemu-arm@nongnu.org
+@@ -XXX,XX +XXX,XX @@ config MUSCA
-@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
- S: Maintained
+ config MUSICPAL
- F: hw/arm/palm.c
+     bool
++    select OR_IRQ
-+Raspberry Pi
+     select BITBANG_I2C
-+M: Peter Maydell <peter.maydell@linaro.org>
+     select MARVELL_88W8618
-+R: Andrew Baumann <Andrew.Baumann@microsoft.com>
+     select PTIMER
 +R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/raspi_platform.h
 +F: hw/*/bcm283*
 +F: include/hw/arm/raspi*
 +F: include/hw/*/bcm283*
 +
  Real View
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: hw/*/pxa2xx*
  F: hw/misc/mst_fpga.c
  F: include/hw/arm/pxa.h
 +SABRELITE / i.MX6
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Jean-Christophe Dubois <jcd@tribudubois.net>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/sabrelite.c
 +F: hw/arm/fsl-imx6.c
 +F: hw/misc/imx6_src.c
 +F: hw/ssi/imx_spi.c
 +F: include/hw/arm/fsl-imx6.h
 +F: include/hw/misc/imx6_src.h
 +F: include/hw/ssi/imx_spi.h
 +
  Sharp SL-5500 (Collie) PDA
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/stellaris*
 +Versatile Express
 +M: Peter Maydell <peter.maydell@linaro.org>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/arm/vexpress.c
 +
  Versatile PB
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ S: Maintained
  F: hw/*/versatile*
  F: hw/misc/arm_sysctl.c
 +Virt
 +M: Peter Maydell <peter.maydell@linaro.org>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/arm/virt*
 +F: include/hw/arm/virt.h
 +
  Xilinx Zynq
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
  M: Alistair Francis <alistair@alistair23.me>
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 02/10] target/arm: Fill in ARMISARegisters for kvm64
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+We don't need to fill the full pic[] array if we only use
-Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
+few of the interrupt lines. Directly call qdev_get_gpio_in()
 when necessary.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-6-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm64.c | 90 ++++++++++++++++++++++++++++++++++++++++++++--
+ hw/arm/musicpal.c | 25 +++++++++++++------------
-file changed, 88 insertions(+), 2 deletions(-)
+file changed, 13 insertions(+), 12 deletions(-)
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
+--- a/hw/arm/musicpal.c
-+++ b/target/arm/kvm64.c
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static inline void unset_feature(uint64_t *features, int feature)
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-     *features &= ~(1ULL << feature);
+ static void musicpal_init(MachineState *machine)
  }
 +static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
 +{
 +    uint64_t ret;
 +    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
 +    int err;
 +
 +    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
 +    err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +    if (err < 0) {
 +        return -1;
 +    }
 +    *pret = ret;
 +    return 0;
 +}
 +
 +static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
 +{
 +    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
 +
 +    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
 +    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +}
 +
  bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
  {
-     /* Identify the feature bits corresponding to the host CPU, and
+     ARMCPU *cpu;
-      * fill out the ARMHostCPUClass fields accordingly. To do this
+-    qemu_irq pic[32];
-      * we have to create a scratch VM, create a single CPU inside it,
+     DeviceState *dev;
-      * and then query that CPU for the relevant ID registers.
++    DeviceState *pic;
--     * For AArch64 we currently don't care about ID registers at
+     DeviceState *uart_orgate;
--     * all; we just want to know the CPU type.
+     DeviceState *i2c_dev;
-      */
+     DeviceState *lcd_dev;
-     int fdarray[3];
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-     uint64_t features = 0;
+                            &error_fatal);
-+    int err;
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
-+
-     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-      * we know these will only support creating one kind of guest CPU,
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-      * which is its preferred CPU type. Fortunately these old kernels
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+-    for (i = 0; i < 32; i++) {
-     ahcf->target = init.target;
+-        pic[i] = qdev_get_gpio_in(dev, i);
-     ahcf->dtb_compatible = "arm,arm-v8";
+-    }
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-+    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+                         ARM64_SYS_REG(3, 0, 0, 4, 0));
+-                          pic[MP_TIMER4_IRQ], NULL);
-+    if (unlikely(err < 0)) {
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+        /*
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
-+         * Before v4.15, the kernel only exposed a limited number of system
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
-+         * registers, not including any of the interesting AArch64 ID regs.
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
-+         * For the most part we could leave these fields as zero with minimal
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
-+         * effect, since this does not affect the values seen by the guest.
-+         *
+     /* Logically OR both UART IRQs together */
-+         * However, it could cause problems down the line for QEMU,
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+         * so provide a minimal v8.0 default.
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+         *
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+         * ??? Could read MIDR and use knowledge from cpu64.c.
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+         * ??? Could map a page of memory into our temp guest and
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-+         *     run the tiniest of hand-crafted kernels to extract
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-+         *     the values seen by the guest.
-+         * ??? Either of these sounds like too much effort just
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+         *     to work around running a modern host kernel.
+                    qdev_get_gpio_in(uart_orgate, 0),
-+         */
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
+                              OBJECT(get_system_memory()), &error_fatal);
-+        err = 0;
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+    } else {
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
+-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
-+                              ARM64_SYS_REG(3, 0, 0, 4, 1));
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
-+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
++                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
-+                              ARM64_SYS_REG(3, 0, 0, 6, 0));
-+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
+     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
-+                              ARM64_SYS_REG(3, 0, 0, 6, 1));
-+
+     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
-+        /*
-+         * Note that if AArch32 support is not present in the host,
+     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-+         * the AArch32 sysregs are present to be read, but will
+-                               pic[MP_GPIO_IRQ]);
-+         * return UNKNOWN values.  This is neither better nor worse
++                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
-+         * than skipping the reads and leaving 0, as we must avoid
+     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
-+         * considering the values in every case.
+     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
-+         */
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+                              ARM64_SYS_REG(3, 0, 0, 2, 0));
+                              NULL);
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+     sysbus_realize_and_unref(s, &error_fatal);
-+                              ARM64_SYS_REG(3, 0, 0, 2, 1));
+     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
-+                              ARM64_SYS_REG(3, 0, 0, 2, 2));
++    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
-+                              ARM64_SYS_REG(3, 0, 0, 2, 3));
+     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+     arm_load_kernel(cpu, machine, &musicpal_binfo);
 +                              ARM64_SYS_REG(3, 0, 0, 2, 4));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 5));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 7));
 +
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
 +                              ARM64_SYS_REG(3, 0, 0, 3, 0));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
 +                              ARM64_SYS_REG(3, 0, 0, 3, 1));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
 +                              ARM64_SYS_REG(3, 0, 0, 3, 2));
 +    }
 +
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
 +    if (err < 0) {
 +        return false;
 +    }
 +
     /* We can assume any KVM supporting CPU is at least a v8
       * with VFPv4+Neon; this in turn implies most of the other
       * feature bits.
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 10/10] MAINTAINERS: list myself as maintainer for various Arm boards
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
-In practice for most of the more-or-less orphan Arm board models,
+The nseries machines have a codepath that allows them to load a
-I will review patches and put them in via the target-arm tree.
+secondary bootloader.  This code wasn't checking that the
-So list myself as an "Odd Fixes" status maintainer for them.
+load_image_targphys() succeeded.  Check the return value and report
 the error to the user.
-This commit downgrades these boards to "Odd Fixes":
+While we're in the vicinity, fix the comment style of the
- * Allwinner-A10
+comment documenting what this image load is doing.
  * Exynos
  * Calxeda Highbank
  * Canon DIGIC
  * Musicpal
  * nSeries
  * Palm
  * PXA2xx
-These boards were already "Odd Fixes":
+Fixes: Coverity CID 1192904
- * Gumstix
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
- * i.MX31 (kzm)
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
 ---
  hw/arm/nseries.c | 15 +++++++++++----
 file changed, 11 insertions(+), 4 deletions(-)
-Philippe Mathieu-Daudé has requested to be moved to R:
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 status for Gumstix now that I am listed as the M: contact.
 Some boards are maintained, but their patches still go
 via the target-arm tree, so add myself as a secondary
 maintainer contact for those:
  * Xilinx Zynq
  * Xilinx ZynqMP
  * STM32F205
  * Netduino 2
  * SmartFusion2
  * Mecraft M2S-FG484
  * ASPEED BMCs
  * NRF51
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
 ---
  MAINTAINERS | 36 +++++++++++++++++++++++++++---------
 file changed, 27 insertions(+), 9 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/nseries.c
-+++ b/MAINTAINERS
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ ARM Machines
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
- ------------
+         /* No, wait, better start at the ROM.  */
- Allwinner-a10
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
- M: Beniamino Galvani <b.galvani@gmail.com>
-+M: Peter Maydell <peter.maydell@linaro.org>
+-        /* This is intended for loading the `secondary.bin' program from
- L: qemu-arm@nongnu.org
++        /*
--S: Maintained
++         * This is intended for loading the `secondary.bin' program from
-+S: Odd Fixes
+          * Nokia images (the NOLO bootloader).  The entry point seems
- F: hw/*/allwinner*
+          * to be at OMAP2_Q2_BASE + 0x400000.
- F: include/hw/*/allwinner*
+          *
- F: hw/arm/cubieboard.c
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-@@ -XXX,XX +XXX,XX @@ F: tests/test-arm-mptimer.c
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
+          *
- Exynos
+          * The code above is for loading the `zImage' file from Nokia
- M: Igor Mitsyanko <i.mitsyanko@gmail.com>
+-         * images.  */
-+M: Peter Maydell <peter.maydell@linaro.org>
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
- L: qemu-arm@nongnu.org
+-                            machine->ram_size - 0x400000);
--S: Maintained
++         * images.
-+S: Odd Fixes
++         */
- F: hw/*/exynos*
++        if (load_image_targphys(option_rom[0].name,
- F: include/hw/arm/exynos4210.h
++                                OMAP2_Q2_BASE + 0x400000,
++                                machine->ram_size - 0x400000) < 0) {
- Calxeda Highbank
++            error_report("Failed to load secondary bootloader %s",
- M: Rob Herring <robh@kernel.org>
++                         option_rom[0].name);
-+M: Peter Maydell <peter.maydell@linaro.org>
++            exit(EXIT_FAILURE);
- L: qemu-arm@nongnu.org
++        }
--S: Maintained
-+S: Odd Fixes
+         n800_setup_nolo_tags(nolo_tags);
- F: hw/arm/highbank.c
+         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
  F: hw/net/xgmac.c
  Canon DIGIC
  M: Antony Pavlov <antonynpavlov@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: include/hw/arm/digic.h
  F: hw/*/digic*
  Gumstix
 -M: Philippe Mathieu-Daudé <f4bug@amsat.org>
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Philippe Mathieu-Daudé <f4bug@amsat.org>
  L: qemu-devel@nongnu.org
  L: qemu-arm@nongnu.org
  S: Odd Fixes
@@ -XXX,XX +XXX,XX @@ F: hw/arm/gumstix.c
  i.MX31 (kzm)
  M: Peter Chubb <peter.chubb@nicta.com.au>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Odd Fixes
  F: hw/arm/kzm.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/iotkit-sysinfo.h
  Musicpal
  M: Jan Kiszka <jan.kiszka@web.de>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/musicpal.c
  nSeries
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/nseries.c
  Palm
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/palm.c
  Raspberry Pi
@@ -XXX,XX +XXX,XX @@ F: include/hw/intc/realview_gic.h
  PXA2XX
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/mainstone.c
  F: hw/arm/spitz.c
  F: hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/arm/virt.h
  Xilinx Zynq
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/xilinx_*
@@ -XXX,XX +XXX,XX @@ X: hw/ssi/xilinx_*
  Xilinx ZynqMP
  M: Alistair Francis <alistair@alistair23.me>
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/xlnx*.c
@@ -XXX,XX +XXX,XX @@ F: hw/arm/virt-acpi-build.c
  STM32F205
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/stm32f205_soc.c
  F: hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/*/stm32*.h
  Netduino 2
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/netduino2.c
  SmartFusion2
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/msf2-soc.c
  F: hw/misc/msf2-sysreg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/mss-spi.h
  Emcraft M2S-FG484
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/msf2-som.c
  ASPEED BMCs
  M: Cédric Le Goater <clg@kaod.org>
 +M: Peter Maydell <peter.maydell@linaro.org>
  R: Andrew Jeffery <andrew@aj.id.au>
  R: Joel Stanley <joel@jms.id.au>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: include/hw/net/ftgmac100.h
  NRF51
  M: Joel Stanley <joel@jms.id.au>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/arm/nrf51_soc.c
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 01/10] target/arm: Install ARMISARegisters from kvm host
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-The ID registers are replacing (some of) the feature bits.
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
-We need (some of) these values to determine the set of data
+plus one. Currently, it's counting the number of times these transitions
-to be handled during migration.
+do _not_ happen, plus one.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Source:
-Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
 section 2.3.4 point (3).
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm_arm.h | 1 +
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
- target/arm/kvm.c     | 1 +
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 2 insertions(+)
-diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm_arm.h
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/target/arm/kvm_arm.h
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
-  * by asking the host kernel)
+     pi = (double)nr_ones / nr_bits;
-  */
- typedef struct ARMHostCPUFeatures {
+     for (k = 0; k < nr_bits - 1; k++) {
-+    ARMISARegisters isar;
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-     uint64_t features;
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
-     uint32_t target;
+     }
-     const char *dtb_compatible;
+     vn_obs += 1;
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
      cpu->kvm_target = arm_host_cpu_features.target;
      cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
 +    cpu->isar = arm_host_cpu_features.isar;
      env->features = arm_host_cpu_features.features;
  }
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 09/10] hw/block/onenand: use qemu_log_mask() for reporting
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-Update the onenand device to use qemu_log_mask() for reporting
+Checks for UNDEF cases should go before the "is VFP enabled?" access
-guest errors and unimplemented features, rather than plain
+check, except in special cases. Move a stray UNDEF check in the VTBL
-fprintf() and hw_error().
+trans function up above the access check.
 (We leave the hw_error() in onenand_reset(), as that is
 triggered by a failure to read the underlying block device
 for the bootRAM, not by guest action.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
 ---
- hw/block/onenand.c | 22 +++++++++++++---------
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 13 insertions(+), 9 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/block/onenand.c b/hw/block/onenand.c
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/onenand.c
+--- a/target/arm/translate-neon.c.inc
-+++ b/hw/block/onenand.c
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- #include "exec/memory.h"
+         return false;
  #include "hw/sysbus.h"
  #include "qemu/error-report.h"
 +#include "qemu/log.h"
  /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
  #define PAGE_SHIFT    11
@@ -XXX,XX +XXX,XX @@ static void onenand_command(OneNANDState *s)
      default:
          s->status |= ONEN_ERR_CMD;
          s->intstatus |= ONEN_INT;
 -        fprintf(stderr, "%s: unknown OneNAND command %x\n",
 -                        __func__, s->command);
 +        qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
 +                      s->command);
      }
-     onenand_intr_update(s);
+-    if (!vfp_access_check(s)) {
-@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
+-        return true;
-     case 0xff02:    /* ECC Result of spare area data */
+-    }
-     case 0xff03:    /* ECC Result of main area data */
+-
-     case 0xff04:    /* ECC Result of spare area data */
+     if ((a->vn + a->len + 1) > 32) {
--        hw_error("%s: implement ECC\n", __func__);
+         /*
-+        qemu_log_mask(LOG_UNIMP,
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
-+                      "onenand: ECC result registers unimplemented\n");
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-         return 0x0000;
+         return false;
      }
--    fprintf(stderr, "%s: unknown OneNAND register %x\n",
++    if (!vfp_access_check(s)) {
--                    __func__, offset);
++        return true;
-+    qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
++    }
-+                  offset);
++
-     return 0;
+     desc = tcg_const_i32((a->vn << 2) | a->len);
- }
+     def = tcg_temp_new_i64();
+     if (a->op) {
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
              break;
          default:
 -            fprintf(stderr, "%s: unknown OneNAND boot command %"PRIx64"\n",
 -                            __func__, value);
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "unknown OneNAND boot command %" PRIx64 "\n",
 +                          value);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
          break;
      default:
 -        fprintf(stderr, "%s: unknown OneNAND register %x\n",
 -                        __func__, offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "write to unknown OneNAND register 0x%x\n",
 +                      offset);
      }
  }
 --
-.19.1
+.20.1

Some Arm bugfixes for rc2...

thanks
-- PMM

The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119

for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:

MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)

----------------------------------------------------------------
target-arm queue:
 * various MAINTAINERS file updates
 * hw/block/onenand: use qemu_log_mask() for reporting
 * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
   on the n800 and n810 machine models
 * target/arm: fix smc incorrectly trapping to EL3 when secure is off
 * hw/arm/stm32f205: Fix the UART and Timer region size
 * target/arm: read ID registers for KVM guests so they can be
   used to gate "is feature X present" checks

----------------------------------------------------------------
Luc Michel (1):
      target/arm: fix smc incorrectly trapping to EL3 when secure is off

Peter Maydell (3):
      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
      hw/block/onenand: use qemu_log_mask() for reporting
      MAINTAINERS: list myself as maintainer for various Arm boards

Richard Henderson (4):
      target/arm: Install ARMISARegisters from kvm host
      target/arm: Fill in ARMISARegisters for kvm64
      target/arm: Introduce read_sys_reg32 for kvm32
      target/arm: Fill in ARMISARegisters for kvm32

Seth Kintigh (1):
      hw/arm/stm32f205: Fix the UART and Timer region size

Thomas Huth (1):
      MAINTAINERS: Add entries for missing ARM boards

target/arm/kvm_arm.h       |   1 +
 hw/block/onenand.c         |  24 +++++-----
 hw/char/stm32f2xx_usart.c  |   2 +-
 hw/timer/stm32f2xx_timer.c |   2 +-
 target/arm/kvm.c           |   1 +
 target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
 target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
 target/arm/op_helper.c     |  54 +++++++++++++++++++----
 MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
 9 files changed, 293 insertions(+), 64 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

The ID registers are replacing (some of) the feature bits.
We need (some of) these values to determine the set of data
to be handled during migration.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 1 +
 target/arm/kvm.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
  * by asking the host kernel)
  */
 typedef struct ARMHostCPUFeatures {
+    ARMISARegisters isar;
     uint64_t features;
     uint32_t target;
     const char *dtb_compatible;
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
 
     cpu->kvm_target = arm_host_cpu_features.target;
     cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
+    cpu->isar = arm_host_cpu_features.isar;
     env->features = arm_host_cpu_features.features;
 }
 
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 90 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 88 insertions(+), 2 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static inline void unset_feature(uint64_t *features, int feature)
     *features &= ~(1ULL << feature);
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    uint64_t ret;
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
+    int err;
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
+    if (err < 0) {
+        return -1;
+    }
+    *pret = ret;
+    return 0;
+}
+
+static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
      * fill out the ARMHostCPUClass fields accordingly. To do this
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
-     * For AArch64 we currently don't care about ID registers at
-     * all; we just want to know the CPU type.
      */
     int fdarray[3];
     uint64_t features = 0;
+    int err;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type. Fortunately these old kernels
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     ahcf->target = init.target;
     ahcf->dtb_compatible = "arm,arm-v8";
 
+    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
+                         ARM64_SYS_REG(3, 0, 0, 4, 0));
+    if (unlikely(err < 0)) {
+        /*
+         * Before v4.15, the kernel only exposed a limited number of system
+         * registers, not including any of the interesting AArch64 ID regs.
+         * For the most part we could leave these fields as zero with minimal
+         * effect, since this does not affect the values seen by the guest.
+         *
+         * However, it could cause problems down the line for QEMU,
+         * so provide a minimal v8.0 default.
+         *
+         * ??? Could read MIDR and use knowledge from cpu64.c.
+         * ??? Could map a page of memory into our temp guest and
+         *     run the tiniest of hand-crafted kernels to extract
+         *     the values seen by the guest.
+         * ??? Either of these sounds like too much effort just
+         *     to work around running a modern host kernel.
+         */
+        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
+        err = 0;
+    } else {
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
+                              ARM64_SYS_REG(3, 0, 0, 4, 1));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
+                              ARM64_SYS_REG(3, 0, 0, 6, 0));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
+                              ARM64_SYS_REG(3, 0, 0, 6, 1));
+
+        /*
+         * Note that if AArch32 support is not present in the host,
+         * the AArch32 sysregs are present to be read, but will
+         * return UNKNOWN values.  This is neither better nor worse
+         * than skipping the reads and leaving 0, as we must avoid
+         * considering the values in every case.
+         */
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                              ARM64_SYS_REG(3, 0, 0, 2, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                              ARM64_SYS_REG(3, 0, 0, 2, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                              ARM64_SYS_REG(3, 0, 0, 2, 2));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                              ARM64_SYS_REG(3, 0, 0, 2, 3));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                              ARM64_SYS_REG(3, 0, 0, 2, 4));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                              ARM64_SYS_REG(3, 0, 0, 2, 5));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                              ARM64_SYS_REG(3, 0, 0, 2, 7));
+
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                              ARM64_SYS_REG(3, 0, 0, 3, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
+                              ARM64_SYS_REG(3, 0, 0, 3, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
+                              ARM64_SYS_REG(3, 0, 0, 3, 2));
+    }
+
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
+    if (err < 0) {
+        return false;
+    }
+
    /* We can assume any KVM supporting CPU is at least a v8
      * with VFPv4+Neon; this in turn implies most of the other
      * feature bits.
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Assert that the value to be written is the correct size.
No change in functionality here, just mirroring the same
function from kvm64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 41 ++++++++++++++++-------------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ static inline void set_feature(uint64_t *features, int feature)
     *features |= 1ULL << feature;
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
      */
-    int i, ret, fdarray[3];
+    int err = 0, fdarray[3];
     uint32_t midr, id_pfr0, mvfr1;
     uint64_t features = 0;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type.
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         QEMU_KVM_ARM_TARGET_NONE
     };
     struct kvm_vcpu_init init;
-    struct kvm_one_reg idregs[] = {
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 0, 0, 0),
-            .addr = (uintptr_t)&midr,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 1, 0, 0),
-            .addr = (uintptr_t)&id_pfr0,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1,
-            .addr = (uintptr_t)&mvfr1,
-        },
-    };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      */
     ahcf->dtb_compatible = "arm,arm-v7";
 
-    for (i = 0; i < ARRAY_SIZE(idregs); i++) {
-        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &idregs[i]);
-        if (ret) {
-            break;
-        }
-    }
+    err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
+    err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
+    err |= read_sys_reg32(fdarray[2], &mvfr1,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
-    if (ret) {
+    if (err < 0) {
         return false;
     }
 
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * and then query that CPU for the relevant ID registers.
      */
     int err = 0, fdarray[3];
-    uint32_t midr, id_pfr0, mvfr1;
+    uint32_t midr, id_pfr0;
     uint64_t features = 0;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 
     err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
     err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
-    err |= read_sys_reg32(fdarray[2], &mvfr1,
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                          ARM_CP15_REG32(0, 0, 2, 0));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                          ARM_CP15_REG32(0, 0, 2, 1));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                          ARM_CP15_REG32(0, 0, 2, 2));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                          ARM_CP15_REG32(0, 0, 2, 3));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                          ARM_CP15_REG32(0, 0, 2, 4));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                          ARM_CP15_REG32(0, 0, 2, 5));
+    if (read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                       ARM_CP15_REG32(0, 0, 2, 7))) {
+        /*
+         * Older kernels don't support reading ID_ISAR6. This register was
+         * only introduced in ARMv8, so we can assume that it is zero on a
+         * CPU that a kernel this old is running on.
+         */
+        ahcf->isar.id_isar6 = 0;
+    }
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR0);
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
                           KVM_REG_ARM | KVM_REG_SIZE_U32 |
                           KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
+    /*
+     * FIXME: There is not yet a way to read MVFR2.
+     * Fortunately there is not yet anything in there that affects migration.
+     */
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(id_pfr0, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_THUMB2EE);
     }
-    if (extract32(mvfr1, 20, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
         set_feature(&features, ARM_FEATURE_VFP_FP16);
     }
-    if (extract32(mvfr1, 12, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
-    if (extract32(mvfr1, 28, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
         /* FMAC support implies VFPv4 */
         set_feature(&features, ARM_FEATURE_VFP4);
     }
-- 
2.19.1

From: Thomas Huth <thuth@redhat.com>

Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
"raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
While we're at it, also adjust the "i.MX31" section a little bit,
so that the wildcards there do not match anymore for unrelated files
(e.g. the new hw/misc/imx6ul_ccm.c file).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 65 insertions(+), 5 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/gumstix.c
 
-i.MX31
+i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
 L: qemu-arm@nongnu.org
-S: Odd fixes
-F: hw/*/imx*
-F: include/hw/*/imx*
+S: Odd Fixes
 F: hw/arm/kzm.c
-F: include/hw/arm/fsl-imx31.h
+F: hw/*/imx_*
+F: hw/*/*imx31*
+F: include/hw/*/imx_*
+F: include/hw/*/*imx31*
 
 Integrator CP
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 
+MCIMX6UL EVK / i.MX6ul
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx6ul-evk.c
+F: hw/arm/fsl-imx6ul.c
+F: hw/misc/imx6ul_ccm.c
+F: include/hw/arm/fsl-imx6ul.h
+F: include/hw/misc/imx6ul_ccm.h
+
+MCIMX7D SABRE / i.MX7
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrey Smirnov <andrew.smirnov@gmail.com>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx7d-sabre.c
+F: hw/arm/fsl-imx7.c
+F: include/hw/arm/fsl-imx7.h
+F: hw/pci-host/designware.c
+F: include/hw/pci-host/designware.h
+
 MPS2
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/palm.c
 
+Raspberry Pi
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrew Baumann <Andrew.Baumann@microsoft.com>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/raspi_platform.h
+F: hw/*/bcm283*
+F: include/hw/arm/raspi*
+F: include/hw/*/bcm283*
+
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: hw/*/pxa2xx*
 F: hw/misc/mst_fpga.c
 F: include/hw/arm/pxa.h
 
+SABRELITE / i.MX6
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/sabrelite.c
+F: hw/arm/fsl-imx6.c
+F: hw/misc/imx6_src.c
+F: hw/ssi/imx_spi.c
+F: include/hw/arm/fsl-imx6.h
+F: include/hw/misc/imx6_src.h
+F: include/hw/ssi/imx_spi.h
+
 Sharp SL-5500 (Collie) PDA
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/stellaris*
 
+Versatile Express
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/vexpress.c
+
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/*/versatile*
 F: hw/misc/arm_sysctl.c
 
+Virt
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/virt*
+F: include/hw/arm/virt.h
+
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
-- 
2.19.1

From: Seth Kintigh <skintigh@gmail.com>

The UART and timer devices for the stm32f205 were being created
with memory regions that were too large. Use the size specified
in the chip datasheet.

The old sizes were so large that the devices would overlap with
each other in the SoC memory map, so this fixes a bug that
caused odd behavior and/or crashes when trying to set up multiple
UARTs.

Signed-off-by: Seth Kintigh <skintigh@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: rephrased commit message to follow our usual standard]
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/stm32f2xx_usart.c  | 2 +-
 hw/timer/stm32f2xx_timer.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_usart_ops, s,
-                          TYPE_STM32F2XX_USART, 0x2000);
+                          TYPE_STM32F2XX_USART, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/stm32f2xx_timer.c
+++ b/hw/timer/stm32f2xx_timer.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_timer_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->iomem, obj, &stm32f2xx_timer_ops, s,
-                          "stm32f2xx_timer", 0x4000);
+                          "stm32f2xx_timer", 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
 
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
-- 
2.19.1

From: Luc Michel <luc.michel@greensocs.com>

This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
    .text
_start:
    ldr x0, =0xdeadbeef  ; invalid PSCI call
    smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                      -o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                    -cpu cortex-a57 -kernel test

Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/op_helper.c | 54 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
     ARMCPU *cpu = arm_env_get_cpu(env);
     int cur_el = arm_current_el(env);
     bool secure = arm_is_secure(env);
-    bool smd = env->cp15.scr_el3 & SCR_SMD;
+    bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
+
+    /*
+     * SMC behaviour is summarized in the following table.
+     * This helper handles the "Trap to EL2" and "Undef insn" cases.
+     * The "Trap to EL3" and "PSCI call" cases are handled in the exception
+     * helper.
+     *
+     *  -> ARM_FEATURE_EL3 and !SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Trap to EL3
+     *  Conduit not SMC          Trap to EL2         Trap to EL3
+     *
+     *
+     *  -> ARM_FEATURE_EL3 and SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Trap to EL2         Undef insn
+     *
+     *
+     *  -> !ARM_FEATURE_EL3
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Undef insn          Undef insn
+     */
+
     /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
      * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
      *  extensions, SMD only applies to NS state.
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
      * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
      * so we need not special case this here.
      */
-    bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
+    bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
+                                                     : smd_flag && !secure;
 
     if (!arm_feature(env, ARM_FEATURE_EL3) &&
         cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
          * to forbid its EL1 from making PSCI calls into QEMU's
          * "firmware" via HCR.TSC, so for these purposes treat
          * PSCI-via-SMC as implying an EL3.
+         * This handles the very last line of the previous table.
          */
-        undef = true;
-    } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
+        raise_exception(env, EXCP_UDEF, syn_uncategorized(),
+                        exception_target_el(env));
+    }
+
+    if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
          * We also want an EL2 guest to be able to forbid its EL1 from
          * making PSCI calls into QEMU's "firmware" via HCR.TSC.
+         * This handles all the "Trap to EL2" cases of the previous table.
          */
         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
     }
 
-    /* If PSCI is enabled and this looks like a valid PSCI call then
-     * suppress the UNDEF -- we'll catch the SMC exception and
-     * implement the PSCI call behaviour there.
+    /* Catch the two remaining "Undef insn" cases of the previous table:
+     *    - PSCI conduit is SMC but we don't have a valid PCSI call,
+     *    - We don't have EL3 or SMD is set.
      */
-    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
+    if (!arm_is_psci_call(cpu, EXCP_SMC) &&
+        (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                         exception_target_el(env));
     }
-- 
2.19.1

An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.

NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.

Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/onenand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     int offset = addr >> s->shift;
 
     switch (offset) {
-    case 0x0000 ... 0xc000:
+    case 0x0000 ... 0xbffe:
         return lduw_le_p(s->boot[0] + addr);
 
     case 0xf000:	/* Manufacturer ID */
-- 
2.19.1

Update the onenand device to use qemu_log_mask() for reporting
guest errors and unimplemented features, rather than plain
fprintf() and hw_error().

(We leave the hw_error() in onenand_reset(), as that is
triggered by a failure to read the underlying block device
for the bootRAM, not by guest action.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
---
 hw/block/onenand.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
 
 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
 #define PAGE_SHIFT	11
@@ -XXX,XX +XXX,XX @@ static void onenand_command(OneNANDState *s)
     default:
         s->status |= ONEN_ERR_CMD;
         s->intstatus |= ONEN_INT;
-        fprintf(stderr, "%s: unknown OneNAND command %x\n",
-                        __func__, s->command);
+        qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
+                      s->command);
     }
 
     onenand_intr_update(s);
@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     case 0xff02:	/* ECC Result of spare area data */
     case 0xff03:	/* ECC Result of main area data */
     case 0xff04:	/* ECC Result of spare area data */
-        hw_error("%s: implement ECC\n", __func__);
+        qemu_log_mask(LOG_UNIMP,
+                      "onenand: ECC result registers unimplemented\n");
         return 0x0000;
     }
 
-    fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                    __func__, offset);
+    qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
+                  offset);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
             break;
 
         default:
-            fprintf(stderr, "%s: unknown OneNAND boot command %"PRIx64"\n",
-                            __func__, value);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "unknown OneNAND boot command %" PRIx64 "\n",
+                          value);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                        __func__, offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "write to unknown OneNAND register 0x%x\n",
+                      offset);
     }
 }
 
-- 
2.19.1

In practice for most of the more-or-less orphan Arm board models,
I will review patches and put them in via the target-arm tree.
So list myself as an "Odd Fixes" status maintainer for them.

This commit downgrades these boards to "Odd Fixes":
 * Allwinner-A10
 * Exynos
 * Calxeda Highbank
 * Canon DIGIC
 * Musicpal
 * nSeries
 * Palm
 * PXA2xx

These boards were already "Odd Fixes":
 * Gumstix
 * i.MX31 (kzm)

Philippe Mathieu-Daudé has requested to be moved to R:
status for Gumstix now that I am listed as the M: contact.

Some boards are maintained, but their patches still go
via the target-arm tree, so add myself as a secondary
maintainer contact for those:
 * Xilinx Zynq
 * Xilinx ZynqMP
 * STM32F205
 * Netduino 2
 * SmartFusion2
 * Mecraft M2S-FG484
 * ASPEED BMCs
 * NRF51

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
---
 MAINTAINERS | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ ARM Machines
 ------------
 Allwinner-a10
 M: Beniamino Galvani <b.galvani@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
@@ -XXX,XX +XXX,XX @@ F: tests/test-arm-mptimer.c
 
 Exynos
 M: Igor Mitsyanko <i.mitsyanko@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/exynos*
 F: include/hw/arm/exynos4210.h
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/highbank.c
 F: hw/net/xgmac.c
 
 Canon DIGIC
 M: Antony Pavlov <antonynpavlov@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
 
 Gumstix
-M: Philippe Mathieu-Daudé <f4bug@amsat.org>
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 L: qemu-arm@nongnu.org
 S: Odd Fixes
@@ -XXX,XX +XXX,XX @@ F: hw/arm/gumstix.c
 
 i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/kzm.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/iotkit-sysinfo.h
 
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/musicpal.c
 
 nSeries
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/nseries.c
 
 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/palm.c
 
 Raspberry Pi
@@ -XXX,XX +XXX,XX @@ F: include/hw/intc/realview_gic.h
 
 PXA2XX
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/mainstone.c
 F: hw/arm/spitz.c
 F: hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/arm/virt.h
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xilinx_*
@@ -XXX,XX +XXX,XX @@ X: hw/ssi/xilinx_*
 Xilinx ZynqMP
 M: Alistair Francis <alistair@alistair23.me>
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
@@ -XXX,XX +XXX,XX @@ F: hw/arm/virt-acpi-build.c
 
 STM32F205
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/stm32f205_soc.c
 F: hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/*/stm32*.h
 
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/netduino2.c
 
 SmartFusion2
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-soc.c
 F: hw/misc/msf2-sysreg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/mss-spi.h
 
 Emcraft M2S-FG484
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-som.c
 
 ASPEED BMCs
 M: Cédric Le Goater <clg@kaod.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 R: Andrew Jeffery <andrew@aj.id.au>
 R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: include/hw/net/ftgmac100.h
 
 NRF51
 M: Joel Stanley <joel@jms.id.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/nrf51_soc.c
-- 
2.19.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1