Series comparison

-[PULL 0/4] target-arm queue
+[PULL 00/25] target-arm queue
-Arm patches for rc3 : just a handful of bug fixes.
+Last lot of target-arm changes to squeeze in before rc1:
  * various minor Arm bug fixes
  * David Carlier's Haiku build portability fixes
  * Wentong Wu's fixes for icount handling in the nios2 target
-thanks
+The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:
 -- PMM
+  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)
 The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713
-for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
+for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:
-  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
+  hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * handle FTYPE flag correctly in v7M exception return
+ * hw/arm/bcm2836: Remove unused 'cpu_type' field
-   for v7M CPUs with an FPU (v8M CPUs were already correct)
+ * target/arm: Fix mtedesc for do_mem_zpz
- * versal: Add the CRP as unimplemented
+ * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
- * Fix ISR_EL1 tracking when executing at EL2
+ * target/arm: Don't do raw writes for PMINTENCLR
- * Honor HCR_EL2.TID3 trapping requirements
+ * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
  * build: Fix various issues with building on Haiku
  * target/nios2: fix wrctl behaviour when using icount
  * hw/arm/tosa: Encapsulate misc GPIO handling in a device
  * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
  * hw/arm/aspeed: Do not create and attach empty SD cards by default
 ----------------------------------------------------------------
-Edgar E. Iglesias (1):
+Aaron Lindsay (1):
-      hw/arm: versal: Add the CRP as unimplemented
+      target/arm: Don't do raw writes for PMINTENCLR
-Jean-Hugues Deschênes (1):
+David CARLIER (8):
-      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+      build: Enable BSD symbols for Haiku
       util/qemu-openpty.c: Don't assume pty.h is glibc-only
       build: Check that mlockall() exists
       osdep.h: Always include <sys/signal.h> if it exists
       osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
       bswap.h: Include <endian.h> on Haiku for bswap operations
       util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
       util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
-Marc Zyngier (2):
+Eric Auger (1):
-      target/arm: Fix ISR_EL1 tracking when executing at EL2
+      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
       target/arm: Honor HCR_EL2.TID3 trapping requirements
- include/hw/arm/xlnx-versal.h |  3 ++
+Gerd Hoffmann (1):
- hw/arm/xlnx-versal.c         |  2 ++
+      util/drm: make portable by avoiding struct dirent d_type
  target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
  target/arm/m_helper.c        |  7 ++--
 files changed, 89 insertions(+), 6 deletions(-)
+Jean-Christophe Dubois (3):
+      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+      Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
+Peter Maydell (4):
+      hw/arm/tosa.c: Detabify
+      hw/arm/tosa: Encapsulate misc GPIO handling in a device
+      hw/arm/palm.c: Detabify
+      hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+Philippe Mathieu-Daudé (2):
+      hw/arm/bcm2836: Remove unused 'cpu_type' field
+      hw/arm/aspeed: Do not create and attach empty SD cards by default
+Richard Henderson (1):
+      target/arm: Fix mtedesc for do_mem_zpz
+Wentong Wu (4):
+      target/nios2: add DISAS_NORETURN case for nothing more to generate
+      target/nios2: in line the semantics of DISAS_UPDATE with other targets
+      target/nios2: Use gen_io_start around wrctl instruction
+      hw/nios2: exit to main CPU loop only when unmasking interrupts
+ configure                   |  38 ++++++++++++-
+ include/hw/arm/bcm2836.h    |   1 -
+ include/hw/arm/fsl-imx25.h  |   1 +
+ include/hw/arm/fsl-imx6.h   |   1 +
+ include/hw/arm/fsl-imx7.h   |   1 +
+ include/qemu/bswap.h        |   2 +
+ include/qemu/osdep.h        |   6 +-
+ hw/arm/aspeed.c             |   9 +--
+ hw/arm/fsl-imx25.c          |   7 +++
+ hw/arm/fsl-imx6.c           |   7 +++
+ hw/arm/fsl-imx7.c           |   9 +++
+ hw/arm/palm.c               | 111 +++++++++++++++++++++++++------------
+ hw/arm/tosa.c               | 132 +++++++++++++++++++++++++++++---------------
+ hw/nios2/cpu_pic.c          |   3 +-
+ hw/virtio/virtio-iommu.c    |   1 +
+ hw/xen/xen-legacy-backend.c |   1 -
+ os-posix.c                  |   4 ++
+ target/arm/helper.c         |   4 +-
+ target/arm/translate-sve.c  |   2 +-
+ target/nios2/translate.c    |  12 +++-
+ util/compatfd.c             |   2 +
+ util/drm.c                  |  19 +++++--
+ util/oslib-posix.c          |  20 ++++++-
+ util/qemu-openpty.c         |   2 +-
+files changed, 292 insertions(+), 103 deletions(-)

-New patch
+[PULL 01/25] hw/arm/bcm2836: Remove unused 'cpu_type' field
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The 'cpu_type' has been moved from BCM283XState to BCM283XClass
+in commit 210f47840d, but we forgot to remove the old variable.
+Do it now.
+Fixes: 210f47840d ("hw/arm/bcm2836: Hardcode correct CPU type")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20200703200459.23294-1-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/bcm2836.h | 1 -
+file changed, 1 deletion(-)
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/bcm2836.h
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
+     DeviceState parent_obj;
+     /*< public >*/
+-    char *cpu_type;
+     uint32_t enabled_cpus;
+     struct {
+--
+.20.1

-New patch
+[PULL 02/25] target/arm: Fix mtedesc for do_mem_zpz
+From: Richard Henderson <richard.henderson@linaro.org>
+The mtedesc that was constructed was not actually passed in.
+Found by Coverity (CID 1429996).
+Fixes: d28d12f008e
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-sve.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-sve.c
++++ b/target/arm/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
+         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
+         desc <<= SVE_MTEDESC_SHIFT;
+     }
+-    desc = simd_desc(vsz, vsz, scale);
++    desc = simd_desc(vsz, vsz, desc | scale);
+     t_desc = tcg_const_i32(desc);
+     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
+--
+.20.1

-New patch
+[PULL 03/25] Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+From: Jean-Christophe Dubois <jcd@tribudubois.net>
+Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
+Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: updated for object_property_set_uint() argument reordering]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/fsl-imx25.h | 1 +
+ hw/arm/fsl-imx25.c         | 7 +++++++
+files changed, 8 insertions(+)
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx25.h
++++ b/include/hw/arm/fsl-imx25.h
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
+     MemoryRegion   rom[2];
+     MemoryRegion   iram;
+     MemoryRegion   iram_alias;
++    uint32_t       phy_num;
+ } FslIMX25State;
+ /**
+diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx25.c
++++ b/hw/arm/fsl-imx25.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
+                                             epit_table[i].irq));
+     }
++    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
+     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
+                                 &s->iram_alias);
+ }
++static Property fsl_imx25_properties[] = {
++    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
+ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
++    device_class_set_props(dc, fsl_imx25_properties);
+     dc->realize = fsl_imx25_realize;
+     dc->desc = "i.MX25 SOC";
+     /*
+--
+.20.1

-New patch
+[PULL 04/25] Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+From: Jean-Christophe Dubois <jcd@tribudubois.net>
+Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
+Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: updated for object_property_set_uint() argument reordering]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/fsl-imx6.h | 1 +
+ hw/arm/fsl-imx6.c         | 7 +++++++
+files changed, 8 insertions(+)
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+     MemoryRegion   caam;
+     MemoryRegion   ocram;
+     MemoryRegion   ocram_alias;
++    uint32_t       phy_num;
+ } FslIMX6State;
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx6.c
++++ b/hw/arm/fsl-imx6.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+                                             spi_table[i].irq));
+     }
++    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
+     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
+         return;
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+                                 &s->ocram_alias);
+ }
++static Property fsl_imx6_properties[] = {
++    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
+ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
++    device_class_set_props(dc, fsl_imx6_properties);
+     dc->realize = fsl_imx6_realize;
+     dc->desc = "i.MX6 SOC";
+     /* Reason: Uses serial_hd() in the realize() function */
+--
+.20.1

-New patch
+[PULL 05/25] Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
+From: Jean-Christophe Dubois <jcd@tribudubois.net>
+Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
+Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: updated for object_property_set_uint() argument reordering]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/fsl-imx7.h | 1 +
+ hw/arm/fsl-imx7.c         | 9 +++++++++
+files changed, 10 insertions(+)
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
+     IMX7GPRState       gpr;
+     ChipideaState      usb[FSL_IMX7_NUM_USBS];
+     DesignwarePCIEHost pcie;
++    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
+ } FslIMX7State;
+ enum FslIMX7MemoryMap {
+diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx7.c
++++ b/hw/arm/fsl-imx7.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
+             FSL_IMX7_ENET2_ADDR,
+         };
++        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
++                                 s->phy_num[i], &error_abort);
+         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
+                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
+         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
+                                 FSL_IMX7_PCIE_PHY_SIZE);
+ }
++static Property fsl_imx7_properties[] = {
++    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
++    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
+ static void fsl_imx7_class_init(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
++    device_class_set_props(dc, fsl_imx7_properties);
+     dc->realize = fsl_imx7_realize;
+     /* Reason: Uses serial_hds and nd_table in realize() directly */
+--
+.20.1

-[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
+[PULL 06/25] target/arm: Don't do raw writes for PMINTENCLR
-From: Marc Zyngier <maz@kernel.org>
+From: Aaron Lindsay <aaron@os.amperecomputing.com>
-HCR_EL2.TID3 mandates that access from EL1 to a long list of id
+Raw writes to this register when in KVM mode can cause interrupts to be
-registers traps to EL2, and QEMU has so far ignored this requirement.
+raised (even when the PMU is disabled). Because the underlying state is
 already aliased to PMINTENSET (which already provides raw write
 functions), we can safely disable raw accesses to PMINTENCLR entirely.
-This breaks (among other things) KVM guests that have PtrAuth enabled,
+Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
-while the hypervisor doesn't want to expose the feature to its guest.
+Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
 To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
 case), and masks out the unsupported feature.
 QEMU not honoring the trap request means that the guest observes
 that the feature is present in the HW, starts using it, and dies
 a horrible death when KVM injects an UNDEF, because the feature
 *really* isn't supported.
 Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
 Note that this change does not include trapping of the MVFR
 registers from AArch32 (they are accessed via the VMRS
 instruction and need to be handled in a different way).
 Reported-by: Will Deacon <will@kernel.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Tested-by: Will Deacon <will@kernel.org>
 Message-id: 20191123115618.29230-1-maz@kernel.org
 [PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
  changed names of access functions to include _tid3]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 4 ++--
-file changed, 76 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
-     REGINFO_SENTINEL
+       .resetvalue = 0x0 },
- };
+     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
+       .access = PL1_RW, .accessfn = access_tpm,
-+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+                                       bool isread)
++      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-+{
+       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+       .writefn = pmintenclr_write, },
-+        return CP_ACCESS_TRAP_EL2;
+     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
-+    }
+       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
-+
+       .access = PL1_RW, .accessfn = access_tpm,
-+    return CP_ACCESS_OK;
+-      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+}
++      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-+
+       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+       .writefn = pmintenclr_write },
-+                                       bool isread)
+     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
 +{
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        return access_aa64_tid3(env, ri, isread);
 +    }
 +
 +    return CP_ACCESS_OK;
 +}
 +
  void register_cp_regs_for_features(ARMCPU *cpu)
  {
      /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_pfr0 },
              /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
               * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa32_tid3,
                .readfn = id_pfr1_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_dfr0 },
              { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_afr0 },
              { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
 .20.1

-New patch
+[PULL 07/25] virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+From: Eric Auger <eric.auger@redhat.com>
+Coverity points out (CID 1430180) that the new case is missing
+break or a /* fallthrough */ comment. Break is the right thing to
+do as in that case, tail is not used.
+Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200708160147.18426-1-eric.auger@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/virtio/virtio-iommu.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/virtio/virtio-iommu.c
++++ b/hw/virtio/virtio-iommu.c
+@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
+             ptail = (struct virtio_iommu_req_tail *)
+                         (buf + s->config.probe_size);
+             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
++            break;
+         }
+         default:
+             tail.status = VIRTIO_IOMMU_S_UNSUPP;
+--
+.20.1

-New patch
+[PULL 08/25] build: Enable BSD symbols for Haiku
+From: David CARLIER <devnexen@gmail.com>
+Tell Haiku to provide various BSD functions by setting BSD_SOURCE
+and linking libbsd.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-2-peter.maydell@linaro.org
+[PMM: expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ SunOS)
+ ;;
+ Haiku)
+   haiku="yes"
+-  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS $QEMU_CFLAGS"
+-  LIBS="-lposix_error_mapper -lnetwork $LIBS"
++  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS -DBSD_SOURCE $QEMU_CFLAGS"
++  LIBS="-lposix_error_mapper -lnetwork -lbsd $LIBS"
+ ;;
+ Linux)
+   audio_drv_list="try-pa oss"
+--
+.20.1

-New patch
+[PULL 09/25] util/qemu-openpty.c: Don't assume pty.h is glibc-only
+From: David CARLIER <devnexen@gmail.com>
+Instead of using an OS-specific ifdef test to select the "openpty()
+is in pty.h" codepath, make configure check for the existence of
+the header and use the new CONFIG_PTY instead.
+This is necessary to build on Haiku, which also provides openpty()
+via pty.h.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-3-peter.maydell@linaro.org
+[PMM: Expanded commit message; rename to HAVE_PTY_H]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure           | 9 +++++++++
+ util/qemu-openpty.c | 2 +-
+files changed, 10 insertions(+), 1 deletion(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ else
+   l2tpv3=no
+ fi
++if check_include "pty.h" ; then
++  pty_h=yes
++else
++  pty_h=no
++fi
++
+ #########################################
+ # vhost interdependencies and host support
+@@ -XXX,XX +XXX,XX @@ fi
+ if test "$sheepdog" = "yes" ; then
+   echo "CONFIG_SHEEPDOG=y" >> $config_host_mak
+ fi
++if test "$pty_h" = "yes" ; then
++  echo "HAVE_PTY_H=y" >> $config_host_mak
++fi
+ if test "$fuzzing" = "yes" ; then
+   if test "$have_fuzzer" = "yes"; then
+     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
+diff --git a/util/qemu-openpty.c b/util/qemu-openpty.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/qemu-openpty.c
++++ b/util/qemu-openpty.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu-common.h"
+-#if defined(__GLIBC__)
++#if defined HAVE_PTY_H
+ # include <pty.h>
+ #elif defined CONFIG_BSD
+ # include <termios.h>
+--
+.20.1

-New patch
+[PULL 10/25] build: Check that mlockall() exists
+From: David CARLIER <devnexen@gmail.com>
+Instead of assuming that all POSIX platforms provide mlockall(),
+test for it in configure. If the host doesn't provide this platform
+then os_mlock() will fail -ENOSYS, as it does already on Windows.
+This is necessary for Haiku, which does not have mlockall().
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-4-peter.maydell@linaro.org
+[PMM: Expanded commit message; rename to HAVE_MLOCKALL]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure  | 15 +++++++++++++++
+ os-posix.c |  4 ++++
+files changed, 19 insertions(+)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ else
+   pty_h=no
+ fi
++cat > $TMPC <<EOF
++#include <sys/mman.h>
++int main(int argc, char *argv[]) {
++    return mlockall(MCL_FUTURE);
++}
++EOF
++if compile_prog "" "" ; then
++  have_mlockall=yes
++else
++  have_mlockall=no
++fi
++
+ #########################################
+ # vhost interdependencies and host support
+@@ -XXX,XX +XXX,XX @@ fi
+ if test "$pty_h" = "yes" ; then
+   echo "HAVE_PTY_H=y" >> $config_host_mak
+ fi
++if test "$have_mlockall" = "yes" ; then
++  echo "HAVE_MLOCKALL=y" >> $config_host_mak
++fi
+ if test "$fuzzing" = "yes" ; then
+   if test "$have_fuzzer" = "yes"; then
+     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
+diff --git a/os-posix.c b/os-posix.c
+index XXXXXXX..XXXXXXX 100644
+--- a/os-posix.c
++++ b/os-posix.c
+@@ -XXX,XX +XXX,XX @@ bool is_daemonized(void)
+ int os_mlock(void)
+ {
++#ifdef HAVE_MLOCKALL
+     int ret = 0;
+     ret = mlockall(MCL_CURRENT | MCL_FUTURE);
+@@ -XXX,XX +XXX,XX @@ int os_mlock(void)
+     }
+     return ret;
++#else
++    return -ENOSYS;
++#endif
+ }
+--
+.20.1

-New patch
+[PULL 11/25] osdep.h: Always include <sys/signal.h> if it exists
+From: David CARLIER <devnexen@gmail.com>
+Regularize our handling of <sys/signal.h>: currently we include it in
+osdep.h, but only for OpenBSD, and we include it without an ifdef
+guard in a couple of C files.  This causes problems for Haiku, which
+doesn't have that header.
+Instead, check in configure whether sys/signal.h exists, and if it
+does then always include it from osdep.h.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-5-peter.maydell@linaro.org
+[PMM: Expanded commit message; rename to HAVE_SYS_SIGNAL_H]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure                   | 10 ++++++++++
+ include/qemu/osdep.h        |  2 +-
+ hw/xen/xen-legacy-backend.c |  1 -
+ util/oslib-posix.c          |  1 -
+files changed, 11 insertions(+), 3 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ if check_include "libdrm/drm.h" ; then
+     have_drm_h=yes
+ fi
++#########################################
++# sys/signal.h check
++have_sys_signal_h=no
++if check_include "sys/signal.h" ; then
++  have_sys_signal_h=yes
++fi
++
+ ##########################################
+ # VTE probe
+@@ -XXX,XX +XXX,XX @@ fi
+ if test "$have_openpty" = "yes" ; then
+     echo "HAVE_OPENPTY=y" >> $config_host_mak
+ fi
++if test "$have_sys_signal_h" = "yes" ; then
++    echo "HAVE_SYS_SIGNAL_H=y" >> $config_host_mak
++fi
+ # Work around a system header bug with some kernel/XFS header
+ # versions where they both try to define 'struct fsxattr':
+diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/osdep.h
++++ b/include/qemu/osdep.h
+@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
+ #include <setjmp.h>
+ #include <signal.h>
+-#ifdef __OpenBSD__
++#ifdef HAVE_SYS_SIGNAL_H
+ #include <sys/signal.h>
+ #endif
+diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/xen/xen-legacy-backend.c
++++ b/hw/xen/xen-legacy-backend.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+-#include <sys/signal.h>
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+diff --git a/util/oslib-posix.c b/util/oslib-posix.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/oslib-posix.c
++++ b/util/oslib-posix.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/sockets.h"
+ #include "qemu/thread.h"
+ #include <libgen.h>
+-#include <sys/signal.h>
+ #include "qemu/cutils.h"
+ #ifdef CONFIG_LINUX
+--
+.20.1

-New patch
+[PULL 12/25] osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
+From: David CARLIER <devnexen@gmail.com>
+Haiku doesn't provide SIGIO; fix this up in osdep.h by defining it as
+equal to SIGPOLL.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-6-peter.maydell@linaro.org
+[PMM: Expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/qemu/osdep.h | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/osdep.h
++++ b/include/qemu/osdep.h
+@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
+ #define HAVE_CHARDEV_PARPORT 1
+ #endif
++#if defined(__HAIKU__)
++#define SIGIO SIGPOLL
++#endif
++
+ #if defined(CONFIG_LINUX)
+ #ifndef BUS_MCEERR_AR
+ #define BUS_MCEERR_AR 4
+--
+.20.1

-New patch
+[PULL 13/25] bswap.h: Include <endian.h> on Haiku for bswap operations
+From: David CARLIER <devnexen@gmail.com>
+Haiku puts the bswap* functions in <endian.h>; pull in that
+include file on that platform.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-7-peter.maydell@linaro.org
+[PMM: Expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/qemu/bswap.h | 2 ++
+file changed, 2 insertions(+)
+diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/bswap.h
++++ b/include/qemu/bswap.h
+@@ -XXX,XX +XXX,XX @@
+ # include <machine/bswap.h>
+ #elif defined(__FreeBSD__)
+ # include <sys/endian.h>
++#elif defined(__HAIKU__)
++# include <endian.h>
+ #elif defined(CONFIG_BYTESWAP_H)
+ # include <byteswap.h>
+--
+.20.1

-New patch
+[PULL 14/25] util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
+From: David CARLIER <devnexen@gmail.com>
+util/compatfd.c includes <sys/syscall.h> so that the CONFIG_SIGNALFD
+code can use SYS_signalfd. Guard the #include with CONFIG_SIGNALFD
+to avoid portability issues on hosts like Haiku which do not
+provide that header file.
+Signed-off-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-8-peter.maydell@linaro.org
+[PMM: Expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ util/compatfd.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/util/compatfd.c b/util/compatfd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/compatfd.c
++++ b/util/compatfd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/thread.h"
++#if defined(CONFIG_SIGNALFD)
+ #include <sys/syscall.h>
++#endif
+ struct sigfd_compat_info
+ {
+--
+.20.1

-[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
+[PULL 15/25] util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
-From: Marc Zyngier <maz@kernel.org>
+From: David CARLIER <devnexen@gmail.com>
-The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
+The qemu_init_exec_dir() function is inherently non-portable;
-ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
+provide an implementation for Haiku hosts.
 SError interrupts.
-Unfortunately, QEMU's implementation only considers the HCR_EL2
+Signed-off-by: David Carlier <devnexen@gmail.com>
 bits, and ignores the current exception level. This means a hypervisor
 trying to look at its own interrupt state actually sees the guest
 state, which is unexpected and breaks KVM as of Linux 5.3.
 Instead, check for the running EL and return the physical bits
 if not running in a virtualized context.
 Fixes: 636540e9c40b
 Cc: qemu-stable@nongnu.org
 Reported-by: Quentin Perret <qperret@google.com>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191122135833.28953-1-maz@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200703145614.16684-9-peter.maydell@linaro.org
 [PMM: Expanded commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 7 +++++--
+ util/oslib-posix.c | 19 +++++++++++++++++++
-file changed, 5 insertions(+), 2 deletions(-)
+file changed, 19 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/util/oslib-posix.c b/util/oslib-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/util/oslib-posix.c
-+++ b/target/arm/helper.c
++++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@
-     CPUState *cs = env_cpu(env);
+ #include <mach-o/dyld.h>
-     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+ #endif
-     uint64_t ret = 0;
-+    bool allow_virt = (arm_current_el(env) == 1 &&
++#ifdef __HAIKU__
-+                       (!arm_is_secure_below_el3(env) ||
++#include <kernel/image.h>
-+                        (env->cp15.scr_el3 & SCR_EEL2)));
++#endif
++
--    if (hcr_el2 & HCR_IMO) {
+ #include "qemu/mmap-alloc.h"
-+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
-         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
+ #ifdef CONFIG_DEBUG_STACK_USAGE
-             ret |= CPSR_I;
+@@ -XXX,XX +XXX,XX @@ void qemu_init_exec_dir(const char *argv0)
-         }
+             }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
          }
      }
++#elif defined(__HAIKU__)
--    if (hcr_el2 & HCR_FMO) {
++    {
-+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
++        image_info ii;
-         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
++        int32_t c = 0;
-             ret |= CPSR_F;
++
-         }
++        *buf = '\0';
 +        while (get_next_image_info(0, &c, &ii) == B_OK) {
 +            if (ii.type == B_APP_IMAGE) {
 +                strncpy(buf, ii.name, sizeof(buf));
 +                buf[sizeof(buf) - 1] = 0;
 +                p = buf;
 +                break;
 +            }
 +        }
 +    }
  #endif
      /* If we don't have any way of figuring out the actual executable
         location then try argv[0].  */
 --
 .20.1

-New patch
+[PULL 16/25] util/drm: make portable by avoiding struct dirent d_type
+From: Gerd Hoffmann <kraxel@redhat.com>
+Given this isn't perforance critical at all lets avoid the non-portable
+d_type and use fstat instead to check whenever the file is a chardev.
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reported-by: David Carlier <devnexen@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200703145614.16684-10-peter.maydell@linaro.org
+Message-id: 20200701180302.14821-1-kraxel@redhat.com
+[PMM: fixed comment style; tweaked subject line]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ util/drm.c | 19 ++++++++++++++-----
+file changed, 14 insertions(+), 5 deletions(-)
+diff --git a/util/drm.c b/util/drm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/drm.c
++++ b/util/drm.c
+@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
+ {
+     DIR *dir;
+     struct dirent *e;
+-    int r, fd;
++    struct stat st;
++    int r, fd, ret;
+     char *p;
+     if (rendernode) {
+@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
+     fd = -1;
+     while ((e = readdir(dir))) {
+-        if (e->d_type != DT_CHR) {
+-            continue;
+-        }
+-
+         if (strncmp(e->d_name, "renderD", 7)) {
+             continue;
+         }
+@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
+             g_free(p);
+             continue;
+         }
++
++        /*
++         * prefer fstat() over checking e->d_type == DT_CHR for
++         * portability reasons
++         */
++        ret = fstat(r, &st);
++        if (ret < 0 || (st.st_mode & S_IFMT) != S_IFCHR) {
++            close(r);
++            g_free(p);
++            continue;
++        }
++
+         fd = r;
+         g_free(p);
+         break;
+--
+.20.1

-New patch
+[PULL 17/25] target/nios2: add DISAS_NORETURN case for nothing more to generate
+From: Wentong Wu <wentong.wu@intel.com>
+Add DISAS_NORETURN case for nothing more to generate because at runtime
+execution will never return from some helper call. And at the same time
+replace DISAS_UPDATE in t_gen_helper_raise_exception and gen_exception
+with the newly added DISAS_NORETURN.
+Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Message-id: 20200710233433.19729-1-wentong.wu@intel.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/nios2/translate.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/nios2/translate.c
++++ b/target/nios2/translate.c
+@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
+     tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
+     gen_helper_raise_exception(dc->cpu_env, tmp);
+     tcg_temp_free_i32(tmp);
+-    dc->is_jmp = DISAS_UPDATE;
++    dc->is_jmp = DISAS_NORETURN;
+ }
+ static bool use_goto_tb(DisasContext *dc, uint32_t dest)
+@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
+     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
+     gen_helper_raise_exception(cpu_env, tmp);
+     tcg_temp_free_i32(tmp);
+-    dc->is_jmp = DISAS_UPDATE;
++    dc->is_jmp = DISAS_NORETURN;
+ }
+ /* generate intermediate code for basic block 'tb'.  */
+@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+         tcg_gen_exit_tb(NULL, 0);
+         break;
++    case DISAS_NORETURN:
+     case DISAS_TB_JUMP:
+         /* nothing more to generate */
+         break;
+--
+.20.1

-New patch
+[PULL 18/25] target/nios2: in line the semantics of DISAS_UPDATE with other targets
+From: Wentong Wu <wentong.wu@intel.com>
+In line the semantics of DISAS_UPDATE on nios2 target with other targets
+which is to explicitly write the PC back into the cpu state before doing
+a tcg_gen_exit_tb().
+Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Message-id: 20200710233433.19729-2-wentong.wu@intel.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/nios2/translate.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/nios2/translate.c
++++ b/target/nios2/translate.c
+@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+     /* Indicate where the next block should start */
+     switch (dc->is_jmp) {
+     case DISAS_NEXT:
++    case DISAS_UPDATE:
+         /* Save the current PC back into the CPU register */
+         tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
+         tcg_gen_exit_tb(NULL, 0);
+@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+     default:
+     case DISAS_JUMP:
+-    case DISAS_UPDATE:
+         /* The jump will already have updated the PC register */
+         tcg_gen_exit_tb(NULL, 0);
+         break;
+--
+.20.1

-New patch
+[PULL 19/25] target/nios2: Use gen_io_start around wrctl instruction
+From: Wentong Wu <wentong.wu@intel.com>
+wrctl instruction on nios2 target will cause checking cpu
+interrupt but tcg_handle_interrupt() will call cpu_abort()
+if the CPU gets an interrupt while it's not in 'can do IO'
+state, so add gen_io_start around wrctl instruction. Also
+at the same time, end the onging TB with DISAS_UPDATE.
+Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Message-id: 20200710233433.19729-3-wentong.wu@intel.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/nios2/translate.c | 5 +++++
+file changed, 5 insertions(+)
+diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/nios2/translate.c
++++ b/target/nios2/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/cpu_ldst.h"
+ #include "exec/translator.h"
+ #include "qemu/qemu-print.h"
++#include "exec/gen-icount.h"
+ /* is_jmp field values */
+ #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
+@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
+     /* If interrupts were enabled using WRCTL, trigger them. */
+ #if !defined(CONFIG_USER_ONLY)
+     if ((instr.imm5 + CR_BASE) == CR_STATUS) {
++        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
++            gen_io_start();
++        }
+         gen_helper_check_interrupts(dc->cpu_env);
++        dc->is_jmp = DISAS_UPDATE;
+     }
+ #endif
+ }
+--
+.20.1

-[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+[PULL 20/25] hw/nios2: exit to main CPU loop only when unmasking interrupts
-From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
+From: Wentong Wu <wentong.wu@intel.com>
-According to the PushStack() pseudocode in the armv7m RM,
+Only when guest code is unmasking interrupts, terminate the excution
-bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
+of translated code and exit to the main CPU loop to handle previous
-an FPU is present. Current implementation is doing it for
+pended interrupts because of the interrupts mask by guest code.
 armv8, but not for armv7. This patch makes the existing
 logic applicable to both code paths.
-Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
+Signed-off-by: Wentong Wu <wentong.wu@intel.com>
 Message-id: 20200710233433.19729-4-wentong.wu@intel.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/m_helper.c | 7 +++----
+ hw/nios2/cpu_pic.c | 3 ++-
-file changed, 3 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/hw/nios2/cpu_pic.c b/hw/nios2/cpu_pic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/hw/nios2/cpu_pic.c
-+++ b/target/arm/m_helper.c
++++ b/hw/nios2/cpu_pic.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void nios2_pic_cpu_handler(void *opaque, int irq, int level)
-         if (env->v7m.secure) {
-             lr |= R_V7M_EXCRET_S_MASK;
+ void nios2_check_interrupts(CPUNios2State *env)
-         }
+ {
--        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+-    if (env->irq_pending) {
--            lr |= R_V7M_EXCRET_FTYPE_MASK;
++    if (env->irq_pending &&
--        }
++        (env->regs[CR_STATUS] & CR_STATUS_PIE)) {
-     } else {
+         env->irq_pending = 0;
-         lr = R_V7M_EXCRET_RES1_MASK |
+         cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HARD);
              R_V7M_EXCRET_S_MASK |
              R_V7M_EXCRET_DCRS_MASK |
 -            R_V7M_EXCRET_FTYPE_MASK |
              R_V7M_EXCRET_ES_MASK;
          if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
              lr |= R_V7M_EXCRET_SPSEL_MASK;
          }
      }
 +    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
 +        lr |= R_V7M_EXCRET_FTYPE_MASK;
 +    }
      if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
 --
 .20.1

-New patch
+[PULL 21/25] hw/arm/tosa.c: Detabify
+Remove the hardcoded tabs from hw/arm/tosa.c. There aren't
+many, but since they're all in constant #defines they're not
+going to go away with our usual "only when we touch a function"
+policy on reformatting.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200628203748.14250-2-peter.maydell@linaro.org
+---
+ hw/arm/tosa.c | 44 ++++++++++++++++++++++----------------------
+file changed, 22 insertions(+), 22 deletions(-)
+diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/tosa.c
++++ b/hw/arm/tosa.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "exec/address-spaces.h"
+-#define TOSA_RAM    0x04000000
+-#define TOSA_ROM    0x00800000
++#define TOSA_RAM 0x04000000
++#define TOSA_ROM 0x00800000
+-#define TOSA_GPIO_USB_IN        (5)
+-#define TOSA_GPIO_nSD_DETECT    (9)
+-#define TOSA_GPIO_ON_RESET        (19)
+-#define TOSA_GPIO_CF_IRQ        (21)    /* CF slot0 Ready */
+-#define TOSA_GPIO_CF_CD            (13)
+-#define TOSA_GPIO_TC6393XB_INT  (15)
+-#define TOSA_GPIO_JC_CF_IRQ        (36)    /* CF slot1 Ready */
++#define TOSA_GPIO_USB_IN                (5)
++#define TOSA_GPIO_nSD_DETECT            (9)
++#define TOSA_GPIO_ON_RESET              (19)
++#define TOSA_GPIO_CF_IRQ                (21)    /* CF slot0 Ready */
++#define TOSA_GPIO_CF_CD                 (13)
++#define TOSA_GPIO_TC6393XB_INT          (15)
++#define TOSA_GPIO_JC_CF_IRQ             (36)    /* CF slot1 Ready */
+-#define TOSA_SCOOP_GPIO_BASE    1
+-#define TOSA_GPIO_IR_POWERDWN    (TOSA_SCOOP_GPIO_BASE + 2)
+-#define TOSA_GPIO_SD_WP            (TOSA_SCOOP_GPIO_BASE + 3)
+-#define TOSA_GPIO_PWR_ON        (TOSA_SCOOP_GPIO_BASE + 4)
++#define TOSA_SCOOP_GPIO_BASE            1
++#define TOSA_GPIO_IR_POWERDWN           (TOSA_SCOOP_GPIO_BASE + 2)
++#define TOSA_GPIO_SD_WP                 (TOSA_SCOOP_GPIO_BASE + 3)
++#define TOSA_GPIO_PWR_ON                (TOSA_SCOOP_GPIO_BASE + 4)
+-#define TOSA_SCOOP_JC_GPIO_BASE        1
+-#define TOSA_GPIO_BT_LED        (TOSA_SCOOP_JC_GPIO_BASE + 0)
+-#define TOSA_GPIO_NOTE_LED        (TOSA_SCOOP_JC_GPIO_BASE + 1)
+-#define TOSA_GPIO_CHRG_ERR_LED        (TOSA_SCOOP_JC_GPIO_BASE + 2)
+-#define TOSA_GPIO_TC6393XB_L3V_ON    (TOSA_SCOOP_JC_GPIO_BASE + 5)
+-#define TOSA_GPIO_WLAN_LED        (TOSA_SCOOP_JC_GPIO_BASE + 7)
++#define TOSA_SCOOP_JC_GPIO_BASE         1
++#define TOSA_GPIO_BT_LED                (TOSA_SCOOP_JC_GPIO_BASE + 0)
++#define TOSA_GPIO_NOTE_LED              (TOSA_SCOOP_JC_GPIO_BASE + 1)
++#define TOSA_GPIO_CHRG_ERR_LED          (TOSA_SCOOP_JC_GPIO_BASE + 2)
++#define TOSA_GPIO_TC6393XB_L3V_ON       (TOSA_SCOOP_JC_GPIO_BASE + 5)
++#define TOSA_GPIO_WLAN_LED              (TOSA_SCOOP_JC_GPIO_BASE + 7)
+-#define    DAC_BASE    0x4e
+-#define DAC_CH1        0
+-#define DAC_CH2        1
++#define DAC_BASE 0x4e
++#define DAC_CH1 0
++#define DAC_CH2 1
+ static void tosa_microdrive_attach(PXA2xxState *cpu)
+ {
+--
+.20.1

-New patch
+[PULL 22/25] hw/arm/tosa: Encapsulate misc GPIO handling in a device
+Currently we have a free-floating set of IRQs and a function
+tosa_out_switch() which handle the GPIO lines on the tosa board which
+connect to LEDs, and another free-floating IRQ and tosa_reset()
+function to handle the GPIO line that resets the system.  Encapsulate
+this behaviour in a simple QOM device.
+This commit fixes Coverity issue CID 1421929 (which pointed out that
+the 'outsignals' in tosa_gpio_setup() were leaked), because it
+removes the use of the qemu_allocate_irqs() API from this code
+entirely.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200628203748.14250-3-peter.maydell@linaro.org
+---
+ hw/arm/tosa.c | 88 +++++++++++++++++++++++++++++++++++++--------------
+file changed, 64 insertions(+), 24 deletions(-)
+diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/tosa.c
++++ b/hw/arm/tosa.c
+@@ -XXX,XX +XXX,XX @@ static void tosa_microdrive_attach(PXA2xxState *cpu)
+     pxa2xx_pcmcia_attach(cpu->pcmcia[0], md);
+ }
+-static void tosa_out_switch(void *opaque, int line, int level)
++/*
++ * Encapsulation of some GPIO line behaviour for the Tosa board
++ *
++ * QEMU interface:
++ *  + named GPIO inputs "leds[0..3]": assert to light LEDs
++ *  + named GPIO input "reset": when asserted, resets the system
++ */
++
++#define TYPE_TOSA_MISC_GPIO "tosa-misc-gpio"
++#define TOSA_MISC_GPIO(obj) \
++    OBJECT_CHECK(TosaMiscGPIOState, (obj), TYPE_TOSA_MISC_GPIO)
++
++typedef struct TosaMiscGPIOState {
++    SysBusDevice parent_obj;
++} TosaMiscGPIOState;
++
++static void tosa_gpio_leds(void *opaque, int line, int level)
+ {
+     switch (line) {
+-        case 0:
+-            fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
+-            break;
+-        case 1:
+-            fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
+-            break;
+-        case 2:
+-            fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
+-            break;
+-        case 3:
+-            fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
+-            break;
+-        default:
+-            fprintf(stderr, "Uhandled out event: %d = %d\n", line, level);
+-            break;
++    case 0:
++        fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
++        break;
++    case 1:
++        fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
++        break;
++    case 2:
++        fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
++        break;
++    case 3:
++        fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
++        break;
++    default:
++        g_assert_not_reached();
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void tosa_reset(void *opaque, int line, int level)
+     }
+ }
++static void tosa_misc_gpio_init(Object *obj)
++{
++    DeviceState *dev = DEVICE(obj);
++
++    qdev_init_gpio_in_named(dev, tosa_gpio_leds, "leds", 4);
++    qdev_init_gpio_in_named(dev, tosa_reset, "reset", 1);
++}
++
+ static void tosa_gpio_setup(PXA2xxState *cpu,
+                 DeviceState *scp0,
+                 DeviceState *scp1,
+                 TC6393xbState *tmio)
+ {
+-    qemu_irq *outsignals = qemu_allocate_irqs(tosa_out_switch, cpu, 4);
+-    qemu_irq reset;
++    DeviceState *misc_gpio;
++
++    misc_gpio = sysbus_create_simple(TYPE_TOSA_MISC_GPIO, -1, NULL);
+     /* MMC/SD host */
+     pxa2xx_mmci_handlers(cpu->mmc,
+@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
+                     qemu_irq_invert(qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_nSD_DETECT)));
+     /* Handle reset */
+-    reset = qemu_allocate_irq(tosa_reset, cpu, 0);
+-    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET, reset);
++    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET,
++                          qdev_get_gpio_in_named(misc_gpio, "reset", 0));
+     /* PCMCIA signals: card's IRQ and Card-Detect */
+     pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0],
+@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
+                         qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_JC_CF_IRQ),
+                         NULL);
+-    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED, outsignals[0]);
+-    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED, outsignals[1]);
+-    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED, outsignals[2]);
+-    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED, outsignals[3]);
++    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED,
++                          qdev_get_gpio_in_named(misc_gpio, "leds", 0));
++    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED,
++                          qdev_get_gpio_in_named(misc_gpio, "leds", 1));
++    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED,
++                          qdev_get_gpio_in_named(misc_gpio, "leds", 2));
++    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED,
++                          qdev_get_gpio_in_named(misc_gpio, "leds", 3));
+     qdev_connect_gpio_out(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo tosa_ssp_info = {
+     .class_init    = tosa_ssp_class_init,
+ };
++static const TypeInfo tosa_misc_gpio_info = {
++    .name          = "tosa-misc-gpio",
++    .parent        = TYPE_SYS_BUS_DEVICE,
++    .instance_size = sizeof(TosaMiscGPIOState),
++    .instance_init = tosa_misc_gpio_init,
++    /*
++     * No class init required: device has no internal state so does not
++     * need to set up reset or vmstate, and has no realize method.
++     */
++};
++
+ static void tosa_register_types(void)
+ {
+     type_register_static(&tosa_dac_info);
+     type_register_static(&tosa_ssp_info);
++    type_register_static(&tosa_misc_gpio_info);
+ }
+ type_init(tosa_register_types)
+--
+.20.1

-New patch
+[PULL 23/25] hw/arm/palm.c: Detabify
+Remove hard-tabs from palm.c.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200628214230.2592-2-peter.maydell@linaro.org
+---
+ hw/arm/palm.c | 64 +++++++++++++++++++++++++--------------------------
+file changed, 32 insertions(+), 32 deletions(-)
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps static_ops = {
+ /* Palm Tunsgten|E support */
+ /* Shared GPIOs */
+-#define PALMTE_USBDETECT_GPIO    0
+-#define PALMTE_USB_OR_DC_GPIO    1
+-#define PALMTE_TSC_GPIO        4
+-#define PALMTE_PINTDAV_GPIO    6
+-#define PALMTE_MMC_WP_GPIO    8
+-#define PALMTE_MMC_POWER_GPIO    9
+-#define PALMTE_HDQ_GPIO        11
+-#define PALMTE_HEADPHONES_GPIO    14
+-#define PALMTE_SPEAKER_GPIO    15
++#define PALMTE_USBDETECT_GPIO   0
++#define PALMTE_USB_OR_DC_GPIO   1
++#define PALMTE_TSC_GPIO                 4
++#define PALMTE_PINTDAV_GPIO     6
++#define PALMTE_MMC_WP_GPIO      8
++#define PALMTE_MMC_POWER_GPIO   9
++#define PALMTE_HDQ_GPIO                 11
++#define PALMTE_HEADPHONES_GPIO  14
++#define PALMTE_SPEAKER_GPIO     15
+ /* MPU private GPIOs */
+-#define PALMTE_DC_GPIO        2
+-#define PALMTE_MMC_SWITCH_GPIO    4
+-#define PALMTE_MMC1_GPIO    6
+-#define PALMTE_MMC2_GPIO    7
+-#define PALMTE_MMC3_GPIO    11
++#define PALMTE_DC_GPIO          2
++#define PALMTE_MMC_SWITCH_GPIO  4
++#define PALMTE_MMC1_GPIO        6
++#define PALMTE_MMC2_GPIO        7
++#define PALMTE_MMC3_GPIO        11
+ static MouseTransformInfo palmte_pointercal = {
+     .x = 320,
+@@ -XXX,XX +XXX,XX @@ static struct {
+     int column;
+ } palmte_keymap[0x80] = {
+     [0 ... 0x7f] = { -1, -1 },
+-    [0x3b] = { 0, 0 },    /* F1    -> Calendar */
+-    [0x3c] = { 1, 0 },    /* F2    -> Contacts */
+-    [0x3d] = { 2, 0 },    /* F3    -> Tasks List */
+-    [0x3e] = { 3, 0 },    /* F4    -> Note Pad */
+-    [0x01] = { 4, 0 },    /* Esc    -> Power */
+-    [0x4b] = { 0, 1 },    /*        Left */
+-    [0x50] = { 1, 1 },    /*        Down */
+-    [0x48] = { 2, 1 },    /*       Up */
+-    [0x4d] = { 3, 1 },    /*       Right */
+-    [0x4c] = { 4, 1 },    /*        Centre */
+-    [0x39] = { 4, 1 },    /* Spc    -> Centre */
++    [0x3b] = { 0, 0 },  /* F1   -> Calendar */
++    [0x3c] = { 1, 0 },  /* F2   -> Contacts */
++    [0x3d] = { 2, 0 },  /* F3   -> Tasks List */
++    [0x3e] = { 3, 0 },  /* F4   -> Note Pad */
++    [0x01] = { 4, 0 },  /* Esc  -> Power */
++    [0x4b] = { 0, 1 },  /*         Left */
++    [0x50] = { 1, 1 },  /*         Down */
++    [0x48] = { 2, 1 },  /*         Up */
++    [0x4d] = { 3, 1 },  /*         Right */
++    [0x4c] = { 4, 1 },  /*         Centre */
++    [0x39] = { 4, 1 },  /* Spc  -> Centre */
+ };
+ static void palmte_button_event(void *opaque, int keycode)
+@@ -XXX,XX +XXX,XX @@ static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
+                             [PALMTE_MMC_SWITCH_GPIO]));
+     misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
+-    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,    misc_gpio[0]);
+-    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,    misc_gpio[1]);
+-    qdev_connect_gpio_out(cpu->gpio, 11,            misc_gpio[2]);
+-    qdev_connect_gpio_out(cpu->gpio, 12,            misc_gpio[3]);
+-    qdev_connect_gpio_out(cpu->gpio, 13,            misc_gpio[4]);
+-    omap_mpuio_out_set(cpu->mpuio, 1,                misc_gpio[5]);
+-    omap_mpuio_out_set(cpu->mpuio, 3,                misc_gpio[6]);
++    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
++    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
++    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
++    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
++    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
++    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
++    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
+     /* Reset some inputs to initial state.  */
+     qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
+--
+.20.1

-New patch
+[PULL 24/25] hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+Replace the free-floating set of IRQs and palmte_onoff_gpios()
+function with a simple QOM device that encapsulates this
+behaviour.
+This fixes Coverity issue CID 1421944, which points out that
+the memory returned by qemu_allocate_irqs() is leaked.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200628214230.2592-3-peter.maydell@linaro.org
+---
+ hw/arm/palm.c | 61 +++++++++++++++++++++++++++++++++++++++++++--------
+file changed, 52 insertions(+), 9 deletions(-)
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@ static void palmte_button_event(void *opaque, int keycode)
+                         !(keycode & 0x80));
+ }
++/*
++ * Encapsulation of some GPIO line behaviour for the Palm board
++ *
++ * QEMU interface:
++ *  + unnamed GPIO inputs 0..6: for the various miscellaneous input lines
++ */
++
++#define TYPE_PALM_MISC_GPIO "palm-misc-gpio"
++#define PALM_MISC_GPIO(obj) \
++    OBJECT_CHECK(PalmMiscGPIOState, (obj), TYPE_PALM_MISC_GPIO)
++
++typedef struct PalmMiscGPIOState {
++    SysBusDevice parent_obj;
++} PalmMiscGPIOState;
++
+ static void palmte_onoff_gpios(void *opaque, int line, int level)
+ {
+     switch (line) {
+@@ -XXX,XX +XXX,XX @@ static void palmte_onoff_gpios(void *opaque, int line, int level)
+     }
+ }
++static void palm_misc_gpio_init(Object *obj)
++{
++    DeviceState *dev = DEVICE(obj);
++
++    qdev_init_gpio_in(dev, palmte_onoff_gpios, 7);
++}
++
++static const TypeInfo palm_misc_gpio_info = {
++    .name = TYPE_PALM_MISC_GPIO,
++    .parent = TYPE_SYS_BUS_DEVICE,
++    .instance_size = sizeof(PalmMiscGPIOState),
++    .instance_init = palm_misc_gpio_init,
++    /*
++     * No class init required: device has no internal state so does not
++     * need to set up reset or vmstate, and has no realize method.
++     */
++};
++
+ static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
+ {
+-    qemu_irq *misc_gpio;
++    DeviceState *misc_gpio;
++
++    misc_gpio = sysbus_create_simple(TYPE_PALM_MISC_GPIO, -1, NULL);
+     omap_mmc_handlers(cpu->mmc,
+                     qdev_get_gpio_in(cpu->gpio, PALMTE_MMC_WP_GPIO),
+                     qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
+                             [PALMTE_MMC_SWITCH_GPIO]));
+-    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
+-    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
+-    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
+-    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
+-    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
+-    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
+-    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
+-    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
++    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,
++                          qdev_get_gpio_in(misc_gpio, 0));
++    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,
++                          qdev_get_gpio_in(misc_gpio, 1));
++    qdev_connect_gpio_out(cpu->gpio, 11, qdev_get_gpio_in(misc_gpio, 2));
++    qdev_connect_gpio_out(cpu->gpio, 12, qdev_get_gpio_in(misc_gpio, 3));
++    qdev_connect_gpio_out(cpu->gpio, 13, qdev_get_gpio_in(misc_gpio, 4));
++    omap_mpuio_out_set(cpu->mpuio, 1, qdev_get_gpio_in(misc_gpio, 5));
++    omap_mpuio_out_set(cpu->mpuio, 3, qdev_get_gpio_in(misc_gpio, 6));
+     /* Reset some inputs to initial state.  */
+     qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
+@@ -XXX,XX +XXX,XX @@ static void palmte_machine_init(MachineClass *mc)
+ }
+ DEFINE_MACHINE("cheetah", palmte_machine_init)
++
++static void palm_register_types(void)
++{
++    type_register_static(&palm_misc_gpio_info);
++}
++
++type_init(palm_register_types)
+--
+.20.1

-[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
+[PULL 25/25] hw/arm/aspeed: Do not create and attach empty SD cards by default
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Add the CRP as unimplemented thus avoiding bus errors when
+Since added in commit 2bea128c3d, each SDHCI is wired with a SD
-guests access these registers.
+card, using empty card when no block drive provided. This is not
 the desired behavior. The SDHCI exposes a SD bus to plug cards
 on, if no card available, it is fine to have an unplugged bus.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Avoid creating unnecessary SD card device when no block drive
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+provided.
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
+Fixes: 2bea128c3d ("hw/sd/aspeed_sdhci: New device")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200705173402.15620-1-f4bug@amsat.org
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h | 3 +++
+ hw/arm/aspeed.c | 9 +++++----
- hw/arm/xlnx-versal.c         | 2 ++
+file changed, 5 insertions(+), 4 deletions(-)
 files changed, 5 insertions(+)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/hw/arm/aspeed.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
- #define MM_IOU_SCNTRS_SIZE          0x10000
+ {
- #define MM_FPD_CRF                  0xfd1a0000U
+         DeviceState *card;
- #define MM_FPD_CRF_SIZE             0x140000
-+
+-        card = qdev_new(TYPE_SD_CARD);
-+#define MM_PMC_CRP                  0xf1260000U
+-        if (dinfo) {
-+#define MM_PMC_CRP_SIZE             0x10000
+-            qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
- #endif
+-                                    &error_fatal);
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
++        if (!dinfo) {
-index XXXXXXX..XXXXXXX 100644
++            return;
---- a/hw/arm/xlnx-versal.c
+         }
-+++ b/hw/arm/xlnx-versal.c
++        card = qdev_new(TYPE_SD_CARD);
-@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
++        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
-                         MM_CRL, MM_CRL_SIZE);
++                                &error_fatal);
-     versal_unimp_area(s, "crf", &s->mr_ps,
+         qdev_realize_and_unref(card,
-                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+                                qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
-+    versal_unimp_area(s, "crp", &s->mr_ps,
+                                &error_fatal);
 +                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
      versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                          MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
      versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 --
 .20.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1

Last lot of target-arm changes to squeeze in before rc1:
 * various minor Arm bug fixes
 * David Carlier's Haiku build portability fixes
 * Wentong Wu's fixes for icount handling in the nios2 target

The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713

for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:

hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/bcm2836: Remove unused 'cpu_type' field
 * target/arm: Fix mtedesc for do_mem_zpz
 * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
 * target/arm: Don't do raw writes for PMINTENCLR
 * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
 * build: Fix various issues with building on Haiku
 * target/nios2: fix wrctl behaviour when using icount
 * hw/arm/tosa: Encapsulate misc GPIO handling in a device
 * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
 * hw/arm/aspeed: Do not create and attach empty SD cards by default

----------------------------------------------------------------
Aaron Lindsay (1):
      target/arm: Don't do raw writes for PMINTENCLR

David CARLIER (8):
      build: Enable BSD symbols for Haiku
      util/qemu-openpty.c: Don't assume pty.h is glibc-only
      build: Check that mlockall() exists
      osdep.h: Always include <sys/signal.h> if it exists
      osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
      bswap.h: Include <endian.h> on Haiku for bswap operations
      util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
      util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku

Eric Auger (1):
      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()

Gerd Hoffmann (1):
      util/drm: make portable by avoiding struct dirent d_type

Jean-Christophe Dubois (3):
      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
      Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor

Peter Maydell (4):
      hw/arm/tosa.c: Detabify
      hw/arm/tosa: Encapsulate misc GPIO handling in a device
      hw/arm/palm.c: Detabify
      hw/arm/palm.c: Encapsulate misc GPIO handling in a device

Philippe Mathieu-Daudé (2):
      hw/arm/bcm2836: Remove unused 'cpu_type' field
      hw/arm/aspeed: Do not create and attach empty SD cards by default

Richard Henderson (1):
      target/arm: Fix mtedesc for do_mem_zpz

Wentong Wu (4):
      target/nios2: add DISAS_NORETURN case for nothing more to generate
      target/nios2: in line the semantics of DISAS_UPDATE with other targets
      target/nios2: Use gen_io_start around wrctl instruction
      hw/nios2: exit to main CPU loop only when unmasking interrupts

From: Richard Henderson <richard.henderson@linaro.org>

The mtedesc that was constructed was not actually passed in.
Found by Coverity (CID 1429996).

Fixes: d28d12f008e
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
         desc <<= SVE_MTEDESC_SHIFT;
     }
-    desc = simd_desc(vsz, vsz, scale);
+    desc = simd_desc(vsz, vsz, desc | scale);
     t_desc = tcg_const_i32(desc);
 
     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 1 +
 hw/arm/fsl-imx25.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     MemoryRegion   rom[2];
     MemoryRegion   iram;
     MemoryRegion   iram_alias;
+    uint32_t       phy_num;
 } FslIMX25State;
 
 /**
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                             epit_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                 &s->iram_alias);
 }
 
+static Property fsl_imx25_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx25_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx25_properties);
     dc->realize = fsl_imx25_realize;
     dc->desc = "i.MX25 SOC";
     /*
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 1 +
 hw/arm/fsl-imx6.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     MemoryRegion   caam;
     MemoryRegion   ocram;
     MemoryRegion   ocram_alias;
+    uint32_t       phy_num;
 } FslIMX6State;
 
 
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             spi_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                 &s->ocram_alias);
 }
 
+static Property fsl_imx6_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx6_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx6_properties);
     dc->realize = fsl_imx6_realize;
     dc->desc = "i.MX6 SOC";
     /* Reason: Uses serial_hd() in the realize() function */
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx7.h | 1 +
 hw/arm/fsl-imx7.c         | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
 } FslIMX7State;
 
 enum FslIMX7MemoryMap {
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
             FSL_IMX7_ENET2_ADDR,
         };
 
+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
+                                 s->phy_num[i], &error_abort);
         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                 FSL_IMX7_PCIE_PHY_SIZE);
 }
 
+static Property fsl_imx7_properties[] = {
+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx7_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx7_properties);
     dc->realize = fsl_imx7_realize;
 
     /* Reason: Uses serial_hds and nd_table in realize() directly */
-- 
2.20.1

From: Aaron Lindsay <aaron@os.amperecomputing.com>

Raw writes to this register when in KVM mode can cause interrupts to be
raised (even when the PMU is disabled). Because the underlying state is
already aliased to PMINTENSET (which already provides raw write
functions), we can safely disable raw accesses to PMINTENCLR entirely.

Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write, },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Coverity points out (CID 1430180) that the new case is missing
break or a /* fallthrough */ comment. Break is the right thing to
do as in that case, tail is not used.

Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200708160147.18426-1-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/virtio/virtio-iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
             ptail = (struct virtio_iommu_req_tail *)
                         (buf + s->config.probe_size);
             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+            break;
         }
         default:
             tail.status = VIRTIO_IOMMU_S_UNSUPP;
-- 
2.20.1