Series comparison

-[PULL 00/12] target-arm queue
+[PULL 00/16] target-arm queue
-One last arm pullreq before I stop work for the end of the year...
+Patches for rc1: nothing major, just some minor bugfixes and
 code cleanups.
 -- PMM
-The following changes since commit 8e5943260a8f765216674ee87ce8588cc4e7463e:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-12-20 12:46:10 +0000)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191220
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to c8fa6079eb35888587f1be27c1590da4edcc5098:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on() (2019-12-20 14:03:00 +0000)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Support emulating the generic timers at frequencies other than 62.5MHz
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * Various fixes for SMMUv3 emulation bugs
+ * Minor coding style fixes
- * Improve assert error message for hflags mismatches
+ * docs: add some notes on the sbsa-ref machine
- * arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
  * target/arm: Fix neon VTBL/VTBX for len > 1
  * hw/arm/armsse: Correct expansion MPC interrupt lines
  * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Andrew Jeffery (4):
+Alex Bennée (1):
-      target/arm: Remove redundant scaling of nexttick
+      docs: add some notes on the sbsa-ref machine
       target/arm: Abstract the generic timer frequency
       target/arm: Prepare generic timer for per-platform CNTFRQ
       ast2600: Configure CNTFRQ at 1125MHz
-Niek Linnenbank (1):
+AlexChen (1):
-      arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
+      ssi: Fix bad printf format specifiers
-Philippe Mathieu-Daudé (1):
+Andrew Jones (1):
-      target/arm: Display helpful message when hflags mismatch
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
-Simon Veith (6):
+Havard Skinnemoen (1):
-      hw/arm/smmuv3: Apply address mask to linear strtab base address
+      tests/qtest/npcm7xx_rng-test: count runs properly
       hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
       hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
       hw/arm/smmuv3: Align stream table base address to table size
       hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro
       hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position
- hw/arm/smmuv3-internal.h  |  6 ++---
+Peter Maydell (2):
- target/arm/cpu.h          |  5 ++++
+      hw/arm/nseries: Check return value from load_image_targphys()
- hw/arm/aspeed_ast2600.c   |  3 +++
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
  hw/arm/smmuv3.c           | 28 +++++++++++++++-----
  target/arm/arm-powerctl.c |  3 +++
  target/arm/cpu.c          | 65 +++++++++++++++++++++++++++++++++++++++++------
  target/arm/helper.c       | 42 +++++++++++++++++++++++-------
 files changed, 125 insertions(+), 27 deletions(-)
+Philippe Mathieu-Daudé (6):
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      hw/arm/armsse: Correct expansion MPC interrupt lines
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+Richard Henderson (1):
+      target/arm: Fix neon VTBL/VTBX for len > 1
+Xinhao Zhang (3):
+      target/arm: add spaces around operator
+      target/arm: Don't use '#' flag of printf format
+      target/arm: add space before the open parenthesis '('
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-New patch
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+From: Andrew Jones <drjones@redhat.com>
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
+in the build when building armv7m_systick.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
+ config ARM_V7M
+     bool
++    select PTIMER
+ config ALLWINNER_A10
+     bool
+--
+.20.1

-New patch
+[PULL 02/16] ssi: Fix bad printf format specifiers
+From: AlexChen <alex.chen@huawei.com>
+We should use printf format specifier "%u" instead of "%d" for
+argument of type "unsigned int".
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 5FA280F5.8060902@huawei.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/ssi/imx_spi.c    | 2 +-
+ hw/ssi/xilinx_spi.c | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/imx_spi.c
++++ b/hw/ssi/imx_spi.c
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+     case ECSPI_MSGDATA:
+         return  "ECSPI_MSGDATA";
+     default:
+-        sprintf(unknown, "%d ?", reg);
++        sprintf(unknown, "%u ?", reg);
+         return unknown;
+     }
+ }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/xilinx_spi.c
++++ b/hw/ssi/xilinx_spi.c
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
+        irq chain unless things really changed.  */
+     if (pending != s->irqline) {
+         s->irqline = pending;
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+         qemu_set_irq(s->irq, pending);
+     }
+--
+.20.1

-[PULL 03/12] target/arm: Prepare generic timer for per-platform CNTFRQ
+[PULL 03/16] target/arm: add spaces around operator
-From: Andrew Jeffery <andrew@aj.id.au>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-The ASPEED AST2600 clocks the generic timer at the rate of HPLL. On
+Fix code style. Operator needs spaces both sides.
 recent firmwares this is at 1125MHz, which is considerably quicker than
 the assumed 62.5MHz of the current generic timer implementation. The
 delta between the value as read from CNTFRQ and the true rate of the
 underlying QEMUTimer leads to sticky behaviour in AST2600 guests.
-Add a feature-gated property exposing CNTFRQ for ARM CPUs providing the
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-generic timer. This allows platforms to configure CNTFRQ (and the
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
-associated QEMUTimer) to the appropriate frequency prior to starting the
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
-guest.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 As the platform can now determine the rate of CNTFRQ we're exposed to
 limitations of QEMUTimer that didn't previously materialise: In the
 course of emulation we need to arbitrarily and accurately convert
 between guest ticks and time, but we're constrained by QEMUTimer's use
 of an integer scaling factor. The effect is QEMUTimer cannot exactly
 capture the period of frequencies that do not cleanly divide
 NANOSECONDS_PER_SECOND for scaling ticks to time. As such, provide an
 equally inaccurate scaling factor for scaling time to ticks so at least
 a self-consistent inverse relationship holds.
 Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: a22db9325f96e39f76e3c2baddcb712149f46bf2.1576215453.git-series.andrew@aj.id.au
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c    | 61 +++++++++++++++++++++++++++++++++++++--------
+ target/arm/arch_dump.c | 8 ++++----
- target/arm/helper.c |  9 ++++++-
+ target/arm/arm-semi.c  | 8 ++++----
-files changed, 59 insertions(+), 11 deletions(-)
+ target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/arch_dump.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/arch_dump.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
-     if (tcg_enabled()) {
-         cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
+     for (i = 0; i < 32; ++i) {
          uint64_t *q = aa64_vfp_qreg(env, i);
 -        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
 -        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
 +        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
 +        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
      }
--
--    cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
- }
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
-+static Property arm_cpu_gt_cntfrq_property =
+         for (i = 0; i < 32; ++i) {
-+            DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,
+             uint64_t tmp = note.vfp.vregs[2*i];
-+                               NANOSECONDS_PER_SECOND / GTIMER_SCALE);
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-+
+-            note.vfp.vregs[2*i+1] = tmp;
- static Property arm_cpu_reset_cbar_property =
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
-             DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
++            note.vfp.vregs[2 * i + 1] = tmp;
@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
  unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
  {
 +    /*
 +     * The exact approach to calculating guest ticks is:
 +     *
 +     *     muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), cpu->gt_cntfrq_hz,
 +     *              NANOSECONDS_PER_SECOND);
 +     *
 +     * We don't do that. Rather we intentionally use integer division
 +     * truncation below and in the caller for the conversion of host monotonic
 +     * time to guest ticks to provide the exact inverse for the semantics of
 +     * the QEMUTimer scale factor. QEMUTimer's scale facter is an integer, so
 +     * it loses precision when representing frequencies where
 +     * `(NANOSECONDS_PER_SECOND % cpu->gt_cntfrq) > 0` holds. Failing to
 +     * provide an exact inverse leads to scheduling timers with negative
 +     * periods, which in turn leads to sticky behaviour in the guest.
 +     *
 +     * Finally, CNTFRQ is effectively capped at 1GHz to ensure our scale factor
 +     * cannot become zero.
 +     */
      return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
        NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
  }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
                               &error_abort);
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
 +        qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property,
 +                                 &error_abort);
 +    }
  }
  static void arm_cpu_finalizefn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          }
      }
--    cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
--                                           arm_gt_ptimer_cb, cpu);
+index XXXXXXX..XXXXXXX 100644
--    cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
+--- a/target/arm/arm-semi.c
--                                           arm_gt_vtimer_cb, cpu);
++++ b/target/arm/arm-semi.c
--    cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
--                                          arm_gt_htimer_cb, cpu);
+         if (use_gdb_syscalls()) {
--    cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
+             arm_semi_open_guestfd = guestfd;
--                                          arm_gt_stimer_cb, cpu);
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-+
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
-+    {
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
-+        uint64_t scale;
+         } else {
-+
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
-+        if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
+             if (ret == (uint32_t)-1) {
-+            if (!cpu->gt_cntfrq_hz) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-+                error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",
+         GET_ARG(1);
-+                           cpu->gt_cntfrq_hz);
+         if (use_gdb_syscalls()) {
-+                return;
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-+            }
+-                                  arg0, (int)arg1+1);
-+            scale = gt_cntfrq_period_ns(cpu);
++                                  arg0, (int)arg1 + 1);
-+        } else {
+         } else {
-+            scale = GTIMER_SCALE;
+             s = lock_user_string(arg0);
-+        }
+             if (!s) {
-+
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-+        cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+         GET_ARG(3);
-+                                               arm_gt_ptimer_cb, cpu);
+         if (use_gdb_syscalls()) {
-+        cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-+                                               arm_gt_vtimer_cb, cpu);
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
-+        cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
-+                                              arm_gt_htimer_cb, cpu);
+         } else {
-+        cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+             char *s2;
-+                                              arm_gt_stimer_cb, cpu);
+             s = lock_user_string(arg0);
-+    }
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
- #endif
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
-     cpu_exec_realizefn(cs, &local_err);
+             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_gt_stimer_cb(void *opaque)
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
-     gt_recalc_timer(cpu, GTIMER_SEC);
+     uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
-+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
-+{
-+    ARMCPU *cpu = env_archcpu(env);
-+
-+    cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
-+}
-+
- static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-     /* Note that CNTFRQ is purely reads-as-written for the benefit
-      * of software; writing it doesn't actually change the timer frequency.
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
-       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
-       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
--      .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
-+      .resetfn = arm_gt_cntfrq_reset,
-     },
-     /* overall control: mostly access permissions */
-     { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
 --
 .20.1

-[PULL 05/12] hw/arm/smmuv3: Apply address mask to linear strtab base address
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-From: Simon Veith <sveith@amazon.de>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-In the SMMU_STRTAB_BASE register, the stream table base address only
+Fix code style. Don't use '#' flag of printf format ('%#') in
-occupies bits [51:6]. Other bits, such as RA (bit [62]), must be masked
+format strings, use '0x' prefix instead
 out to obtain the base address.
-The branch for 2-level stream tables correctly applies this mask by way
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-of SMMU_BASE_ADDR_MASK, but the one for linear stream tables does not.
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Apply the missing mask in that case as well so that the correct stream
 base address is used by guests which configure a linear stream table.
 Linux guests are unaffected by this change because they choose a 2-level
 stream table layout for the QEMU SMMUv3, based on the size of its stream
 ID space.
 ref. ARM IHI 0070C, section 6.3.23.
 Signed-off-by: Simon Veith <sveith@amazon.de>
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-2-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3.c | 2 +-
+ target/arm/translate-a64.c | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/smmuv3.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
-         }
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
-         addr = l2ptr + l2_ste_offset * sizeof(*ste);
+                 break;
-     } else {
+             default:
--        addr = s->strtab_base + sid * sizeof(*ste);
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-+        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                          __func__, insn, fpopcode, s->pc_curr);
                  g_assert_not_reached();
              }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      case 0x7f: /* FSQRT (vector) */
          break;
      default:
 -        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
 +        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
-     if (smmu_get_ste(s, addr, ste, event)) {
 --
 .20.1

-[PULL 10/12] hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-From: Simon Veith <sveith@amazon.de>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-The smmuv3_record_event() function that generates the F_STE_FETCH error
+Fix code style. Space required before the open parenthesis '('.
 uses the EVT_SET_ADDR macro to record the fetch address, placing it in
 -bit words 4 and 5.
-The correct position for this address is in words 6 and 7, per the
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-SMMUv3 Architecture Specification.
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
 Update the function to use the EVT_SET_ADDR2 macro instead, which is the
 macro intended for writing to these words.
 ref. ARM IHI 0070C, section 7.3.4.
 Signed-off-by: Simon Veith <sveith@amazon.de>
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-7-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3.c | 2 +-
+ target/arm/translate.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/smmuv3.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     case SMMU_EVT_F_STE_FETCH:
+             - Hardware watchpoints.
-         EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
+            Hardware breakpoints have already been handled and skip this code.
-         EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
+          */
--        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
+-        switch(dc->base.is_jmp) {
-+        EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
++        switch (dc->base.is_jmp) {
-         break;
+         case DISAS_NEXT:
-     case SMMU_EVT_C_BAD_STE:
+         case DISAS_TOO_MANY:
-         EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
+             gen_goto_tb(dc, 1, dc->base.pc_next);
 --
 .20.1

-[PULL 04/12] ast2600: Configure CNTFRQ at 1125MHz
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-From: Andrew Jeffery <andrew@aj.id.au>
+From: Alex Bennée <alex.bennee@linaro.org>
-This matches the configuration set by u-boot on the AST2600.
+We should at least document what this machine is about.
-Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Cc: Leif Lindholm <leif@nuviainc.com>
-Message-id: 080ca1267a09381c43cf3c50d434fb6c186f2b6e.1576215453.git-series.andrew@aj.id.au
+Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed_ast2600.c | 3 +++
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
-file changed, 3 insertions(+)
+ docs/system/target-arm.rst |  1 +
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
 +Arm Server Base System Architecture Reference board (``sbsa-ref``)
 +==================================================================
 +
 +While the `virt` board is a generic board platform that doesn't match
 +any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
+--- a/docs/system/target-arm.rst
-+++ b/hw/arm/aspeed_ast2600.c
++++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-         object_property_set_int(OBJECT(&s->cpu[i]), aspeed_calc_affinity(i),
+    arm/mps2
-                                 "mp-affinity", &error_abort);
+    arm/musca
+    arm/realview
-+        object_property_set_int(OBJECT(&s->cpu[i]), 1125000000, "cntfrq",
++   arm/sbsa
-+                                &error_abort);
+    arm/versatile
-+
+    arm/vexpress
-         /*
+    arm/aspeed
           * TODO: the secondary CPUs are started and a boot helper
           * is needed when using -kernel
 --
 .20.1

-[PULL 11/12] target/arm: Display helpful message when hflags mismatch
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Instead of crashing in a confuse way, give some hint to the user
+When using a Cortex-A15, the Virt machine does not use any
-about why we aborted. He might report the issue without having
+MPCore peripherals. Remove the dependency.
 to use a debugger.
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20191209134552.27733-1-philmd@redhat.com
+Message-id: 20201107114852.271922-1-philmd@redhat.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 18 +++++++++++++++---
+ hw/arm/Kconfig | 1 -
-file changed, 15 insertions(+), 3 deletions(-)
+file changed, 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/Kconfig
-+++ b/target/arm/helper.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
+     imply VFIO_PLATFORM
- }
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
-+static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
+-    select A15MPCORE
-+{
+     select ACPI
-+#ifdef CONFIG_DEBUG_TCG
+     select ARM_SMMUV3
-+    uint32_t env_flags_current = env->hflags;
+     select GPIO_KEY
 +    uint32_t env_flags_rebuilt = rebuild_hflags_internal(env);
 +
 +    if (unlikely(env_flags_current != env_flags_rebuilt)) {
 +        fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n",
 +                env_flags_current, env_flags_rebuilt);
 +        abort();
 +    }
 +#endif
 +}
 +
  void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                            target_ulong *cs_base, uint32_t *pflags)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
      uint32_t pstate_for_ss;
      *cs_base = 0;
 -#ifdef CONFIG_DEBUG_TCG
 -    assert(flags == rebuild_hflags_internal(env));
 -#endif
 +    assert_hflags_rebuild_correctly(env);
      if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {
          *pc = env->pc;
 --
 .20.1

-[PULL 12/12] arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-After setting CP15 bits in arm_set_cpu_on() the cached hflags must
+The helper function did not get updated when we reorganized
-be rebuild to reflect the changed processor state. Without rebuilding,
+the vector register file for SVE.  Since then, the neon dregs
-the cached hflags would be inconsistent until the next call to
+are non-sequential and cannot be simply indexed.
 arm_rebuild_hflags(). When QEMU is compiled with debugging enabled
 (--enable-debug), this problem is captured shortly after the first
 call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:
-  qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:
+At the same time, make the helper function operate on 64-bit
-  Assertion `flags == rebuild_hflags_internal(env)' failed.
+quantities so that we do not have to call it twice.
   Aborted (core dumped)
-Fixes: 0c7f8c43daf65
+Fixes: c39c2b9043e
-Cc: qemu-stable@nongnu.org
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+[PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arm-powerctl.c | 3 +++
+ target/arm/helper.h             |  2 +-
-file changed, 3 insertions(+)
+ target/arm/op_helper.c          | 23 +++++++++--------
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-powerctl.c
+--- a/target/arm/helper.h
-+++ b/target/arm/arm-powerctl.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
-         target_cpu->env.regs[0] = info->context_id;
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
  DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
  DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
 -DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
 -uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
 -                          uint32_t maxindex)
 +uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
 +                          uint64_t ireg, uint64_t def)
  {
 -    uint32_t val, shift;
 -    uint64_t *table = vn;
 +    uint64_t tmp, val = 0;
 +    uint32_t maxindex = ((desc & 3) + 1) * 8;
 +    uint32_t base_reg = desc >> 2;
 +    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
+     return val;
-+    /* CP15 update requires rebuilding hflags */
+ }
-+    arm_rebuild_hflags(&target_cpu->env);
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
-     /* Start the new CPU at the requested address */
++    tcg_temp_free_i64(def);
-     cpu_set_pc(target_cpu_state, info->entry);
++    tcg_temp_free_i64(val);
 +    tcg_temp_free_i32(desc);
      return true;
  }
 --
 .20.1

-[PULL 09/12] hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
-From: Simon Veith <sveith@amazon.de>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The bit offsets in the EVT_SET_ADDR2 macro do not match those specified
+We can use one MPC per SRAM bank, but we currently only wire the
-in the ARM SMMUv3 Architecture Specification. In all events that use
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
 this macro, e.g. F_WALK_EABT, the faulting fetch address or IPA actually
 occupies the 32-bit words 6 and 7 in the event record contiguously, with
 the upper and lower unused bits clear due to alignment or maximum
 supported address bits. How many bits are clear depends on the
 individual event type.
-Update the macro to write to the correct words in the event record so
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
-that guest drivers can obtain accurate address information on events.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
 ref. ARM IHI 0070C, sections 7.3.12 through 7.3.16.
 Signed-off-by: Simon Veith <sveith@amazon.de>
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-6-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 4 ++--
+ hw/arm/armsse.c | 3 ++-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/hw/arm/armsse.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-     } while (0)
+                                         qdev_get_gpio_in(dev_splitter, 0));
- #define EVT_SET_ADDR2(x, addr)                            \
+             qdev_connect_gpio_out(dev_splitter, 0,
-     do {                                                  \
+                                   qdev_get_gpio_in_named(dev_secctl,
--            (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16);   \
+-                                                         "mpc_status", 0));
--            (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
++                                                         "mpc_status",
-+            (x)->word[7] = (uint32_t)(addr >> 32);        \
++                                                         i - IOTS_NUM_EXP_MPC));
-+            (x)->word[6] = (uint32_t)(addr & 0xffffffff); \
+         }
-     } while (0)
+         qdev_connect_gpio_out(dev_splitter, 1,
  void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 --
 .20.1

-[PULL 02/12] target/arm: Abstract the generic timer frequency
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
-From: Andrew Jeffery <andrew@aj.id.au>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Prepare for SoCs such as the ASPEED AST2600 whose firmware configures
+The system configuration controller (SYSCFG) doesn't have
-CNTFRQ to values significantly larger than the static 62.5MHz value
+any output IRQ (and the INTC input #71 belongs to the UART6).
-currently derived from GTIMER_SCALE. As the OS potentially derives its
+Remove the invalid code.
 timer periods from the CNTFRQ value the lack of support for running
 QEMUTimers at the appropriate rate leads to sticky behaviour in the
 guest.
-Substitute the GTIMER_SCALE constant with use of a helper to derive the
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
-period from gt_cntfrq_hz stored in struct ARMCPU. Initially set
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-gt_cntfrq_hz to the frequency associated with GTIMER_SCALE so current
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
-behaviour is maintained.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 40bd8df043f66e1ccfb3e9482999d099ac72bb2e.1576215453.git-series.andrew@aj.id.au
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h    |  5 +++++
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
- target/arm/cpu.c    |  8 ++++++++
+ hw/arm/stm32f205_soc.c             | 1 -
- target/arm/helper.c | 10 +++++++---
+ hw/misc/stm32f2xx_syscfg.c         | 2 --
-files changed, 20 insertions(+), 3 deletions(-)
+files changed, 5 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/target/arm/cpu.h
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
-      */
+     uint32_t syscfg_exticr3;
-     DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
+     uint32_t syscfg_exticr4;
-     DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
+     uint32_t syscfg_cmpcr;
-+
+-
-+    /* Generic timer counter frequency, in Hz */
+-    qemu_irq irq;
 +    uint64_t gt_cntfrq_hz;
  };
-+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);
+ #endif /* HW_STM32F2XX_SYSCFG_H */
-+
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
  void arm_cpu_post_init(Object *obj);
  uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz);
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/hw/arm/stm32f205_soc.c
-+++ b/target/arm/cpu.c
++++ b/hw/arm/stm32f205_soc.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
      if (tcg_enabled()) {
          cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
      }
-+
+     busdev = SYS_BUS_DEVICE(dev);
-+    cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
+     sysbus_mmio_map(busdev, 0, 0x40013800);
- }
+-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
- static Property arm_cpu_reset_cbar_property =
+     /* Attach UART (uses USART registers) and USART controllers */
-@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
+     for (i = 0; i < STM_NUM_USARTS; i++) {
-     visit_type_uint32(v, name, &cpu->init_svtor, errp);
+diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
- }
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/stm32f2xx_syscfg.c
-+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
++++ b/hw/misc/stm32f2xx_syscfg.c
-+{
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 +    return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
 +      NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
 +}
 +
  void arm_cpu_post_init(Object *obj)
  {
-     ARMCPU *cpu = ARM_CPU(obj);
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
---- a/target/arm/helper.c
+-
-+++ b/target/arm/helper.c
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_stimer_access(CPUARMState *env,
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
  static uint64_t gt_get_countervalue(CPUARMState *env)
  {
 -    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
  }
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
           * set the timer for as far in the future as possible. When the
           * timer expires we will reset the timer for any remaining period.
           */
 -        if (nexttick > INT64_MAX / GTIMER_SCALE) {
 +        if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
              timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
          } else {
              timer_mod(cpu->gt_timer[timeridx], nexttick);
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
  static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
 +    ARMCPU *cpu = env_archcpu(env);
 +
      /* Currently we have no support for QEMUTimer in linux-user so we
       * can't call gt_get_countervalue(env), instead we directly
       * call the lower level functions.
       */
 -    return cpu_get_clock() / GTIMER_SCALE;
 +    return cpu_get_clock() / gt_cntfrq_period_ns(cpu);
  }
  static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
 --
 .20.1

-[PULL 07/12] hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-From: Simon Veith <sveith@amazon.de>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-When checking whether a stream ID is in range of the stream table, we
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-have so far been only checking it against our implementation limit
+OMAP2 chip support") takes care of creating the 3 UARTs.
 (SMMU_IDR1_SIDSIZE). However, the guest can program the
 STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this
 limit.
-Check the stream ID against this limit as well to match the hardware
+Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
-behavior of raising C_BAD_STREAMID events in case the limit is exceeded.
+extensions and attach to n8x0's UART") added n8x0_uart_setup()
-Also, ensure that we do not go one entry beyond the end of the table by
+which create the UART and connects it to an IRQ output,
-checking that its index is strictly smaller than the table size.
+overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
-ref. ARM IHI 0070C, section 6.3.24.
+Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
-Signed-off-by: Simon Veith <sveith@amazon.de>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Acked-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-4-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3.c | 8 ++++++--
+ hw/arm/nseries.c | 11 -----------
-file changed, 6 insertions(+), 2 deletions(-)
+file changed, 11 deletions(-)
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/hw/arm/nseries.c
-+++ b/hw/arm/smmuv3.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
-                          SMMUEventInfo *event)
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
  }
 -static void n8x0_uart_setup(struct n800_s *s)
 -{
 -    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
 -    /*
 -     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
 -     * here, but this code has been removed with the bluetooth backend.
 -     */
 -    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -}
 -
  static void n8x0_usb_setup(struct n800_s *s)
  {
-     dma_addr_t addr;
+     SysBusDevice *dev;
-+    uint32_t log2size;
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-     int ret;
+     n8x0_spi_setup(s);
+     n8x0_dss_setup(s);
-     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+     n8x0_cbus_setup(s);
--    /* Check SID range */
+-    n8x0_uart_setup(s);
--    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
+     if (machine_usb(machine)) {
-+    log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
+         n8x0_usb_setup(s);
 +    /*
 +     * Check SID range against both guest-configured and implementation limits
 +     */
 +    if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
          event->type = SMMU_EVT_C_BAD_STREAMID;
          return -EINVAL;
      }
 --
 .20.1

-[PULL 08/12] hw/arm/smmuv3: Align stream table base address to table size
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-From: Simon Veith <sveith@amazon.de>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Per the specification, and as observed in hardware, the SMMUv3 aligns
+The MusicPal board code connects both of the IRQ outputs of the UART
-the SMMU_STRTAB_BASE address to the size of the table by masking out the
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-respective least significant bits in the ADDR field.
+to the same input is not valid as it produces subtly wrong behaviour
 (for instance if both the IRQ lines are high, and then one goes
 low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-Apply this masking logic to our smmu_find_ste() lookup function per the
+This kind of wiring needs an explicitly created OR gate; add one.
 specification.
-ref. ARM IHI 0070C, section 6.3.23.
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Simon Veith <sveith@amazon.de>
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-5-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3.c | 18 ++++++++++++++----
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 14 insertions(+), 4 deletions(-)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/hw/arm/musicpal.c
-+++ b/hw/arm/smmuv3.c
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ bad_ste:
+@@ -XXX,XX +XXX,XX @@
- static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+ #include "ui/console.h"
-                          SMMUEventInfo *event)
+ #include "hw/i2c/i2c.h"
- {
+ #include "hw/irq.h"
--    dma_addr_t addr;
++#include "hw/or-irq.h"
-+    dma_addr_t addr, strtab_base;
+ #include "hw/audio/wm8750.h"
-     uint32_t log2size;
+ #include "sysemu/block-backend.h"
-+    int strtab_size_shift;
+ #include "sysemu/runstate.h"
-     int ret;
+@@ -XXX,XX +XXX,XX @@
+ #define MP_TIMER4_IRQ           7
-     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+ #define MP_EHCI_IRQ             8
-@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+ #define MP_ETH_IRQ              9
-     }
+-#define MP_UART1_IRQ            11
-     if (s->features & SMMU_FEATURE_2LVL_STE) {
+-#define MP_UART2_IRQ            11
-         int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
++#define MP_UART_SHARED_IRQ      11
--        dma_addr_t strtab_base, l1ptr, l2ptr;
+ #define MP_GPIO_IRQ             12
-+        dma_addr_t l1ptr, l2ptr;
+ #define MP_RTC_IRQ              28
-         STEDesc l1std;
+ #define MP_AUDIO_IRQ            30
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
--        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
+     ARMCPU *cpu;
-+        /*
+     qemu_irq pic[32];
-+         * Align strtab base address to table size. For this purpose, assume it
+     DeviceState *dev;
-+         * is not bounded by SMMU_IDR1_SIDSIZE.
++    DeviceState *uart_orgate;
-+         */
+     DeviceState *i2c_dev;
-+        strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
+     DeviceState *lcd_dev;
-+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
+     DeviceState *key_dev;
-+                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-         l1_ste_offset = sid >> s->sid_split;
+                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-         l2_ste_offset = sid & ((1 << s->sid_split) - 1);
+                           pic[MP_TIMER4_IRQ], NULL);
-         l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
-@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
-         }
++    /* Logically OR both UART IRQs together */
-         addr = l2ptr + l2_ste_offset * sizeof(*ste);
++    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-     } else {
++    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
--        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
++    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+        strtab_size_shift = log2size + 5;
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
++
-+                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
++    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+        addr = strtab_base + sid * sizeof(*ste);
++                   qdev_get_gpio_in(uart_orgate, 0),
-     }
+                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
+-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
-     if (smmu_get_ste(s, addr, ste, event)) {
++    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 1),
                     1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
      /* Register flash */
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
  config MUSICPAL
      bool
 +    select OR_IRQ
      select BITBANG_I2C
      select MARVELL_88W8618
      select PTIMER
 --
 .20.1

-[PULL 01/12] target/arm: Remove redundant scaling of nexttick
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
-From: Andrew Jeffery <andrew@aj.id.au>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The corner-case codepath was adjusting nexttick such that overflow
+We don't need to fill the full pic[] array if we only use
-wouldn't occur when timer_mod() scaled the value back up. Remove a use
+few of the interrupt lines. Directly call qdev_get_gpio_in()
-of GTIMER_SCALE and avoid unnecessary operations by calling
+when necessary.
 timer_mod_ns() directly.
-Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: f8c680720e3abe55476e6d9cb604ad27fdbeb2e0.1576215453.git-series.andrew@aj.id.au
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 5 +++--
+ hw/arm/musicpal.c | 25 +++++++++++++------------
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 13 insertions(+), 12 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/musicpal.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-          * timer expires we will reset the timer for any remaining period.
+ static void musicpal_init(MachineState *machine)
-          */
+ {
-         if (nexttick > INT64_MAX / GTIMER_SCALE) {
+     ARMCPU *cpu;
--            nexttick = INT64_MAX / GTIMER_SCALE;
+-    qemu_irq pic[32];
-+            timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
+     DeviceState *dev;
-+        } else {
++    DeviceState *pic;
-+            timer_mod(cpu->gt_timer[timeridx], nexttick);
+     DeviceState *uart_orgate;
-         }
+     DeviceState *i2c_dev;
--        timer_mod(cpu->gt_timer[timeridx], nexttick);
+     DeviceState *lcd_dev;
-         trace_arm_gt_recalc(timeridx, irqstate, nexttick);
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-     } else {
+                            &error_fatal);
-         /* Timer disabled: ISTATUS and timer output always clear */
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 -    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
 +    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                 qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
 -    for (i = 0; i < 32; i++) {
 -        pic[i] = qdev_get_gpio_in(dev, i);
 -    }
 -    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
 -                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
 -                          pic[MP_TIMER4_IRQ], NULL);
 +    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
 +                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
      /* Logically OR both UART IRQs together */
      uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
      object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
      qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 -    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
 +                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
      serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                     qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               OBJECT(get_system_memory()), &error_fatal);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
 .20.1

-New patch
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+The nseries machines have a codepath that allows them to load a
+secondary bootloader.  This code wasn't checking that the
+load_image_targphys() succeeded.  Check the return value and report
+the error to the user.
+While we're in the vicinity, fix the comment style of the
+comment documenting what this image load is doing.
+Fixes: Coverity CID 1192904
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+---
+ hw/arm/nseries.c | 15 +++++++++++----
+file changed, 11 insertions(+), 4 deletions(-)
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+         /* No, wait, better start at the ROM.  */
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+-        /* This is intended for loading the `secondary.bin' program from
++        /*
++         * This is intended for loading the `secondary.bin' program from
+          * Nokia images (the NOLO bootloader).  The entry point seems
+          * to be at OMAP2_Q2_BASE + 0x400000.
+          *
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
+          *
+          * The code above is for loading the `zImage' file from Nokia
+-         * images.  */
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
+-                            machine->ram_size - 0x400000);
++         * images.
++         */
++        if (load_image_targphys(option_rom[0].name,
++                                OMAP2_Q2_BASE + 0x400000,
++                                machine->ram_size - 0x400000) < 0) {
++            error_report("Failed to load secondary bootloader %s",
++                         option_rom[0].name);
++            exit(EXIT_FAILURE);
++        }
+         n800_setup_nolo_tags(nolo_tags);
+         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
+--
+.20.1

-[PULL 06/12] hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: Simon Veith <sveith@amazon.de>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-There are two issues with the current value of SMMU_BASE_ADDR_MASK:
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
 plus one. Currently, it's counting the number of times these transitions
 do _not_ happen, plus one.
-- At the lower end, we are clearing bits [4:0]. Per the SMMUv3 spec,
+Source:
-  we should also be treating bit 5 as zero in the base address.
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
-- At the upper end, we are clearing bits [63:48]. Per the SMMUv3 spec,
+section 2.3.4 point (3).
   only bits [63:52] must be explicitly treated as zero.
-Update the SMMU_BASE_ADDR_MASK value to mask out bits [63:52] and [5:0].
+Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
+Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 ref. ARM IHI 0070C, section 6.3.23.
 Signed-off-by: Simon Veith <sveith@amazon.de>
 Acked-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1576509312-13083-3-git-send-email-sveith@amazon.de
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 2 +-
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ REG32(GERROR_IRQ_CFG2, 0x74)
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+     pi = (double)nr_ones / nr_bits;
- #define A_STRTAB_BASE      0x80 /* 64b */
+     for (k = 0; k < nr_bits - 1; k++) {
--#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+#define SMMU_BASE_ADDR_MASK 0xfffffffffffc0
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
+     }
- REG32(STRTAB_BASE_CFG,     0x88)
+     vn_obs += 1;
-     FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
 --
 .20.1

-New patch
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+Checks for UNDEF cases should go before the "is VFP enabled?" access
+check, except in special cases. Move a stray UNDEF check in the VTBL
+trans function up above the access check.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
+---
+ target/arm/translate-neon.c.inc | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.c.inc
++++ b/target/arm/translate-neon.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+         return false;
+     }
+-    if (!vfp_access_check(s)) {
+-        return true;
+-    }
+-
+     if ((a->vn + a->len + 1) > 32) {
+         /*
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+         return false;
+     }
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
+     desc = tcg_const_i32((a->vn << 2) | a->len);
+     def = tcg_temp_new_i64();
+     if (a->op) {
+--
+.20.1

One last arm pullreq before I stop work for the end of the year...

-- PMM

The following changes since commit 8e5943260a8f765216674ee87ce8588cc4e7463e:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-12-20 12:46:10 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191220

for you to fetch changes up to c8fa6079eb35888587f1be27c1590da4edcc5098:

arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on() (2019-12-20 14:03:00 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support emulating the generic timers at frequencies other than 62.5MHz
 * Various fixes for SMMUv3 emulation bugs
 * Improve assert error message for hflags mismatches
 * arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()

----------------------------------------------------------------
Andrew Jeffery (4):
      target/arm: Remove redundant scaling of nexttick
      target/arm: Abstract the generic timer frequency
      target/arm: Prepare generic timer for per-platform CNTFRQ
      ast2600: Configure CNTFRQ at 1125MHz

Niek Linnenbank (1):
      arm/arm-powerctl: rebuild hflags after setting CP15 bits in arm_set_cpu_on()

Philippe Mathieu-Daudé (1):
      target/arm: Display helpful message when hflags mismatch

Simon Veith (6):
      hw/arm/smmuv3: Apply address mask to linear strtab base address
      hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
      hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
      hw/arm/smmuv3: Align stream table base address to table size
      hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2 macro
      hw/arm/smmuv3: Report F_STE_FETCH fault address in correct word position

hw/arm/smmuv3-internal.h  |  6 ++---
 target/arm/cpu.h          |  5 ++++
 hw/arm/aspeed_ast2600.c   |  3 +++
 hw/arm/smmuv3.c           | 28 +++++++++++++++-----
 target/arm/arm-powerctl.c |  3 +++
 target/arm/cpu.c          | 65 +++++++++++++++++++++++++++++++++++++++++------
 target/arm/helper.c       | 42 +++++++++++++++++++++++-------
 7 files changed, 125 insertions(+), 27 deletions(-)

From: Andrew Jeffery <andrew@aj.id.au>

The corner-case codepath was adjusting nexttick such that overflow
wouldn't occur when timer_mod() scaled the value back up. Remove a use
of GTIMER_SCALE and avoid unnecessary operations by calling
timer_mod_ns() directly.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: f8c680720e3abe55476e6d9cb604ad27fdbeb2e0.1576215453.git-series.andrew@aj.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * timer expires we will reset the timer for any remaining period.
          */
         if (nexttick > INT64_MAX / GTIMER_SCALE) {
-            nexttick = INT64_MAX / GTIMER_SCALE;
+            timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
+        } else {
+            timer_mod(cpu->gt_timer[timeridx], nexttick);
         }
-        timer_mod(cpu->gt_timer[timeridx], nexttick);
         trace_arm_gt_recalc(timeridx, irqstate, nexttick);
     } else {
         /* Timer disabled: ISTATUS and timer output always clear */
-- 
2.20.1

From: Andrew Jeffery <andrew@aj.id.au>

Prepare for SoCs such as the ASPEED AST2600 whose firmware configures
CNTFRQ to values significantly larger than the static 62.5MHz value
currently derived from GTIMER_SCALE. As the OS potentially derives its
timer periods from the CNTFRQ value the lack of support for running
QEMUTimers at the appropriate rate leads to sticky behaviour in the
guest.

Substitute the GTIMER_SCALE constant with use of a helper to derive the
period from gt_cntfrq_hz stored in struct ARMCPU. Initially set
gt_cntfrq_hz to the frequency associated with GTIMER_SCALE so current
behaviour is maintained.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 40bd8df043f66e1ccfb3e9482999d099ac72bb2e.1576215453.git-series.andrew@aj.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  5 +++++
 target/arm/cpu.c    |  8 ++++++++
 target/arm/helper.c | 10 +++++++---
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      */
     DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
     DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
+
+    /* Generic timer counter frequency, in Hz */
+    uint64_t gt_cntfrq_hz;
 };
 
+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);
+
 void arm_cpu_post_init(Object *obj);
 
 uint64_t arm_cpu_mp_affinity(int idx, uint8_t clustersz);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     if (tcg_enabled()) {
         cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
     }
+
+    cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
 }
 
 static Property arm_cpu_reset_cbar_property =
@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
     visit_type_uint32(v, name, &cpu->init_svtor, errp);
 }
 
+unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
+{
+    return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
+      NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
+}
+
 void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_stimer_access(CPUARMState *env,
 
 static uint64_t gt_get_countervalue(CPUARMState *env)
 {
-    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / GTIMER_SCALE;
+    ARMCPU *cpu = env_archcpu(env);
+
+    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
 }
 
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * set the timer for as far in the future as possible. When the
          * timer expires we will reset the timer for any remaining period.
          */
-        if (nexttick > INT64_MAX / GTIMER_SCALE) {
+        if (nexttick > INT64_MAX / gt_cntfrq_period_ns(cpu)) {
             timer_mod_ns(cpu->gt_timer[timeridx], INT64_MAX);
         } else {
             timer_mod(cpu->gt_timer[timeridx], nexttick);
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
 
 static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
+    ARMCPU *cpu = env_archcpu(env);
+
     /* Currently we have no support for QEMUTimer in linux-user so we
      * can't call gt_get_countervalue(env), instead we directly
      * call the lower level functions.
      */
-    return cpu_get_clock() / GTIMER_SCALE;
+    return cpu_get_clock() / gt_cntfrq_period_ns(cpu);
 }
 
 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-- 
2.20.1

From: Andrew Jeffery <andrew@aj.id.au>

The ASPEED AST2600 clocks the generic timer at the rate of HPLL. On
recent firmwares this is at 1125MHz, which is considerably quicker than
the assumed 62.5MHz of the current generic timer implementation. The
delta between the value as read from CNTFRQ and the true rate of the
underlying QEMUTimer leads to sticky behaviour in AST2600 guests.

Add a feature-gated property exposing CNTFRQ for ARM CPUs providing the
generic timer. This allows platforms to configure CNTFRQ (and the
associated QEMUTimer) to the appropriate frequency prior to starting the
guest.

As the platform can now determine the rate of CNTFRQ we're exposed to
limitations of QEMUTimer that didn't previously materialise: In the
course of emulation we need to arbitrarily and accurately convert
between guest ticks and time, but we're constrained by QEMUTimer's use
of an integer scaling factor. The effect is QEMUTimer cannot exactly
capture the period of frequencies that do not cleanly divide
NANOSECONDS_PER_SECOND for scaling ticks to time. As such, provide an
equally inaccurate scaling factor for scaling time to ticks so at least
a self-consistent inverse relationship holds.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: a22db9325f96e39f76e3c2baddcb712149f46bf2.1576215453.git-series.andrew@aj.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c    | 61 +++++++++++++++++++++++++++++++++++++--------
 target/arm/helper.c |  9 ++++++-
 2 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     if (tcg_enabled()) {
         cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
     }
-
-    cpu->gt_cntfrq_hz = NANOSECONDS_PER_SECOND / GTIMER_SCALE;
 }
 
+static Property arm_cpu_gt_cntfrq_property =
+            DEFINE_PROP_UINT64("cntfrq", ARMCPU, gt_cntfrq_hz,
+                               NANOSECONDS_PER_SECOND / GTIMER_SCALE);
+
 static Property arm_cpu_reset_cbar_property =
             DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
 
@@ -XXX,XX +XXX,XX @@ static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
 
 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
 {
+    /*
+     * The exact approach to calculating guest ticks is:
+     *
+     *     muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), cpu->gt_cntfrq_hz,
+     *              NANOSECONDS_PER_SECOND);
+     *
+     * We don't do that. Rather we intentionally use integer division
+     * truncation below and in the caller for the conversion of host monotonic
+     * time to guest ticks to provide the exact inverse for the semantics of
+     * the QEMUTimer scale factor. QEMUTimer's scale facter is an integer, so
+     * it loses precision when representing frequencies where
+     * `(NANOSECONDS_PER_SECOND % cpu->gt_cntfrq) > 0` holds. Failing to
+     * provide an exact inverse leads to scheduling timers with negative
+     * periods, which in turn leads to sticky behaviour in the guest.
+     *
+     * Finally, CNTFRQ is effectively capped at 1GHz to ensure our scale factor
+     * cannot become zero.
+     */
     return NANOSECONDS_PER_SECOND > cpu->gt_cntfrq_hz ?
       NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
 }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
 
     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
                              &error_abort);
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER)) {
+        qdev_property_add_static(DEVICE(cpu), &arm_cpu_gt_cntfrq_property,
+                                 &error_abort);
+    }
 }
 
 static void arm_cpu_finalizefn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
-    cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
-                                           arm_gt_ptimer_cb, cpu);
-    cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
-                                           arm_gt_vtimer_cb, cpu);
-    cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
-                                          arm_gt_htimer_cb, cpu);
-    cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, GTIMER_SCALE,
-                                          arm_gt_stimer_cb, cpu);
+
+    {
+        uint64_t scale;
+
+        if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
+            if (!cpu->gt_cntfrq_hz) {
+                error_setg(errp, "Invalid CNTFRQ: %"PRId64"Hz",
+                           cpu->gt_cntfrq_hz);
+                return;
+            }
+            scale = gt_cntfrq_period_ns(cpu);
+        } else {
+            scale = GTIMER_SCALE;
+        }
+
+        cpu->gt_timer[GTIMER_PHYS] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+                                               arm_gt_ptimer_cb, cpu);
+        cpu->gt_timer[GTIMER_VIRT] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+                                               arm_gt_vtimer_cb, cpu);
+        cpu->gt_timer[GTIMER_HYP] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+                                              arm_gt_htimer_cb, cpu);
+        cpu->gt_timer[GTIMER_SEC] = timer_new(QEMU_CLOCK_VIRTUAL, scale,
+                                              arm_gt_stimer_cb, cpu);
+    }
 #endif
 
     cpu_exec_realizefn(cs, &local_err);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_gt_stimer_cb(void *opaque)
     gt_recalc_timer(cpu, GTIMER_SEC);
 }
 
+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    cpu->env.cp15.c14_cntfrq = cpu->gt_cntfrq_hz;
+}
+
 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* Note that CNTFRQ is purely reads-as-written for the benefit
      * of software; writing it doesn't actually change the timer frequency.
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
       .access = PL1_RW | PL0_R, .accessfn = gt_cntfrq_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
-      .resetvalue = (1000 * 1000 * 1000) / GTIMER_SCALE,
+      .resetfn = arm_gt_cntfrq_reset,
     },
     /* overall control: mostly access permissions */
     { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
-- 
2.20.1

From: Andrew Jeffery <andrew@aj.id.au>

This matches the configuration set by u-boot on the AST2600.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 080ca1267a09381c43cf3c50d434fb6c186f2b6e.1576215453.git-series.andrew@aj.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_ast2600.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         object_property_set_int(OBJECT(&s->cpu[i]), aspeed_calc_affinity(i),
                                 "mp-affinity", &error_abort);
 
+        object_property_set_int(OBJECT(&s->cpu[i]), 1125000000, "cntfrq",
+                                &error_abort);
+
         /*
          * TODO: the secondary CPUs are started and a boot helper
          * is needed when using -kernel
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

In the SMMU_STRTAB_BASE register, the stream table base address only
occupies bits [51:6]. Other bits, such as RA (bit [62]), must be masked
out to obtain the base address.

The branch for 2-level stream tables correctly applies this mask by way
of SMMU_BASE_ADDR_MASK, but the one for linear stream tables does not.

Apply the missing mask in that case as well so that the correct stream
base address is used by guests which configure a linear stream table.

Linux guests are unaffected by this change because they choose a 2-level
stream table layout for the QEMU SMMUv3, based on the size of its stream
ID space.

ref. ARM IHI 0070C, section 6.3.23.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-2-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Acked-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
         }
         addr = l2ptr + l2_ste_offset * sizeof(*ste);
     } else {
-        addr = s->strtab_base + sid * sizeof(*ste);
+        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
     }
 
     if (smmu_get_ste(s, addr, ste, event)) {
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

There are two issues with the current value of SMMU_BASE_ADDR_MASK:

- At the lower end, we are clearing bits [4:0]. Per the SMMUv3 spec,
  we should also be treating bit 5 as zero in the base address.
- At the upper end, we are clearing bits [63:48]. Per the SMMUv3 spec,
  only bits [63:52] must be explicitly treated as zero.

Update the SMMU_BASE_ADDR_MASK value to mask out bits [63:52] and [5:0].

ref. ARM IHI 0070C, section 6.3.23.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-3-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ REG32(GERROR_IRQ_CFG2, 0x74)
 
 #define A_STRTAB_BASE      0x80 /* 64b */
 
-#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
+#define SMMU_BASE_ADDR_MASK 0xfffffffffffc0
 
 REG32(STRTAB_BASE_CFG,     0x88)
     FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

When checking whether a stream ID is in range of the stream table, we
have so far been only checking it against our implementation limit
(SMMU_IDR1_SIDSIZE). However, the guest can program the
STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this
limit.

Check the stream ID against this limit as well to match the hardware
behavior of raising C_BAD_STREAMID events in case the limit is exceeded.
Also, ensure that we do not go one entry beyond the end of the table by
checking that its index is strictly smaller than the table size.

ref. ARM IHI 0070C, section 6.3.24.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-4-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
                          SMMUEventInfo *event)
 {
     dma_addr_t addr;
+    uint32_t log2size;
     int ret;
 
     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
-    /* Check SID range */
-    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
+    log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
+    /*
+     * Check SID range against both guest-configured and implementation limits
+     */
+    if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
         event->type = SMMU_EVT_C_BAD_STREAMID;
         return -EINVAL;
     }
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

Per the specification, and as observed in hardware, the SMMUv3 aligns
the SMMU_STRTAB_BASE address to the size of the table by masking out the
respective least significant bits in the ADDR field.

Apply this masking logic to our smmu_find_ste() lookup function per the
specification.

ref. ARM IHI 0070C, section 6.3.23.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-5-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ bad_ste:
 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
                          SMMUEventInfo *event)
 {
-    dma_addr_t addr;
+    dma_addr_t addr, strtab_base;
     uint32_t log2size;
+    int strtab_size_shift;
     int ret;
 
     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
     }
     if (s->features & SMMU_FEATURE_2LVL_STE) {
         int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
-        dma_addr_t strtab_base, l1ptr, l2ptr;
+        dma_addr_t l1ptr, l2ptr;
         STEDesc l1std;
 
-        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
+        /*
+         * Align strtab base address to table size. For this purpose, assume it
+         * is not bounded by SMMU_IDR1_SIDSIZE.
+         */
+        strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
+                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
         l1_ste_offset = sid >> s->sid_split;
         l2_ste_offset = sid & ((1 << s->sid_split) - 1);
         l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
@@ -XXX,XX +XXX,XX @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
         }
         addr = l2ptr + l2_ste_offset * sizeof(*ste);
     } else {
-        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
+        strtab_size_shift = log2size + 5;
+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
+                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
+        addr = strtab_base + sid * sizeof(*ste);
     }
 
     if (smmu_get_ste(s, addr, ste, event)) {
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

The bit offsets in the EVT_SET_ADDR2 macro do not match those specified
in the ARM SMMUv3 Architecture Specification. In all events that use
this macro, e.g. F_WALK_EABT, the faulting fetch address or IPA actually
occupies the 32-bit words 6 and 7 in the event record contiguously, with
the upper and lower unused bits clear due to alignment or maximum
supported address bits. How many bits are clear depends on the
individual event type.

Update the macro to write to the correct words in the event record so
that guest drivers can obtain accurate address information on events.

ref. ARM IHI 0070C, sections 7.3.12 through 7.3.16.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-6-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Acked-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
     } while (0)
 #define EVT_SET_ADDR2(x, addr)                            \
     do {                                                  \
-            (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16);   \
-            (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
+            (x)->word[7] = (uint32_t)(addr >> 32);        \
+            (x)->word[6] = (uint32_t)(addr & 0xffffffff); \
     } while (0)
 
 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
-- 
2.20.1

From: Simon Veith <sveith@amazon.de>

The smmuv3_record_event() function that generates the F_STE_FETCH error
uses the EVT_SET_ADDR macro to record the fetch address, placing it in
32-bit words 4 and 5.

The correct position for this address is in words 6 and 7, per the
SMMUv3 Architecture Specification.

Update the function to use the EVT_SET_ADDR2 macro instead, which is the
macro intended for writing to these words.

ref. ARM IHI 0070C, section 7.3.4.

Signed-off-by: Simon Veith <sveith@amazon.de>
Acked-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1576509312-13083-7-git-send-email-sveith@amazon.de
Cc: Eric Auger <eric.auger@redhat.com>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Acked-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
     case SMMU_EVT_F_STE_FETCH:
         EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
         EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
-        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
+        EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
         break;
     case SMMU_EVT_C_BAD_STE:
         EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Instead of crashing in a confuse way, give some hint to the user
about why we aborted. He might report the issue without having
to use a debugger.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20191209134552.27733-1-philmd@redhat.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_a64)(CPUARMState *env, int el)
     env->hflags = rebuild_hflags_a64(env, el, fp_el, mmu_idx);
 }
 
+static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
+{
+#ifdef CONFIG_DEBUG_TCG
+    uint32_t env_flags_current = env->hflags;
+    uint32_t env_flags_rebuilt = rebuild_hflags_internal(env);
+
+    if (unlikely(env_flags_current != env_flags_rebuilt)) {
+        fprintf(stderr, "TCG hflags mismatch (current:0x%08x rebuilt:0x%08x)\n",
+                env_flags_current, env_flags_rebuilt);
+        abort();
+    }
+#endif
+}
+
 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                           target_ulong *cs_base, uint32_t *pflags)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
     uint32_t pstate_for_ss;
 
     *cs_base = 0;
-#ifdef CONFIG_DEBUG_TCG
-    assert(flags == rebuild_hflags_internal(env));
-#endif
+    assert_hflags_rebuild_correctly(env);
 
     if (FIELD_EX32(flags, TBFLAG_ANY, AARCH64_STATE)) {
         *pc = env->pc;
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

After setting CP15 bits in arm_set_cpu_on() the cached hflags must
be rebuild to reflect the changed processor state. Without rebuilding,
the cached hflags would be inconsistent until the next call to
arm_rebuild_hflags(). When QEMU is compiled with debugging enabled
(--enable-debug), this problem is captured shortly after the first
call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:

qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:
  Assertion `flags == rebuild_hflags_internal(env)' failed.
  Aborted (core dumped)

Fixes: 0c7f8c43daf65
Cc: qemu-stable@nongnu.org
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-powerctl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
         target_cpu->env.regs[0] = info->context_id;
     }
 
+    /* CP15 update requires rebuilding hflags */
+    arm_rebuild_hflags(&target_cpu->env);
+
     /* Start the new CPU at the requested address */
     cpu_set_pc(target_cpu_state, info->entry);
 
-- 
2.20.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1