Series comparison

-[PULL 00/15] target-arm queue
+[PULL 00/16] target-arm queue
-Latest arm queue, a mixed bag of features and bug fixes.
+Patches for rc1: nothing major, just some minor bugfixes and
 code cleanups.
-thanks
 -- PMM
-The following changes since commit cbf01142b2aef0c0b4e995cecd7e79d342bbc47e:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200115' into staging (2020-01-17 12:13:17 +0000)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200117-1
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  target/arm: Set ISSIs16Bit in make_issinfo (2020-01-17 14:27:16 +0000)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
-Add model of the Netduino Plus 2 board
+target-arm queue:
-Some allwinner-a10 code cleanup
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
-New test cases for cubieboard
+ * Minor coding style fixes
-target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+ * docs: add some notes on the sbsa-ref machine
-i.MX: add an emulation for RNGC device
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
-target/arm: adjust program counter for wfi exception in AArch32
+ * target/arm: Fix neon VTBL/VTBX for len > 1
-arm/gicv3: update virtual irq state after IAR register read
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
-Set IL bit correctly for syndrome information for data aborts
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Alistair Francis (4):
+Alex Bennée (1):
-      hw/misc: Add the STM32F4xx Sysconfig device
+      docs: add some notes on the sbsa-ref machine
       hw/misc: Add the STM32F4xx EXTI device
       hw/arm: Add the STM32F4xx SoC
       hw/arm: Add the Netduino Plus 2
-Jeff Kubascik (3):
+AlexChen (1):
-      target/arm: adjust program counter for wfi exception in AArch32
+      ssi: Fix bad printf format specifiers
       arm/gicv3: update virtual irq state after IAR register read
       target/arm: Return correct IL bit in merge_syn_data_abort
-Martin Kaiser (1):
+Andrew Jones (1):
-      i.MX: add an emulation for RNGC
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
-Masahiro Yamada (1):
+Havard Skinnemoen (1):
-      target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+      tests/qtest/npcm7xx_rng-test: count runs properly
-Philippe Mathieu-Daudé (5):
+Peter Maydell (2):
-      tests/boot_linux_console: Add initrd test for the CubieBoard
+      hw/arm/nseries: Check return value from load_image_targphys()
-      tests/boot_linux_console: Add a SD card test for the CubieBoard
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-      hw/arm/allwinner-a10: Move SoC definitions out of header
-      hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
+Philippe Mathieu-Daudé (6):
-      hw/arm/allwinner-a10: Remove local qemu_irq variables
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
       hw/arm/armsse: Correct expansion MPC interrupt lines
       hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
       hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
       hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
       hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 Richard Henderson (1):
-      target/arm: Set ISSIs16Bit in make_issinfo
+      target/arm: Fix neon VTBL/VTBX for len > 1
- hw/arm/Makefile.objs                   |   2 +
+Xinhao Zhang (3):
- hw/misc/Makefile.objs                  |   3 +
+      target/arm: add spaces around operator
- include/hw/arm/allwinner-a10.h         |   7 -
+      target/arm: Don't use '#' flag of printf format
- include/hw/arm/fsl-imx25.h             |   5 +
+      target/arm: add space before the open parenthesis '('
  include/hw/arm/stm32f405_soc.h         |  73 ++++++++
  include/hw/misc/imx_rngc.h             |  35 ++++
  include/hw/misc/stm32f4xx_exti.h       |  60 +++++++
  include/hw/misc/stm32f4xx_syscfg.h     |  61 +++++++
  hw/arm/allwinner-a10.c                 |  39 +++--
  hw/arm/fsl-imx25.c                     |  11 ++
  hw/arm/netduinoplus2.c                 |  52 ++++++
  hw/arm/stm32f405_soc.c                 | 302 +++++++++++++++++++++++++++++++++
  hw/intc/arm_gicv3_cpuif.c              |   3 +
  hw/misc/imx_rngc.c                     | 278 ++++++++++++++++++++++++++++++
  hw/misc/stm32f4xx_exti.c               | 188 ++++++++++++++++++++
  hw/misc/stm32f4xx_syscfg.c             | 171 +++++++++++++++++++
  target/arm/arm-semi.c                  |   5 +-
  target/arm/op_helper.c                 |   7 +-
  target/arm/tlb_helper.c                |   2 +-
  target/arm/translate.c                 |   3 +
  MAINTAINERS                            |  14 ++
  default-configs/arm-softmmu.mak        |   1 +
  hw/arm/Kconfig                         |  10 ++
  hw/misc/Kconfig                        |   6 +
  hw/misc/trace-events                   |  11 ++
  tests/acceptance/boot_linux_console.py |  85 ++++++++++
 files changed, 1405 insertions(+), 29 deletions(-)
  create mode 100644 include/hw/arm/stm32f405_soc.h
  create mode 100644 include/hw/misc/imx_rngc.h
  create mode 100644 include/hw/misc/stm32f4xx_exti.h
  create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
  create mode 100644 hw/arm/netduinoplus2.c
  create mode 100644 hw/arm/stm32f405_soc.c
  create mode 100644 hw/misc/imx_rngc.c
  create mode 100644 hw/misc/stm32f4xx_exti.c
  create mode 100644 hw/misc/stm32f4xx_syscfg.c
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-[PULL 02/15] hw/misc: Add the STM32F4xx EXTI device
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
-From: Alistair Francis <alistair@alistair23.me>
+From: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
-Message-id: ef941d59fd8658589d34ed432e1d6dfdcf7fb1d0.1576658572.git.alistair@alistair23.me
+in the build when building armv7m_systick.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs            |   1 +
+ hw/arm/Kconfig | 1 +
- include/hw/misc/stm32f4xx_exti.h |  60 ++++++++++
+file changed, 1 insertion(+)
  hw/misc/stm32f4xx_exti.c         | 188 +++++++++++++++++++++++++++++++
  hw/arm/Kconfig                   |   1 +
  hw/misc/Kconfig                  |   3 +
  hw/misc/trace-events             |   5 +
 files changed, 258 insertions(+)
  create mode 100644 include/hw/misc/stm32f4xx_exti.h
  create mode 100644 hw/misc/stm32f4xx_exti.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
- common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
- common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
- common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
-+common-obj-$(CONFIG_STM32F4XX_EXTI) += stm32f4xx_exti.o
- obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
- obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
- obj-$(CONFIG_MIPS_ITU) += mips_itu.o
-diff --git a/include/hw/misc/stm32f4xx_exti.h b/include/hw/misc/stm32f4xx_exti.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/misc/stm32f4xx_exti.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * STM32F4XX EXTI
-+ *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#ifndef HW_STM_EXTI_H
-+#define HW_STM_EXTI_H
-+
-+#include "hw/sysbus.h"
-+#include "hw/hw.h"
-+
-+#define EXTI_IMR   0x00
-+#define EXTI_EMR   0x04
-+#define EXTI_RTSR  0x08
-+#define EXTI_FTSR  0x0C
-+#define EXTI_SWIER 0x10
-+#define EXTI_PR    0x14
-+
-+#define TYPE_STM32F4XX_EXTI "stm32f4xx-exti"
-+#define STM32F4XX_EXTI(obj) \
-+    OBJECT_CHECK(STM32F4xxExtiState, (obj), TYPE_STM32F4XX_EXTI)
-+
-+#define NUM_GPIO_EVENT_IN_LINES 16
-+#define NUM_INTERRUPT_OUT_LINES 16
-+
-+typedef struct {
-+    SysBusDevice parent_obj;
-+
-+    MemoryRegion mmio;
-+
-+    uint32_t exti_imr;
-+    uint32_t exti_emr;
-+    uint32_t exti_rtsr;
-+    uint32_t exti_ftsr;
-+    uint32_t exti_swier;
-+    uint32_t exti_pr;
-+
-+    qemu_irq irq[NUM_INTERRUPT_OUT_LINES];
-+} STM32F4xxExtiState;
-+
-+#endif
-diff --git a/hw/misc/stm32f4xx_exti.c b/hw/misc/stm32f4xx_exti.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/stm32f4xx_exti.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * STM32F4XX EXTI
-+ *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "trace.h"
-+#include "hw/irq.h"
-+#include "migration/vmstate.h"
-+#include "hw/misc/stm32f4xx_exti.h"
-+
-+static void stm32f4xx_exti_reset(DeviceState *dev)
-+{
-+    STM32F4xxExtiState *s = STM32F4XX_EXTI(dev);
-+
-+    s->exti_imr = 0x00000000;
-+    s->exti_emr = 0x00000000;
-+    s->exti_rtsr = 0x00000000;
-+    s->exti_ftsr = 0x00000000;
-+    s->exti_swier = 0x00000000;
-+    s->exti_pr = 0x00000000;
-+}
-+
-+static void stm32f4xx_exti_set_irq(void *opaque, int irq, int level)
-+{
-+    STM32F4xxExtiState *s = opaque;
-+
-+    trace_stm32f4xx_exti_set_irq(irq, level);
-+
-+    if (((1 << irq) & s->exti_rtsr) && level) {
-+        /* Rising Edge */
-+        s->exti_pr |= 1 << irq;
-+    }
-+
-+    if (((1 << irq) & s->exti_ftsr) && !level) {
-+        /* Falling Edge */
-+        s->exti_pr |= 1 << irq;
-+    }
-+
-+    if (!((1 << irq) & s->exti_imr)) {
-+        /* Interrupt is masked */
-+        return;
-+    }
-+    qemu_irq_pulse(s->irq[irq]);
-+}
-+
-+static uint64_t stm32f4xx_exti_read(void *opaque, hwaddr addr,
-+                                     unsigned int size)
-+{
-+    STM32F4xxExtiState *s = opaque;
-+
-+    trace_stm32f4xx_exti_read(addr);
-+
-+    switch (addr) {
-+    case EXTI_IMR:
-+        return s->exti_imr;
-+    case EXTI_EMR:
-+        return s->exti_emr;
-+    case EXTI_RTSR:
-+        return s->exti_rtsr;
-+    case EXTI_FTSR:
-+        return s->exti_ftsr;
-+    case EXTI_SWIER:
-+        return s->exti_swier;
-+    case EXTI_PR:
-+        return s->exti_pr;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "STM32F4XX_exti_read: Bad offset %x\n", (int)addr);
-+        return 0;
-+    }
-+    return 0;
-+}
-+
-+static void stm32f4xx_exti_write(void *opaque, hwaddr addr,
-+                       uint64_t val64, unsigned int size)
-+{
-+    STM32F4xxExtiState *s = opaque;
-+    uint32_t value = (uint32_t) val64;
-+
-+    trace_stm32f4xx_exti_write(addr, value);
-+
-+    switch (addr) {
-+    case EXTI_IMR:
-+        s->exti_imr = value;
-+        return;
-+    case EXTI_EMR:
-+        s->exti_emr = value;
-+        return;
-+    case EXTI_RTSR:
-+        s->exti_rtsr = value;
-+        return;
-+    case EXTI_FTSR:
-+        s->exti_ftsr = value;
-+        return;
-+    case EXTI_SWIER:
-+        s->exti_swier = value;
-+        return;
-+    case EXTI_PR:
-+        /* This bit is cleared by writing a 1 to it */
-+        s->exti_pr &= ~value;
-+        return;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "STM32F4XX_exti_write: Bad offset %x\n", (int)addr);
-+    }
-+}
-+
-+static const MemoryRegionOps stm32f4xx_exti_ops = {
-+    .read = stm32f4xx_exti_read,
-+    .write = stm32f4xx_exti_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+};
-+
-+static void stm32f4xx_exti_init(Object *obj)
-+{
-+    STM32F4xxExtiState *s = STM32F4XX_EXTI(obj);
-+    int i;
-+
-+    for (i = 0; i < NUM_INTERRUPT_OUT_LINES; i++) {
-+        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq[i]);
-+    }
-+
-+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_exti_ops, s,
-+                          TYPE_STM32F4XX_EXTI, 0x400);
-+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-+
-+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_exti_set_irq,
-+                      NUM_GPIO_EVENT_IN_LINES);
-+}
-+
-+static const VMStateDescription vmstate_stm32f4xx_exti = {
-+    .name = TYPE_STM32F4XX_EXTI,
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(exti_imr, STM32F4xxExtiState),
-+        VMSTATE_UINT32(exti_emr, STM32F4xxExtiState),
-+        VMSTATE_UINT32(exti_rtsr, STM32F4xxExtiState),
-+        VMSTATE_UINT32(exti_ftsr, STM32F4xxExtiState),
-+        VMSTATE_UINT32(exti_swier, STM32F4xxExtiState),
-+        VMSTATE_UINT32(exti_pr, STM32F4xxExtiState),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void stm32f4xx_exti_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->reset = stm32f4xx_exti_reset;
-+    dc->vmsd = &vmstate_stm32f4xx_exti;
-+}
-+
-+static const TypeInfo stm32f4xx_exti_info = {
-+    .name          = TYPE_STM32F4XX_EXTI,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(STM32F4xxExtiState),
-+    .instance_init = stm32f4xx_exti_init,
-+    .class_init    = stm32f4xx_exti_class_init,
-+};
-+
-+static void stm32f4xx_exti_register_types(void)
-+{
-+    type_register_static(&stm32f4xx_exti_info);
-+}
-+
-+type_init(stm32f4xx_exti_register_types)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
  config ARM_V7M
      bool
-     select ARM_V7M
++    select PTIMER
-     select STM32F4XX_SYSCFG
-+    select STM32F4XX_EXTI
+ config ALLWINNER_A10
  config XLNX_ZYNQMP_ARM
      bool
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Kconfig
-+++ b/hw/misc/Kconfig
-@@ -XXX,XX +XXX,XX @@ config STM32F2XX_SYSCFG
- config STM32F4XX_SYSCFG
-     bool
-+config STM32F4XX_EXTI
-+    bool
-+
- config MIPS_ITU
-     bool
-diff --git a/hw/misc/trace-events b/hw/misc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/trace-events
-+++ b/hw/misc/trace-events
-@@ -XXX,XX +XXX,XX @@ stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
- stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
- stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
-+# stm32f4xx_exti
-+stm32f4xx_exti_set_irq(int irq, int leve) "Set EXTI: %d to %d"
-+stm32f4xx_exti_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
-+stm32f4xx_exti_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
-+
- # tz-mpc.c
- tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
- tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 --
 .20.1

-[PULL 14/15] target/arm: Return correct IL bit in merge_syn_data_abort
+[PULL 02/16] ssi: Fix bad printf format specifiers
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+From: AlexChen <alex.chen@huawei.com>
-The IL bit is set for 32-bit instructions, thus passing false
+We should use printf format specifier "%u" instead of "%d" for
-with the is_16bit parameter to syn_data_abort_with_iss() makes
+argument of type "unsigned int".
 a syn mask that always has the IL bit set.
-Pass is_16bit as true to make the initial syn mask have IL=0,
+Reported-by: Euler Robot <euler.robot@huawei.com>
-so that the final IL value comes from or'ing template_syn.
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Cc: qemu-stable@nongnu.org
+Message-id: 5FA280F5.8060902@huawei.com
 Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
 Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200117004618.2742-2-richard.henderson@linaro.org
 [rth: Extracted this as a self-contained bug fix from a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tlb_helper.c | 2 +-
+ hw/ssi/imx_spi.c    | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/ssi/xilinx_spi.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tlb_helper.c
+--- a/hw/ssi/imx_spi.c
-+++ b/target/arm/tlb_helper.c
++++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
-         syn = syn_data_abort_with_iss(same_el,
+     case ECSPI_MSGDATA:
-, 0, 0, 0, 0,
+         return  "ECSPI_MSGDATA";
-                                       ea, 0, s1ptw, is_write, fsc,
+     default:
--                                      false);
+-        sprintf(unknown, "%d ?", reg);
-+                                      true);
++        sprintf(unknown, "%u ?", reg);
-         /* Merge the runtime syndrome with the template syndrome.  */
+         return unknown;
-         syn |= template_syn;
+     }
  }
 diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/xilinx_spi.c
 +++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
         irq chain unless things really changed.  */
      if (pending != s->irqline) {
          s->irqline = pending;
 -        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
 +        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                      pending, s->regs[R_IPISR], s->regs[R_IPIER]);
          qemu_set_irq(s->irq, pending);
      }
 --
 .20.1

-[PULL 10/15] target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+[PULL 03/16] target/arm: add spaces around operator
-From: Masahiro Yamada <masahiroy@kernel.org>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-According to the specification "Semihosting for AArch32 and Aarch64",
+Fix code style. Operator needs spaces both sides.
 the SYS_OPEN operation should return:
- - A nonzero handle if the call is successful
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
- - -1 if the call is not successful
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
-So, it should never return 0.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
 code hand out its own file descriptors"), the guest fd matched to the
 host fd. It returned a nonzero handle on success since the fd 0 is
 already used for stdin.
 Now that the guest fd is the index of guestfd_array, it starts from 0.
 I noticed this issue particularly because Trusted Firmware-A built with
 PLAT=qemu is no longer working. Its io_semihosting driver only handles
 a positive return value as a valid filehandle.
 Basically, there are two ways to fix this:
   - Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
     increment/decrement to convert the guestfd and the array index back
     and forth.
   - Keep using guestfd as the index of guestfs_array. The first entry
     of guestfs_array is left unused.
 I thought the latter is simpler. We end up with wasting a small piece
 of memory for the unused first entry of guestfd_array, but this is
 probably not a big deal.
 Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200109041228.10131-1-masahiroy@kernel.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arm-semi.c | 5 +++--
+ target/arm/arch_dump.c | 8 ++++----
-file changed, 3 insertions(+), 2 deletions(-)
+ target/arm/arm-semi.c  | 8 ++++----
  target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arch_dump.c
++++ b/target/arm/arch_dump.c
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     }
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
+         for (i = 0; i < 32; ++i) {
+             uint64_t tmp = note.vfp.vregs[2*i];
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-            note.vfp.vregs[2*i+1] = tmp;
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++            note.vfp.vregs[2 * i + 1] = tmp;
+         }
+     }
 diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-semi.c
 +++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static int alloc_guestfd(void)
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
+         if (use_gdb_syscalls()) {
-     }
+             arm_semi_open_guestfd = guestfd;
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
--    for (i = 0; i < guestfd_array->len; i++) {
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
-+    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
-+    for (i = 1; i < guestfd_array->len; i++) {
+         } else {
-         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
+             if (ret == (uint32_t)-1) {
-         if (gf->type == GuestFDUnused) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
+         GET_ARG(1);
-         return NULL;
+         if (use_gdb_syscalls()) {
-     }
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
+-                                  arg0, (int)arg1+1);
--    if (guestfd < 0 || guestfd >= guestfd_array->len) {
++                                  arg0, (int)arg1 + 1);
-+    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
+         } else {
-         return NULL;
+             s = lock_user_string(arg0);
-     }
+             if (!s) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
      uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
 --
 .20.1

-[PULL 11/15] i.MX: add an emulation for RNGC
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-From: Martin Kaiser <martin@kaiser.cx>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Add an emulation for the RNGC random number generator and the compatible
+Fix code style. Don't use '#' flag of printf format ('%#') in
-RNGB variant. These peripherals are included (at least) in imx25 and
+format strings, use '0x' prefix instead
 imx35 chipsets.
-The emulation supports the initial self test, reseeding the prng and
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-reading random numbers.
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Signed-off-by: Martin Kaiser <martin@kaiser.cx>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs      |   1 +
+ target/arm/translate-a64.c | 4 ++--
- include/hw/arm/fsl-imx25.h |   5 +
+file changed, 2 insertions(+), 2 deletions(-)
  include/hw/misc/imx_rngc.h |  35 +++++
  hw/arm/fsl-imx25.c         |  11 ++
  hw/misc/imx_rngc.c         | 278 +++++++++++++++++++++++++++++++++++++
 files changed, 330 insertions(+)
  create mode 100644 include/hw/misc/imx_rngc.h
  create mode 100644 hw/misc/imx_rngc.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx7_ccm.o
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
- common-obj-$(CONFIG_IMX) += imx2_wdt.o
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
- common-obj-$(CONFIG_IMX) += imx7_snvs.o
+                 break;
- common-obj-$(CONFIG_IMX) += imx7_gpr.o
+             default:
-+common-obj-$(CONFIG_IMX) += imx_rngc.o
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
- common-obj-$(CONFIG_MILKYMIST) += milkymist-hpdmc.o
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
- common-obj-$(CONFIG_MILKYMIST) += milkymist-pfpu.o
+                         __func__, insn, fpopcode, s->pc_curr);
- common-obj-$(CONFIG_MAINSTONE) += mst_fpga.o
+                 g_assert_not_reached();
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+             }
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
---- a/include/hw/arm/fsl-imx25.h
+     case 0x7f: /* FSQRT (vector) */
-+++ b/include/hw/arm/fsl-imx25.h
+         break;
-@@ -XXX,XX +XXX,XX @@
+     default:
- #include "hw/timer/imx_gpt.h"
+-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
- #include "hw/timer/imx_epit.h"
++        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
- #include "hw/net/imx_fec.h"
+         g_assert_not_reached();
-+#include "hw/misc/imx_rngc.h"
+     }
- #include "hw/i2c/imx_i2c.h"
  #include "hw/gpio/imx_gpio.h"
  #include "exec/memory.h"
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
      IMXGPTState    gpt[FSL_IMX25_NUM_GPTS];
      IMXEPITState   epit[FSL_IMX25_NUM_EPITS];
      IMXFECState    fec;
 +    IMXRNGCState   rngc;
      IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
      IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
      MemoryRegion   rom[2];
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
  #define FSL_IMX25_GPIO4_SIZE    0x4000
  #define FSL_IMX25_GPIO3_ADDR    0x53FA4000
  #define FSL_IMX25_GPIO3_SIZE    0x4000
 +#define FSL_IMX25_RNGC_ADDR     0x53FB0000
 +#define FSL_IMX25_RNGC_SIZE     0x4000
  #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
  #define FSL_IMX25_GPIO1_SIZE    0x4000
  #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
  #define FSL_IMX25_EPIT1_IRQ     28
  #define FSL_IMX25_EPIT2_IRQ     27
  #define FSL_IMX25_FEC_IRQ       57
 +#define FSL_IMX25_RNGC_IRQ      22
  #define FSL_IMX25_I2C1_IRQ      3
  #define FSL_IMX25_I2C2_IRQ      4
  #define FSL_IMX25_I2C3_IRQ      10
 diff --git a/include/hw/misc/imx_rngc.h b/include/hw/misc/imx_rngc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/imx_rngc.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Freescale i.MX RNGC emulation
 + *
 + * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef IMX_RNGC_H
 +#define IMX_RNGC_H
 +
 +#include "hw/sysbus.h"
 +
 +#define TYPE_IMX_RNGC "imx.rngc"
 +#define IMX_RNGC(obj) OBJECT_CHECK(IMXRNGCState, (obj), TYPE_IMX_RNGC)
 +
 +typedef struct IMXRNGCState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion  iomem;
 +
 +    uint8_t op_self_test;
 +    uint8_t op_seed;
 +    uint8_t mask;
 +    bool    auto_seed;
 +
 +    QEMUBH *self_test_bh;
 +    QEMUBH *seed_bh;
 +    qemu_irq irq;
 +} IMXRNGCState;
 +
 +#endif /* IMX_RNGC_H */
 diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx25.c
 +++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
      sysbus_init_child_obj(obj, "fec", &s->fec, sizeof(s->fec), TYPE_IMX_FEC);
 +    sysbus_init_child_obj(obj, "rngc", &s->rngc, sizeof(s->rngc),
 +                          TYPE_IMX_RNGC);
 +
      for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
          sysbus_init_child_obj(obj, "i2c[*]", &s->i2c[i], sizeof(s->i2c[i]),
                                TYPE_IMX_I2C);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fec), 0,
                         qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_FEC_IRQ));
 +    object_property_set_bool(OBJECT(&s->rngc), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rngc), 0, FSL_IMX25_RNGC_ADDR);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rngc), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_RNGC_IRQ));
      /* Initialize all I2C */
      for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
 diff --git a/hw/misc/imx_rngc.c b/hw/misc/imx_rngc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/imx_rngc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Freescale i.MX RNGC emulation
 + *
 + * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + * This driver provides the minimum functionality to initialize and seed
 + * an rngc and to read random numbers. The rngb that is found in imx25
 + * chipsets is also supported.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/module.h"
 +#include "qemu/log.h"
 +#include "qemu/guest-random.h"
 +#include "hw/irq.h"
 +#include "hw/misc/imx_rngc.h"
 +#include "migration/vmstate.h"
 +
 +#define RNGC_NAME "i.MX RNGC"
 +
 +#define RNGC_VER_ID  0x00
 +#define RNGC_COMMAND 0x04
 +#define RNGC_CONTROL 0x08
 +#define RNGC_STATUS  0x0C
 +#define RNGC_FIFO    0x14
 +
 +/* These version info are reported by the rngb in an imx258 chip. */
 +#define RNG_TYPE_RNGB 0x1
 +#define V_MAJ 0x2
 +#define V_MIN 0x40
 +
 +#define RNGC_CMD_BIT_SW_RST    0x40
 +#define RNGC_CMD_BIT_CLR_ERR   0x20
 +#define RNGC_CMD_BIT_CLR_INT   0x10
 +#define RNGC_CMD_BIT_SEED      0x02
 +#define RNGC_CMD_BIT_SELF_TEST 0x01
 +
 +#define RNGC_CTRL_BIT_MASK_ERR  0x40
 +#define RNGC_CTRL_BIT_MASK_DONE 0x20
 +#define RNGC_CTRL_BIT_AUTO_SEED 0x10
 +
 +/* the current status for self-test and seed operations */
 +#define OP_IDLE 0
 +#define OP_RUN  1
 +#define OP_DONE 2
 +
 +static uint64_t imx_rngc_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +    uint64_t val = 0;
 +
 +    switch (offset) {
 +    case RNGC_VER_ID:
 +        val |= RNG_TYPE_RNGB << 28 | V_MAJ << 8 | V_MIN;
 +        break;
 +
 +    case RNGC_COMMAND:
 +        if (s->op_seed == OP_RUN) {
 +            val |= RNGC_CMD_BIT_SEED;
 +        }
 +        if (s->op_self_test == OP_RUN) {
 +            val |= RNGC_CMD_BIT_SELF_TEST;
 +        }
 +        break;
 +
 +    case RNGC_CONTROL:
 +        /*
 +         * The CTL_ACC and VERIF_MODE bits are not supported yet.
 +         * They read as 0.
 +         */
 +        val |= s->mask;
 +        if (s->auto_seed) {
 +            val |= RNGC_CTRL_BIT_AUTO_SEED;
 +        }
 +        /*
 +         * We don't have an internal fifo like the real hardware.
 +         * There's no need for strategy to handle fifo underflows.
 +         * We return the FIFO_UFLOW_RESPONSE bits as 0.
 +         */
 +        break;
 +
 +    case RNGC_STATUS:
 +        /*
 +         * We never report any statistics test or self-test errors or any
 +         * other errors. STAT_TEST_PF, ST_PF and ERROR are always 0.
 +         */
 +
 +        /*
 +         * We don't have an internal fifo, see above. Therefore, we
 +         * report back the default fifo size (5 32-bit words) and
 +         * indicate that our fifo is always full.
 +         */
 +        val |= 5 << 12 | 5 << 8;
 +
 +        /* We always have a new seed available. */
 +        val |= 1 << 6;
 +
 +        if (s->op_seed == OP_DONE) {
 +            val |= 1 << 5;
 +        }
 +        if (s->op_self_test == OP_DONE) {
 +            val |= 1 << 4;
 +        }
 +        if (s->op_seed == OP_RUN || s->op_self_test == OP_RUN) {
 +            /*
 +             * We're busy if self-test is running or if we're
 +             * seeding the prng.
 +             */
 +            val |= 1 << 1;
 +        } else {
 +            /*
 +             * We're ready to provide secure random numbers whenever
 +             * we're not busy.
 +             */
 +            val |= 1;
 +        }
 +        break;
 +
 +    case RNGC_FIFO:
 +        qemu_guest_getrandom_nofail(&val, sizeof(val));
 +        break;
 +    }
 +
 +    return val;
 +}
 +
 +static void imx_rngc_do_reset(IMXRNGCState *s)
 +{
 +    s->op_self_test = OP_IDLE;
 +    s->op_seed = OP_IDLE;
 +    s->mask = 0;
 +    s->auto_seed = false;
 +}
 +
 +static void imx_rngc_write(void *opaque, hwaddr offset, uint64_t value,
 +                           unsigned size)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +
 +    switch (offset) {
 +    case RNGC_COMMAND:
 +        if (value & RNGC_CMD_BIT_SW_RST) {
 +            imx_rngc_do_reset(s);
 +        }
 +
 +        /*
 +         * For now, both CLR_ERR and CLR_INT clear the interrupt. We
 +         * don't report any errors yet.
 +         */
 +        if (value & (RNGC_CMD_BIT_CLR_ERR | RNGC_CMD_BIT_CLR_INT)) {
 +            qemu_irq_lower(s->irq);
 +        }
 +
 +        if (value & RNGC_CMD_BIT_SEED) {
 +            s->op_seed = OP_RUN;
 +            qemu_bh_schedule(s->seed_bh);
 +        }
 +
 +        if (value & RNGC_CMD_BIT_SELF_TEST) {
 +            s->op_self_test = OP_RUN;
 +            qemu_bh_schedule(s->self_test_bh);
 +        }
 +        break;
 +
 +    case RNGC_CONTROL:
 +        /*
 +         * The CTL_ACC and VERIF_MODE bits are not supported yet.
 +         * We ignore them if they're set by the caller.
 +         */
 +
 +        if (value & RNGC_CTRL_BIT_MASK_ERR) {
 +            s->mask |= RNGC_CTRL_BIT_MASK_ERR;
 +        } else {
 +            s->mask &= ~RNGC_CTRL_BIT_MASK_ERR;
 +        }
 +
 +        if (value & RNGC_CTRL_BIT_MASK_DONE) {
 +            s->mask |= RNGC_CTRL_BIT_MASK_DONE;
 +        } else {
 +            s->mask &= ~RNGC_CTRL_BIT_MASK_DONE;
 +        }
 +
 +        if (value & RNGC_CTRL_BIT_AUTO_SEED) {
 +            s->auto_seed = true;
 +        } else {
 +            s->auto_seed = false;
 +        }
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps imx_rngc_ops = {
 +    .read  = imx_rngc_read,
 +    .write = imx_rngc_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void imx_rngc_self_test(void *opaque)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +
 +    s->op_self_test = OP_DONE;
 +    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
 +        qemu_irq_raise(s->irq);
 +    }
 +}
 +
 +static void imx_rngc_seed(void *opaque)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +
 +    s->op_seed = OP_DONE;
 +    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
 +        qemu_irq_raise(s->irq);
 +    }
 +}
 +
 +static void imx_rngc_realize(DeviceState *dev, Error **errp)
 +{
 +    IMXRNGCState *s = IMX_RNGC(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &imx_rngc_ops, s,
 +                          TYPE_IMX_RNGC, 0x1000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +
 +    sysbus_init_irq(sbd, &s->irq);
 +    s->self_test_bh = qemu_bh_new(imx_rngc_self_test, s);
 +    s->seed_bh = qemu_bh_new(imx_rngc_seed, s);
 +}
 +
 +static void imx_rngc_reset(DeviceState *dev)
 +{
 +    IMXRNGCState *s = IMX_RNGC(dev);
 +
 +    imx_rngc_do_reset(s);
 +}
 +
 +static const VMStateDescription vmstate_imx_rngc = {
 +    .name = RNGC_NAME,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT8(op_self_test, IMXRNGCState),
 +        VMSTATE_UINT8(op_seed, IMXRNGCState),
 +        VMSTATE_UINT8(mask, IMXRNGCState),
 +        VMSTATE_BOOL(auto_seed, IMXRNGCState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void imx_rngc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = imx_rngc_realize;
 +    dc->reset = imx_rngc_reset;
 +    dc->desc = RNGC_NAME,
 +    dc->vmsd = &vmstate_imx_rngc;
 +}
 +
 +static const TypeInfo imx_rngc_info = {
 +    .name          = TYPE_IMX_RNGC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(IMXRNGCState),
 +    .class_init    = imx_rngc_class_init,
 +};
 +
 +static void imx_rngc_register_types(void)
 +{
 +    type_register_static(&imx_rngc_info);
 +}
 +
 +type_init(imx_rngc_register_types)
 --
 .20.1

-[PULL 15/15] target/arm: Set ISSIs16Bit in make_issinfo
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-During the conversion to decodetree, the setting of
+Fix code style. Space required before the open parenthesis '('.
 ISSIs16Bit got lost.  This causes the guest os to
 incorrectly adjust trapping memory operations.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Reported-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200117004618.2742-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 3 +++
+ target/arm/translate.c | 2 +-
-file changed, 3 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-     /* ISS not valid if writeback */
+             - Hardware watchpoints.
-     if (p && !w) {
+            Hardware breakpoints have already been handled and skip this code.
-         ret = rd;
+          */
-+        if (s->base.pc_next - s->pc_curr == 2) {
+-        switch(dc->base.is_jmp) {
-+            ret |= ISSIs16Bit;
++        switch (dc->base.is_jmp) {
-+        }
+         case DISAS_NEXT:
-     } else {
+         case DISAS_TOO_MANY:
-         ret = ISSInvalid;
+             gen_goto_tb(dc, 1, dc->base.pc_next);
      }
 --
 .20.1

-[PULL 04/15] hw/arm: Add the Netduino Plus 2
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-From: Alistair Francis <alistair@alistair23.me>
+From: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+We should at least document what this machine is about.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: dad8d8d47f7625913e35e27a1c00f603a6b08f9a.1576658572.git.alistair@alistair23.me
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
 Cc: Leif Lindholm <leif@nuviainc.com>
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs   |  1 +
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
- hw/arm/netduinoplus2.c | 52 ++++++++++++++++++++++++++++++++++++++++++
+ docs/system/target-arm.rst |  1 +
- MAINTAINERS            |  6 +++++
+files changed, 33 insertions(+)
-files changed, 59 insertions(+)
+ create mode 100644 docs/system/arm/sbsa.rst
  create mode 100644 hw/arm/netduinoplus2.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MAINSTONE) += mainstone.o
  obj-$(CONFIG_MICROBIT) += microbit.o
  obj-$(CONFIG_MUSICPAL) += musicpal.o
  obj-$(CONFIG_NETDUINO2) += netduino2.o
 +obj-$(CONFIG_NETDUINOPLUS2) += netduinoplus2.o
  obj-$(CONFIG_NSERIES) += nseries.o
  obj-$(CONFIG_SX1) += omap_sx1.o
  obj-$(CONFIG_CHEETAH) += palm.o
 diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/netduinoplus2.c
++++ b/docs/system/arm/sbsa.rst
 @@ -XXX,XX +XXX,XX @@
-+/*
++Arm Server Base System Architecture Reference board (``sbsa-ref``)
-+ * Netduino Plus 2 Machine Model
++==================================================================
 + *
 + * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#include "qemu/osdep.h"
++While the `virt` board is a generic board platform that doesn't match
-+#include "qapi/error.h"
++any real hardware the `sbsa-ref` board intends to look like real
-+#include "hw/boards.h"
++hardware. The `Server Base System Architecture
-+#include "hw/qdev-properties.h"
++<https://developer.arm.com/documentation/den0029/latest>` defines a
-+#include "qemu/error-report.h"
++minimum base line of hardware support and importantly how the firmware
-+#include "hw/arm/stm32f405_soc.h"
++reports that to any operating system. It is a static system that
-+#include "hw/arm/boot.h"
++reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
-+static void netduinoplus2_init(MachineState *machine)
++It is intended to be a machine for developing firmware and testing
-+{
++standards compliance with operating systems.
 +    DeviceState *dev;
 +
-+    dev = qdev_create(NULL, TYPE_STM32F405_SOC);
++Supported devices
-+    qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
++"""""""""""""""""
 +    object_property_set_bool(OBJECT(dev), true, "realized", &error_fatal);
 +
-+    armv7m_load_kernel(ARM_CPU(first_cpu),
++The sbsa-ref board supports:
 +                       machine->kernel_filename,
 +                       FLASH_SIZE);
 +}
 +
-+static void netduinoplus2_machine_init(MachineClass *mc)
++  - A configurable number of AArch64 CPUs
-+{
++  - GIC version 3
-+    mc->desc = "Netduino Plus 2 Machine";
++  - System bus AHCI controller
-+    mc->init = netduinoplus2_init;
++  - System bus EHCI controller
-+}
++  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
-+DEFINE_MACHINE("netduinoplus2", netduinoplus2_machine_init)
+diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/docs/system/target-arm.rst
-+++ b/MAINTAINERS
++++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
- S: Maintained
+    arm/mps2
- F: hw/arm/netduino2.c
+    arm/musca
+    arm/realview
-+Netduino Plus 2
++   arm/sbsa
-+M: Alistair Francis <alistair@alistair23.me>
+    arm/versatile
-+M: Peter Maydell <peter.maydell@linaro.org>
+    arm/vexpress
-+S: Maintained
+    arm/aspeed
 +F: hw/arm/netduinoplus2.c
 +
  SmartFusion2
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
  M: Peter Maydell <peter.maydell@linaro.org>
 --
 .20.1

-[PULL 01/15] hw/misc: Add the STM32F4xx Sysconfig device
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
-From: Alistair Francis <alistair@alistair23.me>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+When using a Cortex-A15, the Virt machine does not use any
 MPCore peripherals. Remove the dependency.
 Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201107114852.271922-1-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 49b01423a09cef2ca832ff73a84a996568f1a8fc.1576658572.git.alistair@alistair23.me
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs              |   1 +
+ hw/arm/Kconfig | 1 -
- include/hw/misc/stm32f4xx_syscfg.h |  61 ++++++++++
+file changed, 1 deletion(-)
  hw/misc/stm32f4xx_syscfg.c         | 171 +++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak    |   1 +
  hw/arm/Kconfig                     |   9 ++
  hw/misc/Kconfig                    |   3 +
  hw/misc/trace-events               |   6 +
 files changed, 252 insertions(+)
  create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
  create mode 100644 hw/misc/stm32f4xx_syscfg.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SLAVIO) += slavio_misc.o
- common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
- common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
- common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
-+common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
- obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
- obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
- obj-$(CONFIG_MIPS_ITU) += mips_itu.o
-diff --git a/include/hw/misc/stm32f4xx_syscfg.h b/include/hw/misc/stm32f4xx_syscfg.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/misc/stm32f4xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * STM32F4xx SYSCFG
-+ *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#ifndef HW_STM_SYSCFG_H
-+#define HW_STM_SYSCFG_H
-+
-+#include "hw/sysbus.h"
-+#include "hw/hw.h"
-+
-+#define SYSCFG_MEMRMP  0x00
-+#define SYSCFG_PMC     0x04
-+#define SYSCFG_EXTICR1 0x08
-+#define SYSCFG_EXTICR2 0x0C
-+#define SYSCFG_EXTICR3 0x10
-+#define SYSCFG_EXTICR4 0x14
-+#define SYSCFG_CMPCR   0x20
-+
-+#define TYPE_STM32F4XX_SYSCFG "stm32f4xx-syscfg"
-+#define STM32F4XX_SYSCFG(obj) \
-+    OBJECT_CHECK(STM32F4xxSyscfgState, (obj), TYPE_STM32F4XX_SYSCFG)
-+
-+#define SYSCFG_NUM_EXTICR 4
-+
-+typedef struct {
-+    /* <private> */
-+    SysBusDevice parent_obj;
-+
-+    /* <public> */
-+    MemoryRegion mmio;
-+
-+    uint32_t syscfg_memrmp;
-+    uint32_t syscfg_pmc;
-+    uint32_t syscfg_exticr[SYSCFG_NUM_EXTICR];
-+    uint32_t syscfg_cmpcr;
-+
-+    qemu_irq irq;
-+    qemu_irq gpio_out[16];
-+} STM32F4xxSyscfgState;
-+
-+#endif
-diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/stm32f4xx_syscfg.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * STM32F4xx SYSCFG
-+ *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "trace.h"
-+#include "hw/irq.h"
-+#include "migration/vmstate.h"
-+#include "hw/misc/stm32f4xx_syscfg.h"
-+
-+static void stm32f4xx_syscfg_reset(DeviceState *dev)
-+{
-+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(dev);
-+
-+    s->syscfg_memrmp = 0x00000000;
-+    s->syscfg_pmc = 0x00000000;
-+    s->syscfg_exticr[0] = 0x00000000;
-+    s->syscfg_exticr[1] = 0x00000000;
-+    s->syscfg_exticr[2] = 0x00000000;
-+    s->syscfg_exticr[3] = 0x00000000;
-+    s->syscfg_cmpcr = 0x00000000;
-+}
-+
-+static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
-+{
-+    STM32F4xxSyscfgState *s = opaque;
-+    int icrreg = irq / 4;
-+    int startbit = (irq & 3) * 4;
-+    uint8_t config = config = irq / 16;
-+
-+    trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
-+
-+    g_assert(icrreg < SYSCFG_NUM_EXTICR);
-+
-+    if (extract32(s->syscfg_exticr[icrreg], startbit, 4) == config) {
-+        qemu_set_irq(s->gpio_out[irq], level);
-+        trace_stm32f4xx_pulse_exti(irq);
-+   }
-+}
-+
-+static uint64_t stm32f4xx_syscfg_read(void *opaque, hwaddr addr,
-+                                     unsigned int size)
-+{
-+    STM32F4xxSyscfgState *s = opaque;
-+
-+    trace_stm32f4xx_syscfg_read(addr);
-+
-+    switch (addr) {
-+    case SYSCFG_MEMRMP:
-+        return s->syscfg_memrmp;
-+    case SYSCFG_PMC:
-+        return s->syscfg_pmc;
-+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
-+        return s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4];
-+    case SYSCFG_CMPCR:
-+        return s->syscfg_cmpcr;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
-+        return 0;
-+    }
-+}
-+
-+static void stm32f4xx_syscfg_write(void *opaque, hwaddr addr,
-+                       uint64_t val64, unsigned int size)
-+{
-+    STM32F4xxSyscfgState *s = opaque;
-+    uint32_t value = val64;
-+
-+    trace_stm32f4xx_syscfg_write(value, addr);
-+
-+    switch (addr) {
-+    case SYSCFG_MEMRMP:
-+        qemu_log_mask(LOG_UNIMP,
-+                      "%s: Changing the memory mapping isn't supported " \
-+                      "in QEMU\n", __func__);
-+        return;
-+    case SYSCFG_PMC:
-+        qemu_log_mask(LOG_UNIMP,
-+                      "%s: Changing the memory mapping isn't supported " \
-+                      "in QEMU\n", __func__);
-+        return;
-+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
-+        s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4] = (value & 0xFFFF);
-+        return;
-+    case SYSCFG_CMPCR:
-+        s->syscfg_cmpcr = value;
-+        return;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
-+    }
-+}
-+
-+static const MemoryRegionOps stm32f4xx_syscfg_ops = {
-+    .read = stm32f4xx_syscfg_read,
-+    .write = stm32f4xx_syscfg_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+};
-+
-+static void stm32f4xx_syscfg_init(Object *obj)
-+{
-+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(obj);
-+
-+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-+
-+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_syscfg_ops, s,
-+                          TYPE_STM32F4XX_SYSCFG, 0x400);
-+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-+
-+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_syscfg_set_irq, 16 * 9);
-+    qdev_init_gpio_out(DEVICE(obj), s->gpio_out, 16);
-+}
-+
-+static const VMStateDescription vmstate_stm32f4xx_syscfg = {
-+    .name = TYPE_STM32F4XX_SYSCFG,
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(syscfg_memrmp, STM32F4xxSyscfgState),
-+        VMSTATE_UINT32(syscfg_pmc, STM32F4xxSyscfgState),
-+        VMSTATE_UINT32_ARRAY(syscfg_exticr, STM32F4xxSyscfgState,
-+                             SYSCFG_NUM_EXTICR),
-+        VMSTATE_UINT32(syscfg_cmpcr, STM32F4xxSyscfgState),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void stm32f4xx_syscfg_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->reset = stm32f4xx_syscfg_reset;
-+    dc->vmsd = &vmstate_stm32f4xx_syscfg;
-+}
-+
-+static const TypeInfo stm32f4xx_syscfg_info = {
-+    .name          = TYPE_STM32F4XX_SYSCFG,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(STM32F4xxSyscfgState),
-+    .instance_init = stm32f4xx_syscfg_init,
-+    .class_init    = stm32f4xx_syscfg_class_init,
-+};
-+
-+static void stm32f4xx_syscfg_register_types(void)
-+{
-+    type_register_static(&stm32f4xx_syscfg_info);
-+}
-+
-+type_init(stm32f4xx_syscfg_register_types)
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
-+++ b/default-configs/arm-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ CONFIG_Z2=y
- CONFIG_COLLIE=y
- CONFIG_ASPEED_SOC=y
- CONFIG_NETDUINO2=y
-+CONFIG_NETDUINOPLUS2=y
- CONFIG_MPS2=y
- CONFIG_RASPI=y
- CONFIG_DIGIC=y
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config NETDUINO2
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     bool
+     imply VFIO_PLATFORM
-     select STM32F205_SOC
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
-+config NETDUINOPLUS2
+-    select A15MPCORE
-+    bool
+     select ACPI
-+    select STM32F405_SOC
+     select ARM_SMMUV3
-+
+     select GPIO_KEY
  config NSERIES
      bool
      select OMAP
@@ -XXX,XX +XXX,XX @@ config STM32F205_SOC
      select STM32F2XX_ADC
      select STM32F2XX_SPI
 +config STM32F405_SOC
 +    bool
 +    select ARM_V7M
 +    select STM32F4XX_SYSCFG
 +
  config XLNX_ZYNQMP_ARM
      bool
      select AHCI
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IMX
  config STM32F2XX_SYSCFG
      bool
 +config STM32F4XX_SYSCFG
 +    bool
 +
  config MIPS_ITU
      bool
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ mos6522_set_sr_int(void) "set sr_int"
  mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
  mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
 +# stm32f4xx_syscfg
 +stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
 +stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
 +stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
 +stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +
  # tz-mpc.c
  tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
  tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 --
 .20.1

-[PULL 12/15] target/arm: adjust program counter for wfi exception in AArch32
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The wfi instruction can be configured to be trapped by a higher exception
+The helper function did not get updated when we reorganized
-level, such as the EL2 hypervisor. When the instruction is trapped, the
+the vector register file for SVE.  Since then, the neon dregs
-program counter should contain the address of the wfi instruction that
+are non-sequential and cannot be simply indexed.
 caused the exception. The program counter is adjusted for this in the wfi op
 helper function.
-However, this correction is done to env->pc, which only applies to AArch64
+At the same time, make the helper function operate on 64-bit
-mode. For AArch32, the program counter is stored in env->regs[15]. This
+quantities so that we do not have to call it twice.
 adds an if-else statement to modify the correct program counter location
 based on the the current CPU mode.
-Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+Fixes: c39c2b9043e
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 [PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/op_helper.c | 7 ++++++-
+ target/arm/helper.h             |  2 +-
-file changed, 6 insertions(+), 1 deletion(-)
+ target/arm/op_helper.c          | 23 +++++++++--------
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
+-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
++DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
+ DEF_HELPER_3(shl_cc, i32, env, i32, i32)
+ DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
 -uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
 -                          uint32_t maxindex)
 +uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
 +                          uint64_t ireg, uint64_t def)
  {
 -    uint32_t val, shift;
 -    uint64_t *table = vn;
 +    uint64_t tmp, val = 0;
 +    uint32_t maxindex = ((desc & 3) + 1) * 8;
 +    uint32_t base_reg = desc >> 2;
 +    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
+     return val;
-     if (target_el) {
+ }
--        env->pc -= insn_len;
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
-+        if (env->aarch64) {
+index XXXXXXX..XXXXXXX 100644
-+            env->pc -= insn_len;
+--- a/target/arm/translate-neon.c.inc
-+        } else {
++++ b/target/arm/translate-neon.c.inc
-+            env->regs[15] -= insn_len;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
-+        }
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
-         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
++    tcg_temp_free_i64(def);
-                         target_el);
++    tcg_temp_free_i64(val);
-     }
++    tcg_temp_free_i32(desc);
      return true;
  }
 --
 .20.1

-[PULL 09/15] hw/arm/allwinner-a10: Remove local qemu_irq variables
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We won't reuse the CPU IRQ/FIQ variables. Simplify by calling
+We can use one MPC per SRAM bank, but we currently only wire the
-qdev_get_gpio_in() in place.
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-6-f4bug@amsat.org
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/allwinner-a10.c | 9 ++++-----
+ hw/arm/armsse.c | 3 ++-
-file changed, 4 insertions(+), 5 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-a10.c
+--- a/hw/arm/armsse.c
-+++ b/hw/arm/allwinner-a10.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
- {
+                                         qdev_get_gpio_in(dev_splitter, 0));
-     AwA10State *s = AW_A10(dev);
+             qdev_connect_gpio_out(dev_splitter, 0,
-     SysBusDevice *sysbusdev;
+                                   qdev_get_gpio_in_named(dev_secctl,
--    qemu_irq fiq, irq;
+-                                                         "mpc_status", 0));
-     Error *err = NULL;
++                                                         "mpc_status",
++                                                         i - IOTS_NUM_EXP_MPC));
-     object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
+         }
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
-         error_propagate(errp, err);
+         qdev_connect_gpio_out(dev_splitter, 1,
          return;
      }
 -    irq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ);
 -    fiq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ);
      object_property_set_bool(OBJECT(&s->intc), true, "realized", &err);
      if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
      }
      sysbusdev = SYS_BUS_DEVICE(&s->intc);
      sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
 -    sysbus_connect_irq(sysbusdev, 0, irq);
 -    sysbus_connect_irq(sysbusdev, 1, fiq);
 +    sysbus_connect_irq(sysbusdev, 0,
 +                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
 +    sysbus_connect_irq(sysbusdev, 1,
 +                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
      qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
      object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
 --
 .20.1

-[PULL 08/15] hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-By calling qdev_pass_gpios() we don't need to hold a copy of the
+The system configuration controller (SYSCFG) doesn't have
-IRQs from the INTC into the SoC state.
+any output IRQ (and the INTC input #71 belongs to the UART6).
-Instead of filling an array of qemu_irq and passing it around, we
+Remove the invalid code.
 can now directly call qdev_get_gpio_in() on the SoC.
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-5-f4bug@amsat.org
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/allwinner-a10.h |  1 -
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
- hw/arm/allwinner-a10.c         | 24 +++++++++++-------------
+ hw/arm/stm32f205_soc.c             | 1 -
-files changed, 11 insertions(+), 14 deletions(-)
+ hw/misc/stm32f2xx_syscfg.c         | 2 --
 files changed, 5 deletions(-)
-diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/include/hw/arm/allwinner-a10.h
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
-     /*< public >*/
+     uint32_t syscfg_exticr3;
+     uint32_t syscfg_exticr4;
-     ARMCPU cpu;
+     uint32_t syscfg_cmpcr;
--    qemu_irq irq[AW_A10_PIC_INT_NR];
+-
-     AwA10PITState timer;
+-    qemu_irq irq;
-     AwA10PICState intc;
+ };
-     AwEmacState emac;
-diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
+ #endif /* HW_STM32F2XX_SYSCFG_H */
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-a10.c
+--- a/hw/arm/stm32f205_soc.c
-+++ b/hw/arm/allwinner-a10.c
++++ b/hw/arm/stm32f205_soc.c
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
      }
      busdev = SYS_BUS_DEVICE(dev);
      sysbus_mmio_map(busdev, 0, 0x40013800);
 -    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
      /* Attach UART (uses USART registers) and USART controllers */
      for (i = 0; i < STM_NUM_USARTS; i++) {
 diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32f2xx_syscfg.c
 +++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
  {
-     AwA10State *s = AW_A10(dev);
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
-     SysBusDevice *sysbusdev;
--    uint8_t i;
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-     qemu_irq fiq, irq;
+-
-     Error *err = NULL;
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
      sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
      sysbus_connect_irq(sysbusdev, 0, irq);
      sysbus_connect_irq(sysbusdev, 1, fiq);
 -    for (i = 0; i < AW_A10_PIC_INT_NR; i++) {
 -        s->irq[i] = qdev_get_gpio_in(DEVICE(&s->intc), i);
 -    }
 +    qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
      object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
      if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
      }
      sysbusdev = SYS_BUS_DEVICE(&s->timer);
      sysbus_mmio_map(sysbusdev, 0, AW_A10_PIT_REG_BASE);
 -    sysbus_connect_irq(sysbusdev, 0, s->irq[22]);
 -    sysbus_connect_irq(sysbusdev, 1, s->irq[23]);
 -    sysbus_connect_irq(sysbusdev, 2, s->irq[24]);
 -    sysbus_connect_irq(sysbusdev, 3, s->irq[25]);
 -    sysbus_connect_irq(sysbusdev, 4, s->irq[67]);
 -    sysbus_connect_irq(sysbusdev, 5, s->irq[68]);
 +    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 22));
 +    sysbus_connect_irq(sysbusdev, 1, qdev_get_gpio_in(dev, 23));
 +    sysbus_connect_irq(sysbusdev, 2, qdev_get_gpio_in(dev, 24));
 +    sysbus_connect_irq(sysbusdev, 3, qdev_get_gpio_in(dev, 25));
 +    sysbus_connect_irq(sysbusdev, 4, qdev_get_gpio_in(dev, 67));
 +    sysbus_connect_irq(sysbusdev, 5, qdev_get_gpio_in(dev, 68));
      memory_region_init_ram(&s->sram_a, OBJECT(dev), "sram A", 48 * KiB,
                             &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
      }
      sysbusdev = SYS_BUS_DEVICE(&s->emac);
      sysbus_mmio_map(sysbusdev, 0, AW_A10_EMAC_BASE);
 -    sysbus_connect_irq(sysbusdev, 0, s->irq[55]);
 +    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 55));
      object_property_set_bool(OBJECT(&s->sata), true, "realized", &err);
      if (err) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sata), 0, AW_A10_SATA_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, s->irq[56]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, qdev_get_gpio_in(dev, 56));
      /* FIXME use a qdev chardev prop instead of serial_hd() */
 -    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2, s->irq[1],
 +    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2,
 +                   qdev_get_gpio_in(dev, 1),
 , serial_hd(0), DEVICE_NATIVE_ENDIAN);
  }
 --
 .20.1

-[PULL 07/15] hw/arm/allwinner-a10: Move SoC definitions out of header
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-These definitions are specific to the A10 SoC and don't need
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-to be exported to the different Allwinner peripherals.
+OMAP2 chip support") takes care of creating the 3 UARTs.
 Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
 extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-4-f4bug@amsat.org
+Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/allwinner-a10.h | 6 ------
+ hw/arm/nseries.c | 11 -----------
- hw/arm/allwinner-a10.c         | 6 ++++++
+file changed, 11 deletions(-)
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
+--- a/hw/arm/nseries.c
-+++ b/include/hw/arm/allwinner-a10.h
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
- #include "target/arm/cpu.h"
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
+ }
--#define AW_A10_PIC_REG_BASE     0x01c20400
+-static void n8x0_uart_setup(struct n800_s *s)
--#define AW_A10_PIT_REG_BASE     0x01c20c00
+-{
--#define AW_A10_UART0_REG_BASE   0x01c28000
+-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
--#define AW_A10_EMAC_BASE        0x01c0b000
+-    /*
--#define AW_A10_SATA_BASE        0x01c18000
+-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
 -     * here, but this code has been removed with the bluetooth backend.
 -     */
 -    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -}
 -
- #define AW_A10_SDRAM_BASE       0x40000000
+ static void n8x0_usb_setup(struct n800_s *s)
  #define TYPE_AW_A10 "allwinner-a10"
 diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-a10.c
 +++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/misc/unimp.h"
  #include "sysemu/sysemu.h"
 +#define AW_A10_PIC_REG_BASE     0x01c20400
 +#define AW_A10_PIT_REG_BASE     0x01c20c00
 +#define AW_A10_UART0_REG_BASE   0x01c28000
 +#define AW_A10_EMAC_BASE        0x01c0b000
 +#define AW_A10_SATA_BASE        0x01c18000
 +
  static void aw_a10_init(Object *obj)
  {
-     AwA10State *s = AW_A10(obj);
+     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
      n8x0_spi_setup(s);
      n8x0_dss_setup(s);
      n8x0_cbus_setup(s);
 -    n8x0_uart_setup(s);
      if (machine_usb(machine)) {
          n8x0_usb_setup(s);
      }
 --
 .20.1

-[PULL 06/15] tests/boot_linux_console: Add a SD card test for the CubieBoard
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The kernel image and DeviceTree blob are built by the Armbian
+The MusicPal board code connects both of the IRQ outputs of the UART
-project (based on Debian):
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-https://docs.armbian.com/Developer-Guide_Build-Preparation/
+to the same input is not valid as it produces subtly wrong behaviour
 (for instance if both the IRQ lines are high, and then one goes
 low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-The cpio image used comes from the linux-build-test project:
+This kind of wiring needs an explicitly created OR gate; add one.
 https://github.com/groeck/linux-build-test
-If ARM is a target being built, "make check-acceptance" will
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   [...]
   console: ahci-sunxi 1c18000.sata: Linked as a consumer to regulator.4
   console: ahci-sunxi 1c18000.sata: controller can't do 64bit DMA, forcing 32bit
   console: ahci-sunxi 1c18000.sata: AHCI 0001.0000 32 slots 1 ports 1.5 Gbps 0x1 impl platform mode
   console: ahci-sunxi 1c18000.sata: flags: ncq only
   console: scsi host0: ahci-sunxi
   console: ata1: SATA max UDMA/133 mmio [mem 0x01c18000-0x01c18fff] port 0x100 irq 27
   console: of_cfs_init
   console: of_cfs_init: OK
   console: vcc3v0: disabling
   console: vcc5v0: disabling
   console: usb1-vbus: disabling
   console: usb2-vbus: disabling
   console: ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
   console: ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100
   console: ata1.00: 40960 sectors, multi 16: LBA48 NCQ (depth 32)
   console: ata1.00: applying bridge limits
   console: ata1.00: configured for UDMA/100
   console: scsi 0:0:0:0: Direct-Access     ATA      QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
   console: sd 0:0:0:0: Attached scsi generic sg0 type 0
   console: sd 0:0:0:0: [sda] 40960 512-byte logical blocks: (21.0 MB/20.0 MiB)
   console: sd 0:0:0:0: [sda] Write Protect is off
   console: sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
   console: sd 0:0:0:0: [sda] Attached SCSI disk
   console: EXT4-fs (sda): mounting ext2 file system using the ext4 subsystem
   console: EXT4-fs (sda): mounted filesystem without journal. Opts: (null)
   console: VFS: Mounted root (ext2 filesystem) readonly on device 8:0.
   [...]
   console: cat /proc/partitions
   console: / # cat /proc/partitions
   console: major minor  #blocks  name
   console: 1        0       4096 ram0
   console: 1        1       4096 ram1
   console: 1        2       4096 ram2
   console: 1        3       4096 ram3
   console: 8        0      20480 sda
   console: reboot
   console: / # reboot
   [...]
   console: sd 0:0:0:0: [sda] Synchronizing SCSI cache
   console: reboot: Restarting system
   PASS (48.39 s)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-3-f4bug@amsat.org
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/acceptance/boot_linux_console.py | 44 ++++++++++++++++++++++++++
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 44 insertions(+)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
+--- a/hw/arm/musicpal.c
-+++ b/tests/acceptance/boot_linux_console.py
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
+@@ -XXX,XX +XXX,XX @@
-         exec_command_and_wait_for_pattern(self, 'reboot',
+ #include "ui/console.h"
-                                                 'reboot: Restarting system')
+ #include "hw/i2c/i2c.h"
+ #include "hw/irq.h"
-+    def test_arm_cubieboard_sata(self):
++#include "hw/or-irq.h"
-+        """
+ #include "hw/audio/wm8750.h"
-+        :avocado: tags=arch:arm
+ #include "sysemu/block-backend.h"
-+        :avocado: tags=machine:cubieboard
+ #include "sysemu/runstate.h"
-+        """
+@@ -XXX,XX +XXX,XX @@
-+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+ #define MP_TIMER4_IRQ           7
-+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+ #define MP_EHCI_IRQ             8
-+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+ #define MP_ETH_IRQ              9
-+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+-#define MP_UART1_IRQ            11
-+        kernel_path = self.extract_from_deb(deb_path,
+-#define MP_UART2_IRQ            11
-+                                            '/boot/vmlinuz-4.20.7-sunxi')
++#define MP_UART_SHARED_IRQ      11
-+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+ #define MP_GPIO_IRQ             12
-+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+ #define MP_RTC_IRQ              28
-+        rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
+ #define MP_AUDIO_IRQ            30
-+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+                      'arm/rootfs-armv5.ext2.gz')
+     ARMCPU *cpu;
-+        rootfs_hash = '093e89d2b4d982234bf528bc9fb2f2f17a9d1f93'
+     qemu_irq pic[32];
-+        rootfs_path_gz = self.fetch_asset(rootfs_url, asset_hash=rootfs_hash)
+     DeviceState *dev;
-+        rootfs_path = os.path.join(self.workdir, 'rootfs.cpio')
++    DeviceState *uart_orgate;
-+        archive.gzip_uncompress(rootfs_path_gz, rootfs_path)
+     DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
-+        self.vm.set_console()
++    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
++                   qdev_get_gpio_in(uart_orgate, 0),
-+                               'console=ttyS0,115200 '
+                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-+                               'usbcore.nousb '
+-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
-+                               'root=/dev/sda ro '
++    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
-+                               'panic=-1 noreboot')
++                   qdev_get_gpio_in(uart_orgate, 1),
-+        self.vm.add_args('-kernel', kernel_path,
+                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-+                         '-dtb', dtb_path,
-+                         '-drive', 'if=none,format=raw,id=disk0,file='
+     /* Register flash */
-+                                   + rootfs_path,
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-+                         '-device', 'ide-hd,bus=ide.0,drive=disk0',
+index XXXXXXX..XXXXXXX 100644
-+                         '-append', kernel_command_line,
+--- a/hw/arm/Kconfig
-+                         '-no-reboot')
++++ b/hw/arm/Kconfig
-+        self.vm.launch()
+@@ -XXX,XX +XXX,XX @@ config MUSCA
-+        self.wait_for_console_pattern('Boot successful.')
-+
+ config MUSICPAL
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+     bool
-+                                                'Allwinner sun4i/sun5i')
++    select OR_IRQ
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
+     select BITBANG_I2C
-+                                                'sda')
+     select MARVELL_88W8618
-+        exec_command_and_wait_for_pattern(self, 'reboot',
+     select PTIMER
 +                                                'reboot: Restarting system')
 +
      def test_s390x_s390_ccw_virtio(self):
          """
          :avocado: tags=arch:s390x
 --
 .20.1

-[PULL 05/15] tests/boot_linux_console: Add initrd test for the CubieBoard
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-This test boots a Linux kernel on a CubieBoard and verify
+We don't need to fill the full pic[] array if we only use
-the serial output is working.
+few of the interrupt lines. Directly call qdev_get_gpio_in()
+when necessary.
 The kernel image and DeviceTree blob are built by the Armbian
 project (based on Debian):
 https://docs.armbian.com/Developer-Guide_Build-Preparation/
 The cpio image used comes from the linux-build-test project:
 https://github.com/groeck/linux-build-test
 If ARM is a target being built, "make check-acceptance" will
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   console: CPU: ARMv7 Processor [410fc080] revision 0 (ARMv7), cr=50c5387d
   console: CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
   console: OF: fdt: Machine model: Cubietech Cubieboard
   [...]
   console: Boot successful.
   console: cat /proc/cpuinfo
   console: / # cat /proc/cpuinfo
   console: processor      : 0
   console: model name     : ARMv7 Processor rev 0 (v7l)
   console: BogoMIPS       : 832.51
   [...]
   console: Hardware       : Allwinner sun4i/sun5i Families
   console: Revision       : 0000
   console: Serial         : 0000000000000000
   console: cat /proc/iomem
   console: / # cat /proc/iomem
   console: 01c00000-01c0002f : system-control@1c00000
   console: 01c02000-01c02fff : dma-controller@1c02000
   console: 01c05000-01c05fff : spi@1c05000
   console: 01c0b080-01c0b093 : mdio@1c0b080
   console: 01c0c000-01c0cfff : lcd-controller@1c0c000
   console: 01c0d000-01c0dfff : lcd-controller@1c0d000
   console: 01c0f000-01c0ffff : mmc@1c0f000
   [...]
   PASS (54.35 s)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Tested-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20191230110953.25496-2-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/acceptance/boot_linux_console.py | 41 ++++++++++++++++++++++++++
+ hw/arm/musicpal.c | 25 +++++++++++++------------
-file changed, 41 insertions(+)
+file changed, 13 insertions(+), 12 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
+--- a/hw/arm/musicpal.c
-+++ b/tests/acceptance/boot_linux_console.py
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-         self.wait_for_console_pattern('Boot successful.')
+ static void musicpal_init(MachineState *machine)
-         # TODO user command, for now the uart is stuck
+ {
+     ARMCPU *cpu;
-+    def test_arm_cubieboard_initrd(self):
+-    qemu_irq pic[32];
-+        """
+     DeviceState *dev;
-+        :avocado: tags=arch:arm
++    DeviceState *pic;
-+        :avocado: tags=machine:cubieboard
+     DeviceState *uart_orgate;
-+        """
+     DeviceState *i2c_dev;
-+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+     DeviceState *lcd_dev;
-+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+                            &error_fatal);
-+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
-+        kernel_path = self.extract_from_deb(deb_path,
-+                                            '/boot/vmlinuz-4.20.7-sunxi')
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-+        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
+-    for (i = 0; i < 32; i++) {
-+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+-        pic[i] = qdev_get_gpio_in(dev, i);
-+                      'arm/rootfs-armv5.cpio.gz')
+-    }
-+        initrd_hash = '2b50f1873e113523967806f4da2afe385462ff9b'
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-+        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
+-                          pic[MP_TIMER4_IRQ], NULL);
-+        archive.gzip_uncompress(initrd_path_gz, initrd_path)
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
-+        self.vm.set_console()
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
-+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
-+                               'console=ttyS0,115200 '
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
-+                               'usbcore.nousb '
-+                               'panic=-1 noreboot')
+     /* Logically OR both UART IRQs together */
-+        self.vm.add_args('-kernel', kernel_path,
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+                         '-dtb', dtb_path,
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+                         '-initrd', initrd_path,
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+                         '-append', kernel_command_line,
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+                         '-no-reboot')
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-+        self.vm.launch()
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-+        self.wait_for_console_pattern('Boot successful.')
-+
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                    qdev_get_gpio_in(uart_orgate, 0),
-+                                                'Allwinner sun4i/sun5i')
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
+                              OBJECT(get_system_memory()), &error_fatal);
-+                                                'system-control@1c00000')
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+        exec_command_and_wait_for_pattern(self, 'reboot',
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-+                                                'reboot: Restarting system')
+-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
-+
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
-     def test_s390x_s390_ccw_virtio(self):
++                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
-         """
-         :avocado: tags=arch:s390x
+     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
 .20.1

-New patch
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+The nseries machines have a codepath that allows them to load a
+secondary bootloader.  This code wasn't checking that the
+load_image_targphys() succeeded.  Check the return value and report
+the error to the user.
+While we're in the vicinity, fix the comment style of the
+comment documenting what this image load is doing.
+Fixes: Coverity CID 1192904
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+---
+ hw/arm/nseries.c | 15 +++++++++++----
+file changed, 11 insertions(+), 4 deletions(-)
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+         /* No, wait, better start at the ROM.  */
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+-        /* This is intended for loading the `secondary.bin' program from
++        /*
++         * This is intended for loading the `secondary.bin' program from
+          * Nokia images (the NOLO bootloader).  The entry point seems
+          * to be at OMAP2_Q2_BASE + 0x400000.
+          *
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
+          *
+          * The code above is for loading the `zImage' file from Nokia
+-         * images.  */
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
+-                            machine->ram_size - 0x400000);
++         * images.
++         */
++        if (load_image_targphys(option_rom[0].name,
++                                OMAP2_Q2_BASE + 0x400000,
++                                machine->ram_size - 0x400000) < 0) {
++            error_report("Failed to load secondary bootloader %s",
++                         option_rom[0].name);
++            exit(EXIT_FAILURE);
++        }
+         n800_setup_nolo_tags(nolo_tags);
+         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
+--
+.20.1

-[PULL 13/15] arm/gicv3: update virtual irq state after IAR register read
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-The IAR0/IAR1 register is used to acknowledge an interrupt - a read of the
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
-register activates the highest priority pending interrupt and provides its
+plus one. Currently, it's counting the number of times these transitions
-interrupt ID. Activating an interrupt can change the CPU's virtual interrupt
+do _not_ happen, plus one.
 state - this change makes sure the virtual irq state is updated.
-Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+Source:
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
-Message-id: 20200113154607.97032-1-jeff.kubascik@dornerworks.com
+section 2.3.4 point (3).
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_cpuif.c | 3 +++
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
-file changed, 3 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+     pi = (double)nr_ones / nr_bits;
-     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
-                              gicv3_redist_affid(cs), intid);
+     for (k = 0; k < nr_bits - 1; k++) {
-+
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+    gicv3_cpuif_virt_update(cs);
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
-+
+     }
-     return intid;
+     vn_obs += 1;
  }
 --
 .20.1

-[PULL 03/15] hw/arm: Add the STM32F4xx SoC
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-From: Alistair Francis <alistair@alistair23.me>
+Checks for UNDEF cases should go before the "is VFP enabled?" access
 check, except in special cases. Move a stray UNDEF check in the VTBL
 trans function up above the access check.
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1d145c4c13e5fa140caf131232a6f524c88fcd72.1576658572.git.alistair@alistair23.me
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 ---
- hw/arm/Makefile.objs           |   1 +
+ target/arm/translate-neon.c.inc | 8 ++++----
- include/hw/arm/stm32f405_soc.h |  73 ++++++++
+file changed, 4 insertions(+), 4 deletions(-)
  hw/arm/stm32f405_soc.c         | 302 +++++++++++++++++++++++++++++++++
  MAINTAINERS                    |   8 +
 files changed, 384 insertions(+)
  create mode 100644 include/hw/arm/stm32f405_soc.h
  create mode 100644 hw/arm/stm32f405_soc.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/target/arm/translate-neon.c.inc
-+++ b/hw/arm/Makefile.objs
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STRONGARM) += strongarm.o
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
+         return false;
- obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
+     }
- obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-+obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
+-    if (!vfp_access_check(s)) {
- obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
+-        return true;
- obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
+-    }
- obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
+-
-diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
+     if ((a->vn + a->len + 1) > 32) {
-new file mode 100644
+         /*
-index XXXXXXX..XXXXXXX
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
---- /dev/null
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-+++ b/include/hw/arm/stm32f405_soc.h
+         return false;
-@@ -XXX,XX +XXX,XX @@
+     }
-+/*
-+ * STM32F405 SoC
++    if (!vfp_access_check(s)) {
-+ *
++        return true;
 + * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#ifndef HW_ARM_STM32F405_SOC_H
 +#define HW_ARM_STM32F405_SOC_H
 +
 +#include "hw/misc/stm32f4xx_syscfg.h"
 +#include "hw/timer/stm32f2xx_timer.h"
 +#include "hw/char/stm32f2xx_usart.h"
 +#include "hw/adc/stm32f2xx_adc.h"
 +#include "hw/misc/stm32f4xx_exti.h"
 +#include "hw/or-irq.h"
 +#include "hw/ssi/stm32f2xx_spi.h"
 +#include "hw/arm/armv7m.h"
 +
 +#define TYPE_STM32F405_SOC "stm32f405-soc"
 +#define STM32F405_SOC(obj) \
 +    OBJECT_CHECK(STM32F405State, (obj), TYPE_STM32F405_SOC)
 +
 +#define STM_NUM_USARTS 7
 +#define STM_NUM_TIMERS 4
 +#define STM_NUM_ADCS 6
 +#define STM_NUM_SPIS 6
 +
 +#define FLASH_BASE_ADDRESS 0x08000000
 +#define FLASH_SIZE (1024 * 1024)
 +#define SRAM_BASE_ADDRESS 0x20000000
 +#define SRAM_SIZE (192 * 1024)
 +
 +typedef struct STM32F405State {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    char *cpu_type;
 +
 +    ARMv7MState armv7m;
 +
 +    STM32F4xxSyscfgState syscfg;
 +    STM32F4xxExtiState exti;
 +    STM32F2XXUsartState usart[STM_NUM_USARTS];
 +    STM32F2XXTimerState timer[STM_NUM_TIMERS];
 +    qemu_or_irq adc_irqs;
 +    STM32F2XXADCState adc[STM_NUM_ADCS];
 +    STM32F2XXSPIState spi[STM_NUM_SPIS];
 +
 +    MemoryRegion sram;
 +    MemoryRegion flash;
 +    MemoryRegion flash_alias;
 +} STM32F405State;
 +
 +#endif
 diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32F405 SoC
 + *
 + * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "qemu-common.h"
 +#include "exec/address-spaces.h"
 +#include "sysemu/sysemu.h"
 +#include "hw/arm/stm32f405_soc.h"
 +#include "hw/misc/unimp.h"
 +
 +#define SYSCFG_ADD                     0x40013800
 +static const uint32_t usart_addr[] = { 0x40011000, 0x40004400, 0x40004800,
 +                                       0x40004C00, 0x40005000, 0x40011400,
 +                                       0x40007800, 0x40007C00 };
 +/* At the moment only Timer 2 to 5 are modelled */
 +static const uint32_t timer_addr[] = { 0x40000000, 0x40000400,
 +                                       0x40000800, 0x40000C00 };
 +#define ADC_ADDR                       0x40012000
 +static const uint32_t spi_addr[] =   { 0x40013000, 0x40003800, 0x40003C00,
 +                                       0x40013400, 0x40015000, 0x40015400 };
 +#define EXTI_ADDR                      0x40013C00
 +
 +#define SYSCFG_IRQ               71
 +static const int usart_irq[] = { 37, 38, 39, 52, 53, 71, 82, 83 };
 +static const int timer_irq[] = { 28, 29, 30, 50 };
 +#define ADC_IRQ 18
 +static const int spi_irq[] =   { 35, 36, 51, 0, 0, 0 };
 +static const int exti_irq[] =  { 6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
 +                                 40, 40, 40, 40, 40} ;
 +
 +
 +static void stm32f405_soc_initfn(Object *obj)
 +{
 +    STM32F405State *s = STM32F405_SOC(obj);
 +    int i;
 +
 +    sysbus_init_child_obj(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
 +                          TYPE_ARMV7M);
 +
 +    sysbus_init_child_obj(obj, "syscfg", &s->syscfg, sizeof(s->syscfg),
 +                          TYPE_STM32F4XX_SYSCFG);
 +
 +    for (i = 0; i < STM_NUM_USARTS; i++) {
 +        sysbus_init_child_obj(obj, "usart[*]", &s->usart[i],
 +                              sizeof(s->usart[i]), TYPE_STM32F2XX_USART);
 +    }
 +
-+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+     desc = tcg_const_i32((a->vn << 2) | a->len);
-+        sysbus_init_child_obj(obj, "timer[*]", &s->timer[i],
+     def = tcg_temp_new_i64();
-+                              sizeof(s->timer[i]), TYPE_STM32F2XX_TIMER);
+     if (a->op) {
 +    }
 +
 +    for (i = 0; i < STM_NUM_ADCS; i++) {
 +        sysbus_init_child_obj(obj, "adc[*]", &s->adc[i], sizeof(s->adc[i]),
 +                              TYPE_STM32F2XX_ADC);
 +    }
 +
 +    for (i = 0; i < STM_NUM_SPIS; i++) {
 +        sysbus_init_child_obj(obj, "spi[*]", &s->spi[i], sizeof(s->spi[i]),
 +                              TYPE_STM32F2XX_SPI);
 +    }
 +
 +    sysbus_init_child_obj(obj, "exti", &s->exti, sizeof(s->exti),
 +                          TYPE_STM32F4XX_EXTI);
 +}
 +
 +static void stm32f405_soc_realize(DeviceState *dev_soc, Error **errp)
 +{
 +    STM32F405State *s = STM32F405_SOC(dev_soc);
 +    MemoryRegion *system_memory = get_system_memory();
 +    DeviceState *dev, *armv7m;
 +    SysBusDevice *busdev;
 +    Error *err = NULL;
 +    int i;
 +
 +    memory_region_init_ram(&s->flash, NULL, "STM32F405.flash", FLASH_SIZE,
 +                           &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_init_alias(&s->flash_alias, NULL, "STM32F405.flash.alias",
 +                             &s->flash, 0, FLASH_SIZE);
 +
 +    memory_region_set_readonly(&s->flash, true);
 +    memory_region_set_readonly(&s->flash_alias, true);
 +
 +    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
 +    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
 +
 +    memory_region_init_ram(&s->sram, NULL, "STM32F405.sram", SRAM_SIZE,
 +                           &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
 +
 +    armv7m = DEVICE(&s->armv7m);
 +    qdev_prop_set_uint32(armv7m, "num-irq", 96);
 +    qdev_prop_set_string(armv7m, "cpu-type", s->cpu_type);
 +    qdev_prop_set_bit(armv7m, "enable-bitband", true);
 +    object_property_set_link(OBJECT(&s->armv7m), OBJECT(system_memory),
 +                                     "memory", &error_abort);
 +    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    /* System configuration controller */
 +    dev = DEVICE(&s->syscfg);
 +    object_property_set_bool(OBJECT(&s->syscfg), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, SYSCFG_ADD);
 +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, SYSCFG_IRQ));
 +
 +    /* Attach UART (uses USART registers) and USART controllers */
 +    for (i = 0; i < STM_NUM_USARTS; i++) {
 +        dev = DEVICE(&(s->usart[i]));
 +        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
 +        object_property_set_bool(OBJECT(&s->usart[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, usart_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
 +    }
 +
 +    /* Timer 2 to 5 */
 +    for (i = 0; i < STM_NUM_TIMERS; i++) {
 +        dev = DEVICE(&(s->timer[i]));
 +        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
 +        object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, timer_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
 +    }
 +
 +    /* ADC device, the IRQs are ORed together */
 +    object_initialize_child(OBJECT(s), "adc-orirq", &s->adc_irqs,
 +                            sizeof(s->adc_irqs), TYPE_OR_IRQ,
 +                            &err, NULL);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_int(OBJECT(&s->adc_irqs), STM_NUM_ADCS,
 +                            "num-lines", &err);
 +    object_property_set_bool(OBJECT(&s->adc_irqs), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->adc_irqs), 0,
 +                          qdev_get_gpio_in(armv7m, ADC_IRQ));
 +
 +    dev = DEVICE(&(s->adc[i]));
 +    object_property_set_bool(OBJECT(&s->adc[i]), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, ADC_ADDR);
 +    sysbus_connect_irq(busdev, 0,
 +                       qdev_get_gpio_in(DEVICE(&s->adc_irqs), i));
 +
 +    /* SPI devices */
 +    for (i = 0; i < STM_NUM_SPIS; i++) {
 +        dev = DEVICE(&(s->spi[i]));
 +        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, spi_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, spi_irq[i]));
 +    }
 +
 +    /* EXTI device */
 +    dev = DEVICE(&s->exti);
 +    object_property_set_bool(OBJECT(&s->exti), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, EXTI_ADDR);
 +    for (i = 0; i < 16; i++) {
 +        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
 +    }
 +    for (i = 0; i < 16; i++) {
 +        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
 +    }
 +
 +    create_unimplemented_device("timer[7]",    0x40001400, 0x400);
 +    create_unimplemented_device("timer[12]",   0x40001800, 0x400);
 +    create_unimplemented_device("timer[6]",    0x40001000, 0x400);
 +    create_unimplemented_device("timer[13]",   0x40001C00, 0x400);
 +    create_unimplemented_device("timer[14]",   0x40002000, 0x400);
 +    create_unimplemented_device("RTC and BKP", 0x40002800, 0x400);
 +    create_unimplemented_device("WWDG",        0x40002C00, 0x400);
 +    create_unimplemented_device("IWDG",        0x40003000, 0x400);
 +    create_unimplemented_device("I2S2ext",     0x40003000, 0x400);
 +    create_unimplemented_device("I2S3ext",     0x40004000, 0x400);
 +    create_unimplemented_device("I2C1",        0x40005400, 0x400);
 +    create_unimplemented_device("I2C2",        0x40005800, 0x400);
 +    create_unimplemented_device("I2C3",        0x40005C00, 0x400);
 +    create_unimplemented_device("CAN1",        0x40006400, 0x400);
 +    create_unimplemented_device("CAN2",        0x40006800, 0x400);
 +    create_unimplemented_device("PWR",         0x40007000, 0x400);
 +    create_unimplemented_device("DAC",         0x40007400, 0x400);
 +    create_unimplemented_device("timer[1]",    0x40010000, 0x400);
 +    create_unimplemented_device("timer[8]",    0x40010400, 0x400);
 +    create_unimplemented_device("SDIO",        0x40012C00, 0x400);
 +    create_unimplemented_device("timer[9]",    0x40014000, 0x400);
 +    create_unimplemented_device("timer[10]",   0x40014400, 0x400);
 +    create_unimplemented_device("timer[11]",   0x40014800, 0x400);
 +    create_unimplemented_device("GPIOA",       0x40020000, 0x400);
 +    create_unimplemented_device("GPIOB",       0x40020400, 0x400);
 +    create_unimplemented_device("GPIOC",       0x40020800, 0x400);
 +    create_unimplemented_device("GPIOD",       0x40020C00, 0x400);
 +    create_unimplemented_device("GPIOE",       0x40021000, 0x400);
 +    create_unimplemented_device("GPIOF",       0x40021400, 0x400);
 +    create_unimplemented_device("GPIOG",       0x40021800, 0x400);
 +    create_unimplemented_device("GPIOH",       0x40021C00, 0x400);
 +    create_unimplemented_device("GPIOI",       0x40022000, 0x400);
 +    create_unimplemented_device("CRC",         0x40023000, 0x400);
 +    create_unimplemented_device("RCC",         0x40023800, 0x400);
 +    create_unimplemented_device("Flash Int",   0x40023C00, 0x400);
 +    create_unimplemented_device("BKPSRAM",     0x40024000, 0x400);
 +    create_unimplemented_device("DMA1",        0x40026000, 0x400);
 +    create_unimplemented_device("DMA2",        0x40026400, 0x400);
 +    create_unimplemented_device("Ethernet",    0x40028000, 0x1400);
 +    create_unimplemented_device("USB OTG HS",  0x40040000, 0x30000);
 +    create_unimplemented_device("USB OTG FS",  0x50000000, 0x31000);
 +    create_unimplemented_device("DCMI",        0x50050000, 0x400);
 +    create_unimplemented_device("RNG",         0x50060800, 0x400);
 +}
 +
 +static Property stm32f405_soc_properties[] = {
 +    DEFINE_PROP_STRING("cpu-type", STM32F405State, cpu_type),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32f405_soc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = stm32f405_soc_realize;
 +    dc->props = stm32f405_soc_properties;
 +    /* No vmstate or reset required: device has no internal state */
 +}
 +
 +static const TypeInfo stm32f405_soc_info = {
 +    .name          = TYPE_STM32F405_SOC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(STM32F405State),
 +    .instance_init = stm32f405_soc_initfn,
 +    .class_init    = stm32f405_soc_class_init,
 +};
 +
 +static void stm32f405_soc_types(void)
 +{
 +    type_register_static(&stm32f405_soc_info);
 +}
 +
 +type_init(stm32f405_soc_types)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/adc/*
  F: hw/ssi/stm32f2xx_spi.c
  F: include/hw/*/stm32*.h
 +STM32F405
 +M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
 +S: Maintained
 +F: hw/arm/stm32f405_soc.c
 +F: hw/misc/stm32f4xx_syscfg.c
 +F: hw/misc/stm32f4xx_exti.c
 +
  Netduino 2
  M: Alistair Francis <alistair@alistair23.me>
  M: Peter Maydell <peter.maydell@linaro.org>
 --
 .20.1

Latest arm queue, a mixed bag of features and bug fixes.

thanks
-- PMM

The following changes since commit cbf01142b2aef0c0b4e995cecd7e79d342bbc47e:

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200115' into staging (2020-01-17 12:13:17 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200117-1

for you to fetch changes up to 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9:

target/arm: Set ISSIs16Bit in make_issinfo (2020-01-17 14:27:16 +0000)

----------------------------------------------------------------
Add model of the Netduino Plus 2 board
Some allwinner-a10 code cleanup
New test cases for cubieboard
target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
i.MX: add an emulation for RNGC device
target/arm: adjust program counter for wfi exception in AArch32
arm/gicv3: update virtual irq state after IAR register read
Set IL bit correctly for syndrome information for data aborts

----------------------------------------------------------------
Alistair Francis (4):
      hw/misc: Add the STM32F4xx Sysconfig device
      hw/misc: Add the STM32F4xx EXTI device
      hw/arm: Add the STM32F4xx SoC
      hw/arm: Add the Netduino Plus 2

Jeff Kubascik (3):
      target/arm: adjust program counter for wfi exception in AArch32
      arm/gicv3: update virtual irq state after IAR register read
      target/arm: Return correct IL bit in merge_syn_data_abort

Martin Kaiser (1):
      i.MX: add an emulation for RNGC

Masahiro Yamada (1):
      target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle

Philippe Mathieu-Daudé (5):
      tests/boot_linux_console: Add initrd test for the CubieBoard
      tests/boot_linux_console: Add a SD card test for the CubieBoard
      hw/arm/allwinner-a10: Move SoC definitions out of header
      hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
      hw/arm/allwinner-a10: Remove local qemu_irq variables

Richard Henderson (1):
      target/arm: Set ISSIs16Bit in make_issinfo

hw/arm/Makefile.objs                   |   2 +
 hw/misc/Makefile.objs                  |   3 +
 include/hw/arm/allwinner-a10.h         |   7 -
 include/hw/arm/fsl-imx25.h             |   5 +
 include/hw/arm/stm32f405_soc.h         |  73 ++++++++
 include/hw/misc/imx_rngc.h             |  35 ++++
 include/hw/misc/stm32f4xx_exti.h       |  60 +++++++
 include/hw/misc/stm32f4xx_syscfg.h     |  61 +++++++
 hw/arm/allwinner-a10.c                 |  39 +++--
 hw/arm/fsl-imx25.c                     |  11 ++
 hw/arm/netduinoplus2.c                 |  52 ++++++
 hw/arm/stm32f405_soc.c                 | 302 +++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_cpuif.c              |   3 +
 hw/misc/imx_rngc.c                     | 278 ++++++++++++++++++++++++++++++
 hw/misc/stm32f4xx_exti.c               | 188 ++++++++++++++++++++
 hw/misc/stm32f4xx_syscfg.c             | 171 +++++++++++++++++++
 target/arm/arm-semi.c                  |   5 +-
 target/arm/op_helper.c                 |   7 +-
 target/arm/tlb_helper.c                |   2 +-
 target/arm/translate.c                 |   3 +
 MAINTAINERS                            |  14 ++
 default-configs/arm-softmmu.mak        |   1 +
 hw/arm/Kconfig                         |  10 ++
 hw/misc/Kconfig                        |   6 +
 hw/misc/trace-events                   |  11 ++
 tests/acceptance/boot_linux_console.py |  85 ++++++++++
 26 files changed, 1405 insertions(+), 29 deletions(-)
 create mode 100644 include/hw/arm/stm32f405_soc.h
 create mode 100644 include/hw/misc/imx_rngc.h
 create mode 100644 include/hw/misc/stm32f4xx_exti.h
 create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
 create mode 100644 hw/arm/netduinoplus2.c
 create mode 100644 hw/arm/stm32f405_soc.c
 create mode 100644 hw/misc/imx_rngc.c
 create mode 100644 hw/misc/stm32f4xx_exti.c
 create mode 100644 hw/misc/stm32f4xx_syscfg.c

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 49b01423a09cef2ca832ff73a84a996568f1a8fc.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs              |   1 +
 include/hw/misc/stm32f4xx_syscfg.h |  61 ++++++++++
 hw/misc/stm32f4xx_syscfg.c         | 171 +++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak    |   1 +
 hw/arm/Kconfig                     |   9 ++
 hw/misc/Kconfig                    |   3 +
 hw/misc/trace-events               |   6 +
 7 files changed, 252 insertions(+)
 create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
 create mode 100644 hw/misc/stm32f4xx_syscfg.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SLAVIO) += slavio_misc.o
 common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
 common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
+common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
 obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
 obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
 obj-$(CONFIG_MIPS_ITU) += mips_itu.o
diff --git a/include/hw/misc/stm32f4xx_syscfg.h b/include/hw/misc/stm32f4xx_syscfg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/stm32f4xx_syscfg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4xx SYSCFG
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_STM_SYSCFG_H
+#define HW_STM_SYSCFG_H
+
+#include "hw/sysbus.h"
+#include "hw/hw.h"
+
+#define SYSCFG_MEMRMP  0x00
+#define SYSCFG_PMC     0x04
+#define SYSCFG_EXTICR1 0x08
+#define SYSCFG_EXTICR2 0x0C
+#define SYSCFG_EXTICR3 0x10
+#define SYSCFG_EXTICR4 0x14
+#define SYSCFG_CMPCR   0x20
+
+#define TYPE_STM32F4XX_SYSCFG "stm32f4xx-syscfg"
+#define STM32F4XX_SYSCFG(obj) \
+    OBJECT_CHECK(STM32F4xxSyscfgState, (obj), TYPE_STM32F4XX_SYSCFG)
+
+#define SYSCFG_NUM_EXTICR 4
+
+typedef struct {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion mmio;
+
+    uint32_t syscfg_memrmp;
+    uint32_t syscfg_pmc;
+    uint32_t syscfg_exticr[SYSCFG_NUM_EXTICR];
+    uint32_t syscfg_cmpcr;
+
+    qemu_irq irq;
+    qemu_irq gpio_out[16];
+} STM32F4xxSyscfgState;
+
+#endif
diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/stm32f4xx_syscfg.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4xx SYSCFG
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/stm32f4xx_syscfg.h"
+
+static void stm32f4xx_syscfg_reset(DeviceState *dev)
+{
+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(dev);
+
+    s->syscfg_memrmp = 0x00000000;
+    s->syscfg_pmc = 0x00000000;
+    s->syscfg_exticr[0] = 0x00000000;
+    s->syscfg_exticr[1] = 0x00000000;
+    s->syscfg_exticr[2] = 0x00000000;
+    s->syscfg_exticr[3] = 0x00000000;
+    s->syscfg_cmpcr = 0x00000000;
+}
+
+static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
+{
+    STM32F4xxSyscfgState *s = opaque;
+    int icrreg = irq / 4;
+    int startbit = (irq & 3) * 4;
+    uint8_t config = config = irq / 16;
+
+    trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
+
+    g_assert(icrreg < SYSCFG_NUM_EXTICR);
+
+    if (extract32(s->syscfg_exticr[icrreg], startbit, 4) == config) {
+        qemu_set_irq(s->gpio_out[irq], level);
+        trace_stm32f4xx_pulse_exti(irq);
+   }
+}
+
+static uint64_t stm32f4xx_syscfg_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    STM32F4xxSyscfgState *s = opaque;
+
+    trace_stm32f4xx_syscfg_read(addr);
+
+    switch (addr) {
+    case SYSCFG_MEMRMP:
+        return s->syscfg_memrmp;
+    case SYSCFG_PMC:
+        return s->syscfg_pmc;
+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
+        return s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4];
+    case SYSCFG_CMPCR:
+        return s->syscfg_cmpcr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+        return 0;
+    }
+}
+
+static void stm32f4xx_syscfg_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    STM32F4xxSyscfgState *s = opaque;
+    uint32_t value = val64;
+
+    trace_stm32f4xx_syscfg_write(value, addr);
+
+    switch (addr) {
+    case SYSCFG_MEMRMP:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing the memory mapping isn't supported " \
+                      "in QEMU\n", __func__);
+        return;
+    case SYSCFG_PMC:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing the memory mapping isn't supported " \
+                      "in QEMU\n", __func__);
+        return;
+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
+        s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4] = (value & 0xFFFF);
+        return;
+    case SYSCFG_CMPCR:
+        s->syscfg_cmpcr = value;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+    }
+}
+
+static const MemoryRegionOps stm32f4xx_syscfg_ops = {
+    .read = stm32f4xx_syscfg_read,
+    .write = stm32f4xx_syscfg_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void stm32f4xx_syscfg_init(Object *obj)
+{
+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(obj);
+
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_syscfg_ops, s,
+                          TYPE_STM32F4XX_SYSCFG, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_syscfg_set_irq, 16 * 9);
+    qdev_init_gpio_out(DEVICE(obj), s->gpio_out, 16);
+}
+
+static const VMStateDescription vmstate_stm32f4xx_syscfg = {
+    .name = TYPE_STM32F4XX_SYSCFG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(syscfg_memrmp, STM32F4xxSyscfgState),
+        VMSTATE_UINT32(syscfg_pmc, STM32F4xxSyscfgState),
+        VMSTATE_UINT32_ARRAY(syscfg_exticr, STM32F4xxSyscfgState,
+                             SYSCFG_NUM_EXTICR),
+        VMSTATE_UINT32(syscfg_cmpcr, STM32F4xxSyscfgState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void stm32f4xx_syscfg_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = stm32f4xx_syscfg_reset;
+    dc->vmsd = &vmstate_stm32f4xx_syscfg;
+}
+
+static const TypeInfo stm32f4xx_syscfg_info = {
+    .name          = TYPE_STM32F4XX_SYSCFG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F4xxSyscfgState),
+    .instance_init = stm32f4xx_syscfg_init,
+    .class_init    = stm32f4xx_syscfg_class_init,
+};
+
+static void stm32f4xx_syscfg_register_types(void)
+{
+    type_register_static(&stm32f4xx_syscfg_info);
+}
+
+type_init(stm32f4xx_syscfg_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_Z2=y
 CONFIG_COLLIE=y
 CONFIG_ASPEED_SOC=y
 CONFIG_NETDUINO2=y
+CONFIG_NETDUINOPLUS2=y
 CONFIG_MPS2=y
 CONFIG_RASPI=y
 CONFIG_DIGIC=y
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config NETDUINO2
     bool
     select STM32F205_SOC
 
+config NETDUINOPLUS2
+    bool
+    select STM32F405_SOC
+
 config NSERIES
     bool
     select OMAP
@@ -XXX,XX +XXX,XX @@ config STM32F205_SOC
     select STM32F2XX_ADC
     select STM32F2XX_SPI
 
+config STM32F405_SOC
+    bool
+    select ARM_V7M
+    select STM32F4XX_SYSCFG
+
 config XLNX_ZYNQMP_ARM
     bool
     select AHCI
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IMX
 config STM32F2XX_SYSCFG
     bool
 
+config STM32F4XX_SYSCFG
+    bool
+
 config MIPS_ITU
     bool
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ mos6522_set_sr_int(void) "set sr_int"
 mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
 mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
 
+# stm32f4xx_syscfg
+stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
+stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
+stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
+stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+
 # tz-mpc.c
 tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: ef941d59fd8658589d34ed432e1d6dfdcf7fb1d0.1576658572.git.alistair@alistair23.me
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs            |   1 +
 include/hw/misc/stm32f4xx_exti.h |  60 ++++++++++
 hw/misc/stm32f4xx_exti.c         | 188 +++++++++++++++++++++++++++++++
 hw/arm/Kconfig                   |   1 +
 hw/misc/Kconfig                  |   3 +
 hw/misc/trace-events             |   5 +
 6 files changed, 258 insertions(+)
 create mode 100644 include/hw/misc/stm32f4xx_exti.h
 create mode 100644 hw/misc/stm32f4xx_exti.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
 common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
 common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
+common-obj-$(CONFIG_STM32F4XX_EXTI) += stm32f4xx_exti.o
 obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
 obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
 obj-$(CONFIG_MIPS_ITU) += mips_itu.o
diff --git a/include/hw/misc/stm32f4xx_exti.h b/include/hw/misc/stm32f4xx_exti.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/stm32f4xx_exti.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4XX EXTI
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_STM_EXTI_H
+#define HW_STM_EXTI_H
+
+#include "hw/sysbus.h"
+#include "hw/hw.h"
+
+#define EXTI_IMR   0x00
+#define EXTI_EMR   0x04
+#define EXTI_RTSR  0x08
+#define EXTI_FTSR  0x0C
+#define EXTI_SWIER 0x10
+#define EXTI_PR    0x14
+
+#define TYPE_STM32F4XX_EXTI "stm32f4xx-exti"
+#define STM32F4XX_EXTI(obj) \
+    OBJECT_CHECK(STM32F4xxExtiState, (obj), TYPE_STM32F4XX_EXTI)
+
+#define NUM_GPIO_EVENT_IN_LINES 16
+#define NUM_INTERRUPT_OUT_LINES 16
+
+typedef struct {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t exti_imr;
+    uint32_t exti_emr;
+    uint32_t exti_rtsr;
+    uint32_t exti_ftsr;
+    uint32_t exti_swier;
+    uint32_t exti_pr;
+
+    qemu_irq irq[NUM_INTERRUPT_OUT_LINES];
+} STM32F4xxExtiState;
+
+#endif
diff --git a/hw/misc/stm32f4xx_exti.c b/hw/misc/stm32f4xx_exti.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/stm32f4xx_exti.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4XX EXTI
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/stm32f4xx_exti.h"
+
+static void stm32f4xx_exti_reset(DeviceState *dev)
+{
+    STM32F4xxExtiState *s = STM32F4XX_EXTI(dev);
+
+    s->exti_imr = 0x00000000;
+    s->exti_emr = 0x00000000;
+    s->exti_rtsr = 0x00000000;
+    s->exti_ftsr = 0x00000000;
+    s->exti_swier = 0x00000000;
+    s->exti_pr = 0x00000000;
+}
+
+static void stm32f4xx_exti_set_irq(void *opaque, int irq, int level)
+{
+    STM32F4xxExtiState *s = opaque;
+
+    trace_stm32f4xx_exti_set_irq(irq, level);
+
+    if (((1 << irq) & s->exti_rtsr) && level) {
+        /* Rising Edge */
+        s->exti_pr |= 1 << irq;
+    }
+
+    if (((1 << irq) & s->exti_ftsr) && !level) {
+        /* Falling Edge */
+        s->exti_pr |= 1 << irq;
+    }
+
+    if (!((1 << irq) & s->exti_imr)) {
+        /* Interrupt is masked */
+        return;
+    }
+    qemu_irq_pulse(s->irq[irq]);
+}
+
+static uint64_t stm32f4xx_exti_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    STM32F4xxExtiState *s = opaque;
+
+    trace_stm32f4xx_exti_read(addr);
+
+    switch (addr) {
+    case EXTI_IMR:
+        return s->exti_imr;
+    case EXTI_EMR:
+        return s->exti_emr;
+    case EXTI_RTSR:
+        return s->exti_rtsr;
+    case EXTI_FTSR:
+        return s->exti_ftsr;
+    case EXTI_SWIER:
+        return s->exti_swier;
+    case EXTI_PR:
+        return s->exti_pr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "STM32F4XX_exti_read: Bad offset %x\n", (int)addr);
+        return 0;
+    }
+    return 0;
+}
+
+static void stm32f4xx_exti_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    STM32F4xxExtiState *s = opaque;
+    uint32_t value = (uint32_t) val64;
+
+    trace_stm32f4xx_exti_write(addr, value);
+
+    switch (addr) {
+    case EXTI_IMR:
+        s->exti_imr = value;
+        return;
+    case EXTI_EMR:
+        s->exti_emr = value;
+        return;
+    case EXTI_RTSR:
+        s->exti_rtsr = value;
+        return;
+    case EXTI_FTSR:
+        s->exti_ftsr = value;
+        return;
+    case EXTI_SWIER:
+        s->exti_swier = value;
+        return;
+    case EXTI_PR:
+        /* This bit is cleared by writing a 1 to it */
+        s->exti_pr &= ~value;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "STM32F4XX_exti_write: Bad offset %x\n", (int)addr);
+    }
+}
+
+static const MemoryRegionOps stm32f4xx_exti_ops = {
+    .read = stm32f4xx_exti_read,
+    .write = stm32f4xx_exti_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void stm32f4xx_exti_init(Object *obj)
+{
+    STM32F4xxExtiState *s = STM32F4XX_EXTI(obj);
+    int i;
+
+    for (i = 0; i < NUM_INTERRUPT_OUT_LINES; i++) {
+        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq[i]);
+    }
+
+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_exti_ops, s,
+                          TYPE_STM32F4XX_EXTI, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_exti_set_irq,
+                      NUM_GPIO_EVENT_IN_LINES);
+}
+
+static const VMStateDescription vmstate_stm32f4xx_exti = {
+    .name = TYPE_STM32F4XX_EXTI,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(exti_imr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_emr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_rtsr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_ftsr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_swier, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_pr, STM32F4xxExtiState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void stm32f4xx_exti_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = stm32f4xx_exti_reset;
+    dc->vmsd = &vmstate_stm32f4xx_exti;
+}
+
+static const TypeInfo stm32f4xx_exti_info = {
+    .name          = TYPE_STM32F4XX_EXTI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F4xxExtiState),
+    .instance_init = stm32f4xx_exti_init,
+    .class_init    = stm32f4xx_exti_class_init,
+};
+
+static void stm32f4xx_exti_register_types(void)
+{
+    type_register_static(&stm32f4xx_exti_info);
+}
+
+type_init(stm32f4xx_exti_register_types)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
     bool
     select ARM_V7M
     select STM32F4XX_SYSCFG
+    select STM32F4XX_EXTI
 
 config XLNX_ZYNQMP_ARM
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32F2XX_SYSCFG
 config STM32F4XX_SYSCFG
     bool
 
+config STM32F4XX_EXTI
+    bool
+
 config MIPS_ITU
     bool
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
 stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
 stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 
+# stm32f4xx_exti
+stm32f4xx_exti_set_irq(int irq, int leve) "Set EXTI: %d to %d"
+stm32f4xx_exti_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
+stm32f4xx_exti_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+
 # tz-mpc.c
 tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1d145c4c13e5fa140caf131232a6f524c88fcd72.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs           |   1 +
 include/hw/arm/stm32f405_soc.h |  73 ++++++++
 hw/arm/stm32f405_soc.c         | 302 +++++++++++++++++++++++++++++++++
 MAINTAINERS                    |   8 +
 4 files changed, 384 insertions(+)
 create mode 100644 include/hw/arm/stm32f405_soc.h
 create mode 100644 hw/arm/stm32f405_soc.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STRONGARM) += strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
+obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/stm32f405_soc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F405 SoC
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_ARM_STM32F405_SOC_H
+#define HW_ARM_STM32F405_SOC_H
+
+#include "hw/misc/stm32f4xx_syscfg.h"
+#include "hw/timer/stm32f2xx_timer.h"
+#include "hw/char/stm32f2xx_usart.h"
+#include "hw/adc/stm32f2xx_adc.h"
+#include "hw/misc/stm32f4xx_exti.h"
+#include "hw/or-irq.h"
+#include "hw/ssi/stm32f2xx_spi.h"
+#include "hw/arm/armv7m.h"
+
+#define TYPE_STM32F405_SOC "stm32f405-soc"
+#define STM32F405_SOC(obj) \
+    OBJECT_CHECK(STM32F405State, (obj), TYPE_STM32F405_SOC)
+
+#define STM_NUM_USARTS 7
+#define STM_NUM_TIMERS 4
+#define STM_NUM_ADCS 6
+#define STM_NUM_SPIS 6
+
+#define FLASH_BASE_ADDRESS 0x08000000
+#define FLASH_SIZE (1024 * 1024)
+#define SRAM_BASE_ADDRESS 0x20000000
+#define SRAM_SIZE (192 * 1024)
+
+typedef struct STM32F405State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    char *cpu_type;
+
+    ARMv7MState armv7m;
+
+    STM32F4xxSyscfgState syscfg;
+    STM32F4xxExtiState exti;
+    STM32F2XXUsartState usart[STM_NUM_USARTS];
+    STM32F2XXTimerState timer[STM_NUM_TIMERS];
+    qemu_or_irq adc_irqs;
+    STM32F2XXADCState adc[STM_NUM_ADCS];
+    STM32F2XXSPIState spi[STM_NUM_SPIS];
+
+    MemoryRegion sram;
+    MemoryRegion flash;
+    MemoryRegion flash_alias;
+} STM32F405State;
+
+#endif
diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F405 SoC
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "exec/address-spaces.h"
+#include "sysemu/sysemu.h"
+#include "hw/arm/stm32f405_soc.h"
+#include "hw/misc/unimp.h"
+
+#define SYSCFG_ADD                     0x40013800
+static const uint32_t usart_addr[] = { 0x40011000, 0x40004400, 0x40004800,
+                                       0x40004C00, 0x40005000, 0x40011400,
+                                       0x40007800, 0x40007C00 };
+/* At the moment only Timer 2 to 5 are modelled */
+static const uint32_t timer_addr[] = { 0x40000000, 0x40000400,
+                                       0x40000800, 0x40000C00 };
+#define ADC_ADDR                       0x40012000
+static const uint32_t spi_addr[] =   { 0x40013000, 0x40003800, 0x40003C00,
+                                       0x40013400, 0x40015000, 0x40015400 };
+#define EXTI_ADDR                      0x40013C00
+
+#define SYSCFG_IRQ               71
+static const int usart_irq[] = { 37, 38, 39, 52, 53, 71, 82, 83 };
+static const int timer_irq[] = { 28, 29, 30, 50 };
+#define ADC_IRQ 18
+static const int spi_irq[] =   { 35, 36, 51, 0, 0, 0 };
+static const int exti_irq[] =  { 6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
+                                 40, 40, 40, 40, 40} ;
+
+
+static void stm32f405_soc_initfn(Object *obj)
+{
+    STM32F405State *s = STM32F405_SOC(obj);
+    int i;
+
+    sysbus_init_child_obj(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
+                          TYPE_ARMV7M);
+
+    sysbus_init_child_obj(obj, "syscfg", &s->syscfg, sizeof(s->syscfg),
+                          TYPE_STM32F4XX_SYSCFG);
+
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        sysbus_init_child_obj(obj, "usart[*]", &s->usart[i],
+                              sizeof(s->usart[i]), TYPE_STM32F2XX_USART);
+    }
+
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        sysbus_init_child_obj(obj, "timer[*]", &s->timer[i],
+                              sizeof(s->timer[i]), TYPE_STM32F2XX_TIMER);
+    }
+
+    for (i = 0; i < STM_NUM_ADCS; i++) {
+        sysbus_init_child_obj(obj, "adc[*]", &s->adc[i], sizeof(s->adc[i]),
+                              TYPE_STM32F2XX_ADC);
+    }
+
+    for (i = 0; i < STM_NUM_SPIS; i++) {
+        sysbus_init_child_obj(obj, "spi[*]", &s->spi[i], sizeof(s->spi[i]),
+                              TYPE_STM32F2XX_SPI);
+    }
+
+    sysbus_init_child_obj(obj, "exti", &s->exti, sizeof(s->exti),
+                          TYPE_STM32F4XX_EXTI);
+}
+
+static void stm32f405_soc_realize(DeviceState *dev_soc, Error **errp)
+{
+    STM32F405State *s = STM32F405_SOC(dev_soc);
+    MemoryRegion *system_memory = get_system_memory();
+    DeviceState *dev, *armv7m;
+    SysBusDevice *busdev;
+    Error *err = NULL;
+    int i;
+
+    memory_region_init_ram(&s->flash, NULL, "STM32F405.flash", FLASH_SIZE,
+                           &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_init_alias(&s->flash_alias, NULL, "STM32F405.flash.alias",
+                             &s->flash, 0, FLASH_SIZE);
+
+    memory_region_set_readonly(&s->flash, true);
+    memory_region_set_readonly(&s->flash_alias, true);
+
+    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
+    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
+
+    memory_region_init_ram(&s->sram, NULL, "STM32F405.sram", SRAM_SIZE,
+                           &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
+
+    armv7m = DEVICE(&s->armv7m);
+    qdev_prop_set_uint32(armv7m, "num-irq", 96);
+    qdev_prop_set_string(armv7m, "cpu-type", s->cpu_type);
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    object_property_set_link(OBJECT(&s->armv7m), OBJECT(system_memory),
+                                     "memory", &error_abort);
+    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    /* System configuration controller */
+    dev = DEVICE(&s->syscfg);
+    object_property_set_bool(OBJECT(&s->syscfg), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, SYSCFG_ADD);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, SYSCFG_IRQ));
+
+    /* Attach UART (uses USART registers) and USART controllers */
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        dev = DEVICE(&(s->usart[i]));
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        object_property_set_bool(OBJECT(&s->usart[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, usart_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
+    }
+
+    /* Timer 2 to 5 */
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        dev = DEVICE(&(s->timer[i]));
+        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
+        object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, timer_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
+    }
+
+    /* ADC device, the IRQs are ORed together */
+    object_initialize_child(OBJECT(s), "adc-orirq", &s->adc_irqs,
+                            sizeof(s->adc_irqs), TYPE_OR_IRQ,
+                            &err, NULL);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_int(OBJECT(&s->adc_irqs), STM_NUM_ADCS,
+                            "num-lines", &err);
+    object_property_set_bool(OBJECT(&s->adc_irqs), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->adc_irqs), 0,
+                          qdev_get_gpio_in(armv7m, ADC_IRQ));
+
+    dev = DEVICE(&(s->adc[i]));
+    object_property_set_bool(OBJECT(&s->adc[i]), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, ADC_ADDR);
+    sysbus_connect_irq(busdev, 0,
+                       qdev_get_gpio_in(DEVICE(&s->adc_irqs), i));
+
+    /* SPI devices */
+    for (i = 0; i < STM_NUM_SPIS; i++) {
+        dev = DEVICE(&(s->spi[i]));
+        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, spi_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, spi_irq[i]));
+    }
+
+    /* EXTI device */
+    dev = DEVICE(&s->exti);
+    object_property_set_bool(OBJECT(&s->exti), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, EXTI_ADDR);
+    for (i = 0; i < 16; i++) {
+        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
+    }
+    for (i = 0; i < 16; i++) {
+        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
+    }
+
+    create_unimplemented_device("timer[7]",    0x40001400, 0x400);
+    create_unimplemented_device("timer[12]",   0x40001800, 0x400);
+    create_unimplemented_device("timer[6]",    0x40001000, 0x400);
+    create_unimplemented_device("timer[13]",   0x40001C00, 0x400);
+    create_unimplemented_device("timer[14]",   0x40002000, 0x400);
+    create_unimplemented_device("RTC and BKP", 0x40002800, 0x400);
+    create_unimplemented_device("WWDG",        0x40002C00, 0x400);
+    create_unimplemented_device("IWDG",        0x40003000, 0x400);
+    create_unimplemented_device("I2S2ext",     0x40003000, 0x400);
+    create_unimplemented_device("I2S3ext",     0x40004000, 0x400);
+    create_unimplemented_device("I2C1",        0x40005400, 0x400);
+    create_unimplemented_device("I2C2",        0x40005800, 0x400);
+    create_unimplemented_device("I2C3",        0x40005C00, 0x400);
+    create_unimplemented_device("CAN1",        0x40006400, 0x400);
+    create_unimplemented_device("CAN2",        0x40006800, 0x400);
+    create_unimplemented_device("PWR",         0x40007000, 0x400);
+    create_unimplemented_device("DAC",         0x40007400, 0x400);
+    create_unimplemented_device("timer[1]",    0x40010000, 0x400);
+    create_unimplemented_device("timer[8]",    0x40010400, 0x400);
+    create_unimplemented_device("SDIO",        0x40012C00, 0x400);
+    create_unimplemented_device("timer[9]",    0x40014000, 0x400);
+    create_unimplemented_device("timer[10]",   0x40014400, 0x400);
+    create_unimplemented_device("timer[11]",   0x40014800, 0x400);
+    create_unimplemented_device("GPIOA",       0x40020000, 0x400);
+    create_unimplemented_device("GPIOB",       0x40020400, 0x400);
+    create_unimplemented_device("GPIOC",       0x40020800, 0x400);
+    create_unimplemented_device("GPIOD",       0x40020C00, 0x400);
+    create_unimplemented_device("GPIOE",       0x40021000, 0x400);
+    create_unimplemented_device("GPIOF",       0x40021400, 0x400);
+    create_unimplemented_device("GPIOG",       0x40021800, 0x400);
+    create_unimplemented_device("GPIOH",       0x40021C00, 0x400);
+    create_unimplemented_device("GPIOI",       0x40022000, 0x400);
+    create_unimplemented_device("CRC",         0x40023000, 0x400);
+    create_unimplemented_device("RCC",         0x40023800, 0x400);
+    create_unimplemented_device("Flash Int",   0x40023C00, 0x400);
+    create_unimplemented_device("BKPSRAM",     0x40024000, 0x400);
+    create_unimplemented_device("DMA1",        0x40026000, 0x400);
+    create_unimplemented_device("DMA2",        0x40026400, 0x400);
+    create_unimplemented_device("Ethernet",    0x40028000, 0x1400);
+    create_unimplemented_device("USB OTG HS",  0x40040000, 0x30000);
+    create_unimplemented_device("USB OTG FS",  0x50000000, 0x31000);
+    create_unimplemented_device("DCMI",        0x50050000, 0x400);
+    create_unimplemented_device("RNG",         0x50060800, 0x400);
+}
+
+static Property stm32f405_soc_properties[] = {
+    DEFINE_PROP_STRING("cpu-type", STM32F405State, cpu_type),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32f405_soc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = stm32f405_soc_realize;
+    dc->props = stm32f405_soc_properties;
+    /* No vmstate or reset required: device has no internal state */
+}
+
+static const TypeInfo stm32f405_soc_info = {
+    .name          = TYPE_STM32F405_SOC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F405State),
+    .instance_init = stm32f405_soc_initfn,
+    .class_init    = stm32f405_soc_class_init,
+};
+
+static void stm32f405_soc_types(void)
+{
+    type_register_static(&stm32f405_soc_info);
+}
+
+type_init(stm32f405_soc_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/adc/*
 F: hw/ssi/stm32f2xx_spi.c
 F: include/hw/*/stm32*.h
 
+STM32F405
+M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
+S: Maintained
+F: hw/arm/stm32f405_soc.c
+F: hw/misc/stm32f4xx_syscfg.c
+F: hw/misc/stm32f4xx_exti.c
+
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: dad8d8d47f7625913e35e27a1c00f603a6b08f9a.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs   |  1 +
 hw/arm/netduinoplus2.c | 52 ++++++++++++++++++++++++++++++++++++++++++
 MAINTAINERS            |  6 +++++
 3 files changed, 59 insertions(+)
 create mode 100644 hw/arm/netduinoplus2.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MAINSTONE) += mainstone.o
 obj-$(CONFIG_MICROBIT) += microbit.o
 obj-$(CONFIG_MUSICPAL) += musicpal.o
 obj-$(CONFIG_NETDUINO2) += netduino2.o
+obj-$(CONFIG_NETDUINOPLUS2) += netduinoplus2.o
 obj-$(CONFIG_NSERIES) += nseries.o
 obj-$(CONFIG_SX1) += omap_sx1.o
 obj-$(CONFIG_CHEETAH) += palm.o
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Netduino Plus 2 Machine Model
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "qemu/error-report.h"
+#include "hw/arm/stm32f405_soc.h"
+#include "hw/arm/boot.h"
+
+static void netduinoplus2_init(MachineState *machine)
+{
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, TYPE_STM32F405_SOC);
+    qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+    object_property_set_bool(OBJECT(dev), true, "realized", &error_fatal);
+
+    armv7m_load_kernel(ARM_CPU(first_cpu),
+                       machine->kernel_filename,
+                       FLASH_SIZE);
+}
+
+static void netduinoplus2_machine_init(MachineClass *mc)
+{
+    mc->desc = "Netduino Plus 2 Machine";
+    mc->init = netduinoplus2_init;
+}
+
+DEFINE_MACHINE("netduinoplus2", netduinoplus2_machine_init)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/netduino2.c
 
+Netduino Plus 2
+M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
+S: Maintained
+F: hw/arm/netduinoplus2.c
+
 SmartFusion2
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots a Linux kernel on a CubieBoard and verify
the serial output is working.

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://docs.armbian.com/Developer-Guide_Build-Preparation/

The cpio image used comes from the linux-build-test project:
https://github.com/groeck/linux-build-test

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Tested-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-id: 20191230110953.25496-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 41 ++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
         self.wait_for_console_pattern('Boot successful.')
         # TODO user command, for now the uart is stuck
 
+    def test_arm_cubieboard_initrd(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:cubieboard
+        """
+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        kernel_path = self.extract_from_deb(deb_path,
+                                            '/boot/vmlinuz-4.20.7-sunxi')
+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+                      'arm/rootfs-armv5.cpio.gz')
+        initrd_hash = '2b50f1873e113523967806f4da2afe385462ff9b'
+        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
+        archive.gzip_uncompress(initrd_path_gz, initrd_path)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'console=ttyS0,115200 '
+                               'usbcore.nousb '
+                               'panic=-1 noreboot')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-dtb', dtb_path,
+                         '-initrd', initrd_path,
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                                                'Allwinner sun4i/sun5i')
+        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
+                                                'system-control@1c00000')
+        exec_command_and_wait_for_pattern(self, 'reboot',
+                                                'reboot: Restarting system')
+
     def test_s390x_s390_ccw_virtio(self):
         """
         :avocado: tags=arch:s390x
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://docs.armbian.com/Developer-Guide_Build-Preparation/

The cpio image used comes from the linux-build-test project:
https://github.com/groeck/linux-build-test

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

$ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  [...]
  console: ahci-sunxi 1c18000.sata: Linked as a consumer to regulator.4
  console: ahci-sunxi 1c18000.sata: controller can't do 64bit DMA, forcing 32bit
  console: ahci-sunxi 1c18000.sata: AHCI 0001.0000 32 slots 1 ports 1.5 Gbps 0x1 impl platform mode
  console: ahci-sunxi 1c18000.sata: flags: ncq only
  console: scsi host0: ahci-sunxi
  console: ata1: SATA max UDMA/133 mmio [mem 0x01c18000-0x01c18fff] port 0x100 irq 27
  console: of_cfs_init
  console: of_cfs_init: OK
  console: vcc3v0: disabling
  console: vcc5v0: disabling
  console: usb1-vbus: disabling
  console: usb2-vbus: disabling
  console: ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
  console: ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100
  console: ata1.00: 40960 sectors, multi 16: LBA48 NCQ (depth 32)
  console: ata1.00: applying bridge limits
  console: ata1.00: configured for UDMA/100
  console: scsi 0:0:0:0: Direct-Access     ATA      QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
  console: sd 0:0:0:0: Attached scsi generic sg0 type 0
  console: sd 0:0:0:0: [sda] 40960 512-byte logical blocks: (21.0 MB/20.0 MiB)
  console: sd 0:0:0:0: [sda] Write Protect is off
  console: sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
  console: sd 0:0:0:0: [sda] Attached SCSI disk
  console: EXT4-fs (sda): mounting ext2 file system using the ext4 subsystem
  console: EXT4-fs (sda): mounted filesystem without journal. Opts: (null)
  console: VFS: Mounted root (ext2 filesystem) readonly on device 8:0.
  [...]
  console: cat /proc/partitions
  console: / # cat /proc/partitions
  console: major minor  #blocks  name
  console: 1        0       4096 ram0
  console: 1        1       4096 ram1
  console: 1        2       4096 ram2
  console: 1        3       4096 ram3
  console: 8        0      20480 sda
  console: reboot
  console: / # reboot
  [...]
  console: sd 0:0:0:0: [sda] Synchronizing SCSI cache
  console: reboot: Restarting system
  PASS (48.39 s)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 44 ++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
         exec_command_and_wait_for_pattern(self, 'reboot',
                                                 'reboot: Restarting system')
 
+    def test_arm_cubieboard_sata(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:cubieboard
+        """
+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        kernel_path = self.extract_from_deb(deb_path,
+                                            '/boot/vmlinuz-4.20.7-sunxi')
+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+        rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+                      'arm/rootfs-armv5.ext2.gz')
+        rootfs_hash = '093e89d2b4d982234bf528bc9fb2f2f17a9d1f93'
+        rootfs_path_gz = self.fetch_asset(rootfs_url, asset_hash=rootfs_hash)
+        rootfs_path = os.path.join(self.workdir, 'rootfs.cpio')
+        archive.gzip_uncompress(rootfs_path_gz, rootfs_path)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'console=ttyS0,115200 '
+                               'usbcore.nousb '
+                               'root=/dev/sda ro '
+                               'panic=-1 noreboot')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-dtb', dtb_path,
+                         '-drive', 'if=none,format=raw,id=disk0,file='
+                                   + rootfs_path,
+                         '-device', 'ide-hd,bus=ide.0,drive=disk0',
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                                                'Allwinner sun4i/sun5i')
+        exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
+                                                'sda')
+        exec_command_and_wait_for_pattern(self, 'reboot',
+                                                'reboot: Restarting system')
+
     def test_s390x_s390_ccw_virtio(self):
         """
         :avocado: tags=arch:s390x
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

These definitions are specific to the A10 SoC and don't need
to be exported to the different Allwinner peripherals.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-a10.h | 6 ------
 hw/arm/allwinner-a10.c         | 6 ++++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/cpu.h"
 
 
-#define AW_A10_PIC_REG_BASE     0x01c20400
-#define AW_A10_PIT_REG_BASE     0x01c20c00
-#define AW_A10_UART0_REG_BASE   0x01c28000
-#define AW_A10_EMAC_BASE        0x01c0b000
-#define AW_A10_SATA_BASE        0x01c18000
-
 #define AW_A10_SDRAM_BASE       0x40000000
 
 #define TYPE_AW_A10 "allwinner-a10"
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "sysemu/sysemu.h"
 
+#define AW_A10_PIC_REG_BASE     0x01c20400
+#define AW_A10_PIT_REG_BASE     0x01c20c00
+#define AW_A10_UART0_REG_BASE   0x01c28000
+#define AW_A10_EMAC_BASE        0x01c0b000
+#define AW_A10_SATA_BASE        0x01c18000
+
 static void aw_a10_init(Object *obj)
 {
     AwA10State *s = AW_A10(obj);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

By calling qdev_pass_gpios() we don't need to hold a copy of the
IRQs from the INTC into the SoC state.
Instead of filling an array of qemu_irq and passing it around, we
can now directly call qdev_get_gpio_in() on the SoC.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-a10.h |  1 -
 hw/arm/allwinner-a10.c         | 24 +++++++++++-------------
 2 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
     /*< public >*/
 
     ARMCPU cpu;
-    qemu_irq irq[AW_A10_PIC_INT_NR];
     AwA10PITState timer;
     AwA10PICState intc;
     AwEmacState emac;
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 {
     AwA10State *s = AW_A10(dev);
     SysBusDevice *sysbusdev;
-    uint8_t i;
     qemu_irq fiq, irq;
     Error *err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
     sysbus_connect_irq(sysbusdev, 0, irq);
     sysbus_connect_irq(sysbusdev, 1, fiq);
-    for (i = 0; i < AW_A10_PIC_INT_NR; i++) {
-        s->irq[i] = qdev_get_gpio_in(DEVICE(&s->intc), i);
-    }
+    qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
 
     object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
     if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->timer);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIT_REG_BASE);
-    sysbus_connect_irq(sysbusdev, 0, s->irq[22]);
-    sysbus_connect_irq(sysbusdev, 1, s->irq[23]);
-    sysbus_connect_irq(sysbusdev, 2, s->irq[24]);
-    sysbus_connect_irq(sysbusdev, 3, s->irq[25]);
-    sysbus_connect_irq(sysbusdev, 4, s->irq[67]);
-    sysbus_connect_irq(sysbusdev, 5, s->irq[68]);
+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 22));
+    sysbus_connect_irq(sysbusdev, 1, qdev_get_gpio_in(dev, 23));
+    sysbus_connect_irq(sysbusdev, 2, qdev_get_gpio_in(dev, 24));
+    sysbus_connect_irq(sysbusdev, 3, qdev_get_gpio_in(dev, 25));
+    sysbus_connect_irq(sysbusdev, 4, qdev_get_gpio_in(dev, 67));
+    sysbus_connect_irq(sysbusdev, 5, qdev_get_gpio_in(dev, 68));
 
     memory_region_init_ram(&s->sram_a, OBJECT(dev), "sram A", 48 * KiB,
                            &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->emac);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_EMAC_BASE);
-    sysbus_connect_irq(sysbusdev, 0, s->irq[55]);
+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 55));
 
     object_property_set_bool(OBJECT(&s->sata), true, "realized", &err);
     if (err) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sata), 0, AW_A10_SATA_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, s->irq[56]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, qdev_get_gpio_in(dev, 56));
 
     /* FIXME use a qdev chardev prop instead of serial_hd() */
-    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2, s->irq[1],
+    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2,
+                   qdev_get_gpio_in(dev, 1),
                    115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We won't reuse the CPU IRQ/FIQ variables. Simplify by calling
qdev_get_gpio_in() in place.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/allwinner-a10.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 {
     AwA10State *s = AW_A10(dev);
     SysBusDevice *sysbusdev;
-    qemu_irq fiq, irq;
     Error *err = NULL;
 
     object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    irq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ);
-    fiq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ);
 
     object_property_set_bool(OBJECT(&s->intc), true, "realized", &err);
     if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->intc);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
-    sysbus_connect_irq(sysbusdev, 0, irq);
-    sysbus_connect_irq(sysbusdev, 1, fiq);
+    sysbus_connect_irq(sysbusdev, 0,
+                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
+    sysbus_connect_irq(sysbusdev, 1,
+                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
     qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
 
     object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
-- 
2.20.1

From: Masahiro Yamada <masahiroy@kernel.org>

According to the specification "Semihosting for AArch32 and Aarch64",
the SYS_OPEN operation should return:

- A nonzero handle if the call is successful
 - -1 if the call is not successful

So, it should never return 0.

Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
code hand out its own file descriptors"), the guest fd matched to the
host fd. It returned a nonzero handle on success since the fd 0 is
already used for stdin.

Now that the guest fd is the index of guestfd_array, it starts from 0.

I noticed this issue particularly because Trusted Firmware-A built with
PLAT=qemu is no longer working. Its io_semihosting driver only handles
a positive return value as a valid filehandle.

Basically, there are two ways to fix this:

- Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
    increment/decrement to convert the guestfd and the array index back
    and forth.

- Keep using guestfd as the index of guestfs_array. The first entry
    of guestfs_array is left unused.

I thought the latter is simpler. We end up with wasting a small piece
of memory for the unused first entry of guestfd_array, but this is
probably not a big deal.

Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
Cc: qemu-stable@nongnu.org
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200109041228.10131-1-masahiroy@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-semi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static int alloc_guestfd(void)
         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
     }
 
-    for (i = 0; i < guestfd_array->len; i++) {
+    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
+    for (i = 1; i < guestfd_array->len; i++) {
         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
 
         if (gf->type == GuestFDUnused) {
@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
         return NULL;
     }
 
-    if (guestfd < 0 || guestfd >= guestfd_array->len) {
+    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
         return NULL;
     }
 
-- 
2.20.1

From: Martin Kaiser <martin@kaiser.cx>

Add an emulation for the RNGC random number generator and the compatible
RNGB variant. These peripherals are included (at least) in imx25 and
imx35 chipsets.

The emulation supports the initial self test, reseeding the prng and
reading random numbers.

Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs      |   1 +
 include/hw/arm/fsl-imx25.h |   5 +
 include/hw/misc/imx_rngc.h |  35 +++++
 hw/arm/fsl-imx25.c         |  11 ++
 hw/misc/imx_rngc.c         | 278 +++++++++++++++++++++++++++++++++++++
 5 files changed, 330 insertions(+)
 create mode 100644 include/hw/misc/imx_rngc.h
 create mode 100644 hw/misc/imx_rngc.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx7_ccm.o
 common-obj-$(CONFIG_IMX) += imx2_wdt.o
 common-obj-$(CONFIG_IMX) += imx7_snvs.o
 common-obj-$(CONFIG_IMX) += imx7_gpr.o
+common-obj-$(CONFIG_IMX) += imx_rngc.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-hpdmc.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-pfpu.o
 common-obj-$(CONFIG_MAINSTONE) += mst_fpga.o
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/imx_gpt.h"
 #include "hw/timer/imx_epit.h"
 #include "hw/net/imx_fec.h"
+#include "hw/misc/imx_rngc.h"
 #include "hw/i2c/imx_i2c.h"
 #include "hw/gpio/imx_gpio.h"
 #include "exec/memory.h"
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     IMXGPTState    gpt[FSL_IMX25_NUM_GPTS];
     IMXEPITState   epit[FSL_IMX25_NUM_EPITS];
     IMXFECState    fec;
+    IMXRNGCState   rngc;
     IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
     IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
     MemoryRegion   rom[2];
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_GPIO4_SIZE    0x4000
 #define FSL_IMX25_GPIO3_ADDR    0x53FA4000
 #define FSL_IMX25_GPIO3_SIZE    0x4000
+#define FSL_IMX25_RNGC_ADDR     0x53FB0000
+#define FSL_IMX25_RNGC_SIZE     0x4000
 #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
 #define FSL_IMX25_GPIO1_SIZE    0x4000
 #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_EPIT1_IRQ     28
 #define FSL_IMX25_EPIT2_IRQ     27
 #define FSL_IMX25_FEC_IRQ       57
+#define FSL_IMX25_RNGC_IRQ      22
 #define FSL_IMX25_I2C1_IRQ      3
 #define FSL_IMX25_I2C2_IRQ      4
 #define FSL_IMX25_I2C3_IRQ      10
diff --git a/include/hw/misc/imx_rngc.h b/include/hw/misc/imx_rngc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/imx_rngc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Freescale i.MX RNGC emulation
+ *
+ * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef IMX_RNGC_H
+#define IMX_RNGC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_IMX_RNGC "imx.rngc"
+#define IMX_RNGC(obj) OBJECT_CHECK(IMXRNGCState, (obj), TYPE_IMX_RNGC)
+
+typedef struct IMXRNGCState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion  iomem;
+
+    uint8_t op_self_test;
+    uint8_t op_seed;
+    uint8_t mask;
+    bool    auto_seed;
+
+    QEMUBH *self_test_bh;
+    QEMUBH *seed_bh;
+    qemu_irq irq;
+} IMXRNGCState;
+
+#endif /* IMX_RNGC_H */
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
 
     sysbus_init_child_obj(obj, "fec", &s->fec, sizeof(s->fec), TYPE_IMX_FEC);
 
+    sysbus_init_child_obj(obj, "rngc", &s->rngc, sizeof(s->rngc),
+                          TYPE_IMX_RNGC);
+
     for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
         sysbus_init_child_obj(obj, "i2c[*]", &s->i2c[i], sizeof(s->i2c[i]),
                               TYPE_IMX_I2C);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fec), 0,
                        qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_FEC_IRQ));
 
+    object_property_set_bool(OBJECT(&s->rngc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rngc), 0, FSL_IMX25_RNGC_ADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rngc), 0,
+                       qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_RNGC_IRQ));
 
     /* Initialize all I2C */
     for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
diff --git a/hw/misc/imx_rngc.c b/hw/misc/imx_rngc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/imx_rngc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Freescale i.MX RNGC emulation
+ *
+ * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * This driver provides the minimum functionality to initialize and seed
+ * an rngc and to read random numbers. The rngb that is found in imx25
+ * chipsets is also supported.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+#include "qemu/module.h"
+#include "qemu/log.h"
+#include "qemu/guest-random.h"
+#include "hw/irq.h"
+#include "hw/misc/imx_rngc.h"
+#include "migration/vmstate.h"
+
+#define RNGC_NAME "i.MX RNGC"
+
+#define RNGC_VER_ID  0x00
+#define RNGC_COMMAND 0x04
+#define RNGC_CONTROL 0x08
+#define RNGC_STATUS  0x0C
+#define RNGC_FIFO    0x14
+
+/* These version info are reported by the rngb in an imx258 chip. */
+#define RNG_TYPE_RNGB 0x1
+#define V_MAJ 0x2
+#define V_MIN 0x40
+
+#define RNGC_CMD_BIT_SW_RST    0x40
+#define RNGC_CMD_BIT_CLR_ERR   0x20
+#define RNGC_CMD_BIT_CLR_INT   0x10
+#define RNGC_CMD_BIT_SEED      0x02
+#define RNGC_CMD_BIT_SELF_TEST 0x01
+
+#define RNGC_CTRL_BIT_MASK_ERR  0x40
+#define RNGC_CTRL_BIT_MASK_DONE 0x20
+#define RNGC_CTRL_BIT_AUTO_SEED 0x10
+
+/* the current status for self-test and seed operations */
+#define OP_IDLE 0
+#define OP_RUN  1
+#define OP_DONE 2
+
+static uint64_t imx_rngc_read(void *opaque, hwaddr offset, unsigned size)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+    uint64_t val = 0;
+
+    switch (offset) {
+    case RNGC_VER_ID:
+        val |= RNG_TYPE_RNGB << 28 | V_MAJ << 8 | V_MIN;
+        break;
+
+    case RNGC_COMMAND:
+        if (s->op_seed == OP_RUN) {
+            val |= RNGC_CMD_BIT_SEED;
+        }
+        if (s->op_self_test == OP_RUN) {
+            val |= RNGC_CMD_BIT_SELF_TEST;
+        }
+        break;
+
+    case RNGC_CONTROL:
+        /*
+         * The CTL_ACC and VERIF_MODE bits are not supported yet.
+         * They read as 0.
+         */
+        val |= s->mask;
+        if (s->auto_seed) {
+            val |= RNGC_CTRL_BIT_AUTO_SEED;
+        }
+        /*
+         * We don't have an internal fifo like the real hardware.
+         * There's no need for strategy to handle fifo underflows.
+         * We return the FIFO_UFLOW_RESPONSE bits as 0.
+         */
+        break;
+
+    case RNGC_STATUS:
+        /*
+         * We never report any statistics test or self-test errors or any
+         * other errors. STAT_TEST_PF, ST_PF and ERROR are always 0.
+         */
+
+        /*
+         * We don't have an internal fifo, see above. Therefore, we
+         * report back the default fifo size (5 32-bit words) and
+         * indicate that our fifo is always full.
+         */
+        val |= 5 << 12 | 5 << 8;
+
+        /* We always have a new seed available. */
+        val |= 1 << 6;
+
+        if (s->op_seed == OP_DONE) {
+            val |= 1 << 5;
+        }
+        if (s->op_self_test == OP_DONE) {
+            val |= 1 << 4;
+        }
+        if (s->op_seed == OP_RUN || s->op_self_test == OP_RUN) {
+            /*
+             * We're busy if self-test is running or if we're
+             * seeding the prng.
+             */
+            val |= 1 << 1;
+        } else {
+            /*
+             * We're ready to provide secure random numbers whenever
+             * we're not busy.
+             */
+            val |= 1;
+        }
+        break;
+
+    case RNGC_FIFO:
+        qemu_guest_getrandom_nofail(&val, sizeof(val));
+        break;
+    }
+
+    return val;
+}
+
+static void imx_rngc_do_reset(IMXRNGCState *s)
+{
+    s->op_self_test = OP_IDLE;
+    s->op_seed = OP_IDLE;
+    s->mask = 0;
+    s->auto_seed = false;
+}
+
+static void imx_rngc_write(void *opaque, hwaddr offset, uint64_t value,
+                           unsigned size)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    switch (offset) {
+    case RNGC_COMMAND:
+        if (value & RNGC_CMD_BIT_SW_RST) {
+            imx_rngc_do_reset(s);
+        }
+
+        /*
+         * For now, both CLR_ERR and CLR_INT clear the interrupt. We
+         * don't report any errors yet.
+         */
+        if (value & (RNGC_CMD_BIT_CLR_ERR | RNGC_CMD_BIT_CLR_INT)) {
+            qemu_irq_lower(s->irq);
+        }
+
+        if (value & RNGC_CMD_BIT_SEED) {
+            s->op_seed = OP_RUN;
+            qemu_bh_schedule(s->seed_bh);
+        }
+
+        if (value & RNGC_CMD_BIT_SELF_TEST) {
+            s->op_self_test = OP_RUN;
+            qemu_bh_schedule(s->self_test_bh);
+        }
+        break;
+
+    case RNGC_CONTROL:
+        /*
+         * The CTL_ACC and VERIF_MODE bits are not supported yet.
+         * We ignore them if they're set by the caller.
+         */
+
+        if (value & RNGC_CTRL_BIT_MASK_ERR) {
+            s->mask |= RNGC_CTRL_BIT_MASK_ERR;
+        } else {
+            s->mask &= ~RNGC_CTRL_BIT_MASK_ERR;
+        }
+
+        if (value & RNGC_CTRL_BIT_MASK_DONE) {
+            s->mask |= RNGC_CTRL_BIT_MASK_DONE;
+        } else {
+            s->mask &= ~RNGC_CTRL_BIT_MASK_DONE;
+        }
+
+        if (value & RNGC_CTRL_BIT_AUTO_SEED) {
+            s->auto_seed = true;
+        } else {
+            s->auto_seed = false;
+        }
+        break;
+    }
+}
+
+static const MemoryRegionOps imx_rngc_ops = {
+    .read  = imx_rngc_read,
+    .write = imx_rngc_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void imx_rngc_self_test(void *opaque)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    s->op_self_test = OP_DONE;
+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void imx_rngc_seed(void *opaque)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    s->op_seed = OP_DONE;
+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void imx_rngc_realize(DeviceState *dev, Error **errp)
+{
+    IMXRNGCState *s = IMX_RNGC(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_rngc_ops, s,
+                          TYPE_IMX_RNGC, 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+
+    sysbus_init_irq(sbd, &s->irq);
+    s->self_test_bh = qemu_bh_new(imx_rngc_self_test, s);
+    s->seed_bh = qemu_bh_new(imx_rngc_seed, s);
+}
+
+static void imx_rngc_reset(DeviceState *dev)
+{
+    IMXRNGCState *s = IMX_RNGC(dev);
+
+    imx_rngc_do_reset(s);
+}
+
+static const VMStateDescription vmstate_imx_rngc = {
+    .name = RNGC_NAME,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(op_self_test, IMXRNGCState),
+        VMSTATE_UINT8(op_seed, IMXRNGCState),
+        VMSTATE_UINT8(mask, IMXRNGCState),
+        VMSTATE_BOOL(auto_seed, IMXRNGCState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void imx_rngc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = imx_rngc_realize;
+    dc->reset = imx_rngc_reset;
+    dc->desc = RNGC_NAME,
+    dc->vmsd = &vmstate_imx_rngc;
+}
+
+static const TypeInfo imx_rngc_info = {
+    .name          = TYPE_IMX_RNGC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IMXRNGCState),
+    .class_init    = imx_rngc_class_init,
+};
+
+static void imx_rngc_register_types(void)
+{
+    type_register_static(&imx_rngc_info);
+}
+
+type_init(imx_rngc_register_types)
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The wfi instruction can be configured to be trapped by a higher exception
level, such as the EL2 hypervisor. When the instruction is trapped, the
program counter should contain the address of the wfi instruction that
caused the exception. The program counter is adjusted for this in the wfi op
helper function.

However, this correction is done to env->pc, which only applies to AArch64
mode. For AArch32, the program counter is stored in env->regs[15]. This
adds an if-else statement to modify the correct program counter location
based on the the current CPU mode.

Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/op_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
     }
 
     if (target_el) {
-        env->pc -= insn_len;
+        if (env->aarch64) {
+            env->pc -= insn_len;
+        } else {
+            env->regs[15] -= insn_len;
+        }
+
         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
                         target_el);
     }
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The IAR0/IAR1 register is used to acknowledge an interrupt - a read of the
register activates the highest priority pending interrupt and provides its
interrupt ID. Activating an interrupt can change the CPU's virtual interrupt
state - this change makes sure the virtual irq state is updated.

Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200113154607.97032-1-jeff.kubascik@dornerworks.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
 
     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
                              gicv3_redist_affid(cs), intid);
+
+    gicv3_cpuif_virt_update(cs);
+
     return intid;
 }
 
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The IL bit is set for 32-bit instructions, thus passing false
with the is_16bit parameter to syn_data_abort_with_iss() makes
a syn mask that always has the IL bit set.

Pass is_16bit as true to make the initial syn mask have IL=0,
so that the final IL value comes from or'ing template_syn.

Cc: qemu-stable@nongnu.org
Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200117004618.2742-2-richard.henderson@linaro.org
[rth: Extracted this as a self-contained bug fix from a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tlb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
         syn = syn_data_abort_with_iss(same_el,
                                       0, 0, 0, 0, 0,
                                       ea, 0, s1ptw, is_write, fsc,
-                                      false);
+                                      true);
         /* Merge the runtime syndrome with the template syndrome.  */
         syn |= template_syn;
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

During the conversion to decodetree, the setting of
ISSIs16Bit got lost.  This causes the guest os to
incorrectly adjust trapping memory operations.

Cc: qemu-stable@nongnu.org
Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
Reported-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200117004618.2742-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
     /* ISS not valid if writeback */
     if (p && !w) {
         ret = rd;
+        if (s->base.pc_next - s->pc_curr == 2) {
+            ret |= ISSIs16Bit;
+        }
     } else {
         ret = ISSInvalid;
     }
-- 
2.20.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1