Series comparison

-[PULL 0/6] target-arm queue
+[PULL 0/4] target-arm queue
-A handful of bugfixes before rc1 tomorrow...
+Hi; some minor changes for 6.2, which I think can be classified
 as bug fixes and are OK for this point in the release cycle.
 (Wouldn't be the end of the world if they slipped to 7.0.)
-thanks
 -- PMM
-The following changes since commit f9fe8450fa7cdc6268e05c93fa258f583f4514b7:
+The following changes since commit 42f6c9179be4401974dd3a75ee72defd16b5092d:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-30 11:32:01 +0100)
+  Merge tag 'pull-ppc-20211112' of https://github.com/legoater/qemu into staging (2021-11-12 12:28:25 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200330
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211115-1
-for you to fetch changes up to 88828bf133b64b7a860c166af3423ef1a47c5d3b:
+for you to fetch changes up to 1adf528ec3bdf62ea3b580b7ad562534a3676ff5:
-  target/arm: fix incorrect current EL bug in aarch32 exception emulation (2020-03-30 13:55:32 +0100)
+  hw/rtc/pl031: Send RTC_CHANGE QMP event (2021-11-15 18:53:00 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available
+ * Support multiple redistributor regions for TCG GICv3
- * hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address
+ * Send RTC_CHANGE QMP event from pl031
  * docs/conf.py: Raise ConfigError for bad Sphinx Python version
  * hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path
  * hw/arm/xlnx-zynqmp.c: Add missing error-propagation code
  * target/arm: fix incorrect current EL bug in aarch32 exception emulation
 ----------------------------------------------------------------
-Changbin Du (1):
+Eric Auger (1):
-      target/arm: fix incorrect current EL bug in aarch32 exception emulation
+      hw/rtc/pl031: Send RTC_CHANGE QMP event
 Niek Linnenbank (2):
       hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available
       hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address
 Peter Maydell (3):
-      docs/conf.py: Raise ConfigError for bad Sphinx Python version
+      hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize
-      hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path
+      hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1
-      hw/arm/xlnx-zynqmp.c: Add missing error-propagation code
+      hw/intc/arm_gicv3: Support multiple redistributor regions
- hw/arm/orangepi.c            |  2 +-
+ include/hw/intc/arm_gicv3_common.h | 14 ++++++++--
- hw/arm/xlnx-zynqmp.c         | 27 ++++++++++++++++++++++++++-
+ hw/intc/arm_gicv3.c                | 12 +-------
- hw/misc/allwinner-h3-dramc.c |  4 ++--
+ hw/intc/arm_gicv3_common.c         | 56 ++++++++++++++++++++++++--------------
- target/arm/helper.c          |  5 ++++-
+ hw/intc/arm_gicv3_kvm.c            | 10 ++-----
- docs/conf.py                 |  9 +++++----
+ hw/intc/arm_gicv3_redist.c         | 40 +++++++++++++++------------
-files changed, 38 insertions(+), 9 deletions(-)
+ hw/rtc/pl031.c                     | 10 ++++++-
  hw/rtc/meson.build                 |  2 +-
 files changed, 83 insertions(+), 61 deletions(-)

-[PULL 5/6] hw/arm/xlnx-zynqmp.c: Add missing error-propagation code
+[PULL 1/4] hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize
-In some places in xlnx_zynqmp_realize() we were putting an
+The GICv3 devices have an array property redist-region-count.
-error into our local Error*, but forgetting to check for
+Currently we check this for errors (bad values) in
-failure and pass it back to the caller. Add the missing code.
+gicv3_init_irqs_and_mmio(), just before we use it.  Move this error
 checking to the arm_gicv3_common_realize() function, where we
 sanity-check all of the other base-class properties. (This will
 always be before gicv3_init_irqs_and_mmio() is called, because
 that function is called in the subclass realize methods, after
 they have called the parent-class realize.)
 The motivation for this refactor is:
  * we would like to use the redist_region_count[] values in
    arm_gicv3_common_realize() in a subsequent patch, so we need
    to have already done the sanity-checking first
  * this removes the only use of the Error** argument to
    gicv3_init_irqs_and_mmio(), so we can remove some error-handling
    boilerplate
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200324134947.15384-3-peter.maydell@linaro.org
 ---
- hw/arm/xlnx-zynqmp.c | 24 ++++++++++++++++++++++++
+ include/hw/intc/arm_gicv3_common.h |  2 +-
-file changed, 24 insertions(+)
+ hw/intc/arm_gicv3.c                |  6 +-----
  hw/intc/arm_gicv3_common.c         | 26 +++++++++++++-------------
  hw/intc/arm_gicv3_kvm.c            |  6 +-----
 files changed, 16 insertions(+), 24 deletions(-)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
+diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
+--- a/include/hw/intc/arm_gicv3_common.h
-+++ b/hw/arm/xlnx-zynqmp.c
++++ b/include/hw/intc/arm_gicv3_common.h
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ struct ARMGICv3CommonClass {
-          * - eMMC Specification Version 4.51
+ };
-          */
-         object_property_set_uint(sdhci, 3, "sd-spec-version", &err);
+ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
-+        if (err) {
+-                              const MemoryRegionOps *ops, Error **errp);
-+            error_propagate(errp, err);
++                              const MemoryRegionOps *ops);
-+            return;
-+        }
+ #endif
-         object_property_set_uint(sdhci, SDHCI_CAPABILITIES, "capareg", &err);
+diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
-+        if (err) {
+index XXXXXXX..XXXXXXX 100644
-+            error_propagate(errp, err);
+--- a/hw/intc/arm_gicv3.c
-+            return;
++++ b/hw/intc/arm_gicv3.c
-+        }
+@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
-         object_property_set_uint(sdhci, UHS_I, "uhs", &err);
+         return;
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
          object_property_set_bool(sdhci, true, "realized", &err);
          if (err) {
              error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          gchar *bus_name;
          object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0, spi_addr[i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      }
-     object_property_set_bool(OBJECT(&s->qspi), true, "realized", &err);
+-    gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops, &local_err);
-+    if (err) {
+-    if (local_err) {
-+        error_propagate(errp, err);
+-        error_propagate(errp, local_err);
 -        return;
 -    }
 +    gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
      gicv3_init_cpuif(s);
  }
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
  };
  void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
 -                              const MemoryRegionOps *ops, Error **errp)
 +                              const MemoryRegionOps *ops)
  {
      SysBusDevice *sbd = SYS_BUS_DEVICE(s);
 -    int rdist_capacity = 0;
      int i;
 -    for (i = 0; i < s->nb_redist_regions; i++) {
 -        rdist_capacity += s->redist_region_count[i];
 -    }
 -    if (rdist_capacity < s->num_cpu) {
 -        error_setg(errp, "Capacity of the redist regions(%d) "
 -                   "is less than number of vcpus(%d)",
 -                   rdist_capacity, s->num_cpu);
 -        return;
 -    }
 -
      /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
       * GPIO array layout is thus:
       *  [0..N-1] spi
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
  static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
  {
      GICv3State *s = ARM_GICV3_COMMON(dev);
 -    int i;
 +    int i, rdist_capacity;
      /* revision property is actually reserved and currently used only in order
       * to keep the interface compatible with GICv2 code, avoiding extra
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
          return;
      }
 +    rdist_capacity = 0;
 +    for (i = 0; i < s->nb_redist_regions; i++) {
 +        rdist_capacity += s->redist_region_count[i];
 +    }
 +    if (rdist_capacity < s->num_cpu) {
 +        error_setg(errp, "Capacity of the redist regions(%d) "
 +                   "is less than number of vcpus(%d)",
 +                   rdist_capacity, s->num_cpu);
 +        return;
 +    }
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 0, QSPI_ADDR);
++
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 1, LQSPI_ADDR);
+     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->qspi), 0, gic_spi[QSPI_IRQ]);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+     for (i = 0; i < s->num_cpu; i++) {
+diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
-     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
+index XXXXXXX..XXXXXXX 100644
-         object_property_set_uint(OBJECT(&s->gdma[i]), 128, "bus-width", &err);
+--- a/hw/intc/arm_gicv3_kvm.c
-+        if (err) {
++++ b/hw/intc/arm_gicv3_kvm.c
-+            error_propagate(errp, err);
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
-+            return;
+         return;
-+        }
+     }
-         object_property_set_bool(OBJECT(&s->gdma[i]), true, "realized", &err);
-         if (err) {
+-    gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL, &local_err);
-             error_propagate(errp, err);
+-    if (local_err) {
 -        error_propagate(errp, local_err);
 -        return;
 -    }
 +    gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL);
      for (i = 0; i < s->num_cpu; i++) {
          ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
 --
-.20.1
+.25.1

-[PULL 6/6] target/arm: fix incorrect current EL bug in aarch32 exception emulation
+[PULL 2/4] hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1
-From: Changbin Du <changbin.du@gmail.com>
+The 'Last' bit in the GICR_TYPER GICv3 redistributor register is
 supposed to be set to 1 if this is the last redistributor in a series
 of contiguous redistributor pages.  Currently we set Last only for
 the redistributor for CPU (num_cpu - 1).  This only works if there is
 a single redistributor region; if there are multiple redistributor
 regions then we need to set the Last bit for the last redistributor
 in each region.
-The arm_current_el() should be invoked after mode switching. Otherwise, we
+This doesn't cause any problems currently because only the KVM GICv3
-get a wrong current EL value, since current EL is also determined by
+supports multiple redistributor regions, and it ignores the value in
-current mode.
+GICv3State::gicr_typer.  But we need to fix this before we can enable
 support for multiple regions in the emulated GICv3.
-Fixes: 4a2696c0d4 ("target/arm: Set PAN bit as required on exception entry")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Changbin Du <changbin.du@gmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200328140232.17278-1-changbin.du@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 5 ++++-
+ hw/intc/arm_gicv3_common.c | 17 ++++++++++++-----
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 12 insertions(+), 5 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/intc/arm_gicv3_common.c
-+++ b/target/arm/helper.c
++++ b/hw/intc/arm_gicv3_common.c
-@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
+@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
+ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
-     /* Change the CPU state so as to actually take the exception. */
+ {
-     switch_mode(env, new_mode);
+     GICv3State *s = ARM_GICV3_COMMON(dev);
--    new_el = arm_current_el(env);
+-    int i, rdist_capacity;
++    int i, rdist_capacity, cpuidx;
-     /*
-      * For exceptions taken to AArch32 we must clear the SS bit in both
+     /* revision property is actually reserved and currently used only in order
-@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
+      * to keep the interface compatible with GICv2 code, avoiding extra
-     env->condexec_bits = 0;
+@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
-     /* Switch to the new mode, and to the correct instruction set.  */
+     for (i = 0; i < s->num_cpu; i++) {
-     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
+         CPUState *cpu = qemu_get_cpu(i);
          uint64_t cpu_affid;
 -        int last;
          s->cpu[i].cpu = cpu;
          s->cpu[i].gic = s;
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
           *  PLPIS == 0 (physical LPIs not supported)
           */
          cpu_affid = object_property_get_uint(OBJECT(cpu), "mp-affinity", NULL);
 -        last = (i == s->num_cpu - 1);
          /* The CPU mp-affinity property is in MPIDR register format; squash
           * the affinity bytes into 32 bits as the GICR_TYPER has them.
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
                       (cpu_affid & 0xFFFFFF);
          s->cpu[i].gicr_typer = (cpu_affid << 32) |
              (1 << 24) |
 -            (i << 8) |
 -            (last << 4);
 +            (i << 8);
          if (s->lpi_enable) {
              s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
          }
      }
 +
-+    /* This must be after mode switching. */
++    /*
-+    new_el = arm_current_el(env);
++     * Now go through and set GICR_TYPER.Last for the final
-+
++     * redistributor in each region.
-     /* Set new mode endianness */
++     */
-     env->uncached_cpsr &= ~CPSR_E;
++    cpuidx = 0;
-     if (env->cp15.sctlr_el[new_el] & SCTLR_EE) {
++    for (i = 0; i < s->nb_redist_regions; i++) {
 +        cpuidx += s->redist_region_count[i];
 +        s->cpu[cpuidx - 1].gicr_typer |= GICR_TYPER_LAST;
 +    }
  }
  static void arm_gicv3_finalize(Object *obj)
 --
-.20.1
+.25.1

-[PULL 3/6] docs/conf.py: Raise ConfigError for bad Sphinx Python version
+[PULL 3/4] hw/intc/arm_gicv3: Support multiple redistributor regions
-Raise ConfigError rather than VersionRequirementError when we detect
+Our GICv3 QOM interface includes an array property
-that the Python being used by Sphinx is too old.
+redist-region-count which allows board models to specify that the
+registributor registers are not in a single contiguous range, but
-Currently the way we flag the Python version problem up to the user
+split into multiple pieces.  We implemented this for KVM, but
-causes Sphinx to print an unnecessary Python stack trace as well as
+currently the TCG GICv3 model insists that there is only one region.
-the information about the problem; in most versions of Sphinx this is
+You can see the limit being hit with a setup like:
-unavoidable.
+  qemu-system-aarch64 -machine virt,gic-version=3 -smp 124
-The upstream Sphinx developers kindly added a feature to allow
+Add support for split regions to the TCG GICv3.  To do this we switch
-conf.py to report errors to the user without the backtrace:
+from allocating a simple array of MemoryRegions to an array of
-  https://github.com/sphinx-doc/sphinx/commit/be608ca2313fc08eb842f3dc19d0f5d2d8227d08
+GICv3RedistRegion structs so that we can use the GICv3RedistRegion as
-but the exception type they chose for this was ConfigError.
+the opaque pointer in the MemoryRegion read/write callbacks.  Each
+GICv3RedistRegion contains the MemoryRegion, a backpointer allowing
-Switch to ConfigError, which won't make any difference with currently
+the read/write callback to get hold of the GICv3State, and an index
-deployed Sphinx versions, but will be prettier one day when the user
+which allows us to calculate which CPU's redistributor is being
-is using a Sphinx version with the new feature.
+accessed.
 Note that arm_gicv3_kvm always passes in NULL as the ops argument
 to gicv3_init_irqs_and_mmio(), so the only MemoryRegion read/write
 callbacks we need to update to handle this new scheme are the
 gicv3_redist_read/write functions used by the emulated GICv3.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: John Snow <jsnow@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200313163616.30674-1-peter.maydell@linaro.org
 ---
- docs/conf.py | 9 +++++----
+ include/hw/intc/arm_gicv3_common.h | 12 ++++++++-
-file changed, 5 insertions(+), 4 deletions(-)
+ hw/intc/arm_gicv3.c                |  6 -----
+ hw/intc/arm_gicv3_common.c         | 15 ++++++++---
-diff --git a/docs/conf.py b/docs/conf.py
+ hw/intc/arm_gicv3_kvm.c            |  4 +--
-index XXXXXXX..XXXXXXX 100644
+ hw/intc/arm_gicv3_redist.c         | 40 ++++++++++++++++--------------
---- a/docs/conf.py
+files changed, 46 insertions(+), 31 deletions(-)
-+++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@
+diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
- import os
+index XXXXXXX..XXXXXXX 100644
- import sys
+--- a/include/hw/intc/arm_gicv3_common.h
- import sphinx
++++ b/include/hw/intc/arm_gicv3_common.h
--from sphinx.errors import VersionRequirementError
+@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
-+from sphinx.errors import ConfigError
+     bool seenbetter;
+ };
- # Make Sphinx fail cleanly if using an old Python, rather than obscurely
- # failing because some code in one of our extensions doesn't work there.
++/*
--# Unfortunately this doesn't display very neatly (there's an unavoidable
++ * The redistributor pages might be split into more than one region
--# Python backtrace) but at least the information gets printed...
++ * on some machine types if there are many CPUs.
-+# In newer versions of Sphinx this will display nicely; in older versions
++ */
-+# Sphinx will also produce a Python backtrace but at least the information
++typedef struct GICv3RedistRegion {
-+# gets printed...
++    GICv3State *gic;
- if sys.version_info < (3,5):
++    MemoryRegion iomem;
--    raise VersionRequirementError(
++    uint32_t cpuidx; /* index of first CPU this region covers */
-+    raise ConfigError(
++} GICv3RedistRegion;
-         "QEMU requires a Sphinx that uses Python 3.5 or better\n")
++
+ struct GICv3State {
- # The per-manual conf.py will set qemu_docdir for a single-manual build;
+     /*< private >*/
      SysBusDevice parent_obj;
      /*< public >*/
      MemoryRegion iomem_dist; /* Distributor */
 -    MemoryRegion *iomem_redist; /* Redistributor Regions */
 +    GICv3RedistRegion *redist_regions; /* Redistributor Regions */
      uint32_t *redist_region_count; /* redistributor count within each region */
      uint32_t nb_redist_regions; /* number of redist regions */
 diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3.c
 +++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
          return;
      }
 -    if (s->nb_redist_regions != 1) {
 -        error_setg(errp, "VGICv3 redist region number(%d) not equal to 1",
 -                   s->nb_redist_regions);
 -        return;
 -    }
 -
      gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
      gicv3_init_cpuif(s);
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
  {
      SysBusDevice *sbd = SYS_BUS_DEVICE(s);
      int i;
 +    int cpuidx;
      /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
       * GPIO array layout is thus:
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
                            "gicv3_dist", 0x10000);
      sysbus_init_mmio(sbd, &s->iomem_dist);
 -    s->iomem_redist = g_new0(MemoryRegion, s->nb_redist_regions);
 +    s->redist_regions = g_new0(GICv3RedistRegion, s->nb_redist_regions);
 +    cpuidx = 0;
      for (i = 0; i < s->nb_redist_regions; i++) {
          char *name = g_strdup_printf("gicv3_redist_region[%d]", i);
 +        GICv3RedistRegion *region = &s->redist_regions[i];
 -        memory_region_init_io(&s->iomem_redist[i], OBJECT(s),
 -                              ops ? &ops[1] : NULL, s, name,
 +        region->gic = s;
 +        region->cpuidx = cpuidx;
 +        cpuidx += s->redist_region_count[i];
 +
 +        memory_region_init_io(&region->iomem, OBJECT(s),
 +                              ops ? &ops[1] : NULL, region, name,
                                s->redist_region_count[i] * GICV3_REDIST_SIZE);
 -        sysbus_init_mmio(sbd, &s->iomem_redist[i]);
 +        sysbus_init_mmio(sbd, &region->iomem);
          g_free(name);
      }
  }
 diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_kvm.c
 +++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
                              KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd, 0);
      if (!multiple_redist_region_allowed) {
 -        kvm_arm_register_device(&s->iomem_redist[0], -1,
 +        kvm_arm_register_device(&s->redist_regions[0].iomem, -1,
                                  KVM_DEV_ARM_VGIC_GRP_ADDR,
                                  KVM_VGIC_V3_ADDR_TYPE_REDIST, s->dev_fd, 0);
      } else {
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
              uint64_t addr_ormask =
                          i | ((uint64_t)s->redist_region_count[i] << 52);
 -            kvm_arm_register_device(&s->iomem_redist[i], -1,
 +            kvm_arm_register_device(&s->redist_regions[i].iomem, -1,
                                      KVM_DEV_ARM_VGIC_GRP_ADDR,
                                      KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION,
                                      s->dev_fd, addr_ormask);
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writell(GICv3CPUState *cs, hwaddr offset,
  MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
                                unsigned size, MemTxAttrs attrs)
  {
 -    GICv3State *s = opaque;
 +    GICv3RedistRegion *region = opaque;
 +    GICv3State *s = region->gic;
      GICv3CPUState *cs;
      MemTxResult r;
      int cpuidx;
      assert((offset & (size - 1)) == 0);
 -    /* This region covers all the redistributor pages; there are
 -     * (for GICv3) two 64K pages per CPU. At the moment they are
 -     * all contiguous (ie in this one region), though we might later
 -     * want to allow splitting of redistributor pages into several
 -     * blocks so we can support more CPUs.
 +    /*
 +     * There are (for GICv3) two 64K redistributor pages per CPU.
 +     * In some cases the redistributor pages for all CPUs are not
 +     * contiguous (eg on the virt board they are split into two
 +     * parts if there are too many CPUs to all fit in the same place
 +     * in the memory map); if so then the GIC has multiple MemoryRegions
 +     * for the redistributors.
       */
 -    cpuidx = offset / 0x20000;
 -    offset %= 0x20000;
 -    assert(cpuidx < s->num_cpu);
 +    cpuidx = region->cpuidx + offset / GICV3_REDIST_SIZE;
 +    offset %= GICV3_REDIST_SIZE;
      cs = &s->cpu[cpuidx];
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
  MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                 unsigned size, MemTxAttrs attrs)
  {
 -    GICv3State *s = opaque;
 +    GICv3RedistRegion *region = opaque;
 +    GICv3State *s = region->gic;
      GICv3CPUState *cs;
      MemTxResult r;
      int cpuidx;
      assert((offset & (size - 1)) == 0);
 -    /* This region covers all the redistributor pages; there are
 -     * (for GICv3) two 64K pages per CPU. At the moment they are
 -     * all contiguous (ie in this one region), though we might later
 -     * want to allow splitting of redistributor pages into several
 -     * blocks so we can support more CPUs.
 +    /*
 +     * There are (for GICv3) two 64K redistributor pages per CPU.
 +     * In some cases the redistributor pages for all CPUs are not
 +     * contiguous (eg on the virt board they are split into two
 +     * parts if there are too many CPUs to all fit in the same place
 +     * in the memory map); if so then the GIC has multiple MemoryRegions
 +     * for the redistributors.
       */
 -    cpuidx = offset / 0x20000;
 -    offset %= 0x20000;
 -    assert(cpuidx < s->num_cpu);
 +    cpuidx = region->cpuidx + offset / GICV3_REDIST_SIZE;
 +    offset %= GICV3_REDIST_SIZE;
      cs = &s->cpu[cpuidx];
 --
-.20.1
+.25.1

-[PULL 1/6] hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available
+[PULL 4/4] hw/rtc/pl031: Send RTC_CHANGE QMP event
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
+From: Eric Auger <eric.auger@redhat.com>
-The Orange Pi PC initialization function needs to verify that the SD card
+The PL031 currently is not able to report guest RTC change to the QMP
-block backend is usable before calling the Boot ROM setup routine. When
+monitor as opposed to mc146818 or spapr RTCs. This patch adds the call
-calling blk_is_available() the input parameter should not be NULL.
+to qapi_event_send_rtc_change() when the Load Register is written. The
-This commit ensures that blk_is_available is only called with non-NULL input.
+value which is reported corresponds to the difference between the guest
 reference time and the reference time kept in softmmu/rtc.c.
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
+For instance adding 20s to the guest RTC value will report 20. Adding
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+an extra 20s to the guest RTC value will report 20 + 20 = 40.
-Message-id: 20200322205439.15231-1-nieklinnenbank@gmail.com
 The inclusion of qapi/qapi-types-misc-target.h in hw/rtl/pl031.c
 require to compile the PL031 with specific_ss.add() to avoid
 ./qapi/qapi-types-misc-target.h:18:13: error: attempt to use poisoned
 "TARGET_<ARCH>".
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210920122535.269988-1-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/orangepi.c | 2 +-
+ hw/rtc/pl031.c     | 10 +++++++++-
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/rtc/meson.build |  2 +-
 files changed, 10 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
+diff --git a/hw/rtc/pl031.c b/hw/rtc/pl031.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/orangepi.c
+--- a/hw/rtc/pl031.c
-+++ b/hw/arm/orangepi.c
++++ b/hw/rtc/pl031.c
-@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@
-                                 machine->ram);
+ #include "qemu/log.h"
+ #include "qemu/module.h"
-     /* Load target kernel or start using BootROM */
+ #include "trace.h"
--    if (!machine->kernel_filename && blk_is_available(blk)) {
++#include "qapi/qapi-events-misc-target.h"
-+    if (!machine->kernel_filename && blk && blk_is_available(blk)) {
-         /* Use Boot ROM to copy data from SD card to SRAM */
+ #define RTC_DR      0x00    /* Data read register */
-         allwinner_h3_bootrom_setup(h3, blk);
+ #define RTC_MR      0x04    /* Match register */
-     }
+@@ -XXX,XX +XXX,XX @@ static void pl031_write(void * opaque, hwaddr offset,
      trace_pl031_write(offset, value);
      switch (offset) {
 -    case RTC_LR:
 +    case RTC_LR: {
 +        struct tm tm;
 +
          s->tick_offset += value - pl031_get_count(s);
 +
 +        qemu_get_timedate(&tm, s->tick_offset);
 +        qapi_event_send_rtc_change(qemu_timedate_diff(&tm));
 +
          pl031_set_alarm(s);
          break;
 +    }
      case RTC_MR:
          s->mr = value;
          pl031_set_alarm(s);
 diff --git a/hw/rtc/meson.build b/hw/rtc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/meson.build
 +++ b/hw/rtc/meson.build
@@ -XXX,XX +XXX,XX @@
  softmmu_ss.add(when: 'CONFIG_DS1338', if_true: files('ds1338.c'))
  softmmu_ss.add(when: 'CONFIG_M41T80', if_true: files('m41t80.c'))
  softmmu_ss.add(when: 'CONFIG_M48T59', if_true: files('m48t59.c'))
 -softmmu_ss.add(when: 'CONFIG_PL031', if_true: files('pl031.c'))
 +specific_ss.add(when: 'CONFIG_PL031', if_true: files('pl031.c'))
  softmmu_ss.add(when: 'CONFIG_TWL92230', if_true: files('twl92230.c'))
  softmmu_ss.add(when: ['CONFIG_ISA_BUS', 'CONFIG_M48T59'], if_true: files('m48t59-isa.c'))
  softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP', if_true: files('xlnx-zynqmp-rtc.c'))
 --
-.20.1
+.25.1

-[PULL 2/6] hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address
+Deleted patch
-From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The allwinner_h3_dramc_map_rows function simulates row addressing behavior
-when bootloader software attempts to detect the amount of available SDRAM.
-Currently the line that calculates the 64-bit address of the mirrored row
-uses a signed 32-bit multiply operation that in theory could result in the
-upper 32-bit be all 1s. This commit ensures that the row mirror address
-is calculated using only 64-bit operations.
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Message-id: 20200323192944.5967-1-nieklinnenbank@gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/allwinner-h3-dramc.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/allwinner-h3-dramc.c
-+++ b/hw/misc/allwinner-h3-dramc.c
-@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,
-     } else if (row_bits_actual) {
-         /* Row bits not matching ram_size, install the rows mirror */
--        hwaddr row_mirror = s->ram_addr + ((1 << (row_bits_actual +
--                                                  bank_bits)) * page_size);
-+        hwaddr row_mirror = s->ram_addr + ((1ULL << (row_bits_actual +
-+                                                     bank_bits)) * page_size);
-         memory_region_set_enabled(&s->row_mirror_alias, true);
-         memory_region_set_address(&s->row_mirror_alias, row_mirror);
---
-.20.1

-[PULL 4/6] hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path
+Deleted patch
-In xlnx_zynqmp_realize() if the attempt to realize the SD
-controller object fails then the error-return path will leak
-the 'bus_name' string. Fix this by deferring the allocation
-until after the realize has succeeded.
-Fixes: Coverity CID 1421911
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20200324134947.15384-2-peter.maydell@linaro.org
----
- hw/arm/xlnx-zynqmp.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]);
-     for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) {
--        char *bus_name = g_strdup_printf("sd-bus%d", i);
-+        char *bus_name;
-         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]);
-         Object *sdhci = OBJECT(&s->sdhci[i]);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-         sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]);
-         /* Alias controller SD bus to the SoC itself */
-+        bus_name = g_strdup_printf("sd-bus%d", i);
-         object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus",
-                                   &error_abort);
-         g_free(bus_name);
---
-.20.1

A handful of bugfixes before rc1 tomorrow...

thanks
-- PMM

The following changes since commit f9fe8450fa7cdc6268e05c93fa258f583f4514b7:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-30 11:32:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200330

for you to fetch changes up to 88828bf133b64b7a860c166af3423ef1a47c5d3b:

target/arm: fix incorrect current EL bug in aarch32 exception emulation (2020-03-30 13:55:32 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available
 * hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address
 * docs/conf.py: Raise ConfigError for bad Sphinx Python version
 * hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path
 * hw/arm/xlnx-zynqmp.c: Add missing error-propagation code
 * target/arm: fix incorrect current EL bug in aarch32 exception emulation

----------------------------------------------------------------
Changbin Du (1):
      target/arm: fix incorrect current EL bug in aarch32 exception emulation

Niek Linnenbank (2):
      hw/arm/orangepi: check for potential NULL pointer when calling blk_is_available
      hw/misc/allwinner-h3-dramc: enforce 64-bit multiply when calculating row mirror address

Peter Maydell (3):
      docs/conf.py: Raise ConfigError for bad Sphinx Python version
      hw/arm/xlnx-zynqmp.c: Avoid memory leak in error-return path
      hw/arm/xlnx-zynqmp.c: Add missing error-propagation code

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Orange Pi PC initialization function needs to verify that the SD card
block backend is usable before calling the Boot ROM setup routine. When
calling blk_is_available() the input parameter should not be NULL.
This commit ensures that blk_is_available is only called with non-NULL input.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Message-id: 20200322205439.15231-1-nieklinnenbank@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/orangepi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
                                 machine->ram);
 
     /* Load target kernel or start using BootROM */
-    if (!machine->kernel_filename && blk_is_available(blk)) {
+    if (!machine->kernel_filename && blk && blk_is_available(blk)) {
         /* Use Boot ROM to copy data from SD card to SRAM */
         allwinner_h3_bootrom_setup(h3, blk);
     }
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The allwinner_h3_dramc_map_rows function simulates row addressing behavior
when bootloader software attempts to detect the amount of available SDRAM.

Currently the line that calculates the 64-bit address of the mirrored row
uses a signed 32-bit multiply operation that in theory could result in the
upper 32-bit be all 1s. This commit ensures that the row mirror address
is calculated using only 64-bit operations.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Message-id: 20200323192944.5967-1-nieklinnenbank@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/allwinner-h3-dramc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/allwinner-h3-dramc.c
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,
 
     } else if (row_bits_actual) {
         /* Row bits not matching ram_size, install the rows mirror */
-        hwaddr row_mirror = s->ram_addr + ((1 << (row_bits_actual +
-                                                  bank_bits)) * page_size);
+        hwaddr row_mirror = s->ram_addr + ((1ULL << (row_bits_actual +
+                                                     bank_bits)) * page_size);
 
         memory_region_set_enabled(&s->row_mirror_alias, true);
         memory_region_set_address(&s->row_mirror_alias, row_mirror);
-- 
2.20.1

Raise ConfigError rather than VersionRequirementError when we detect
that the Python being used by Sphinx is too old.

Currently the way we flag the Python version problem up to the user
causes Sphinx to print an unnecessary Python stack trace as well as
the information about the problem; in most versions of Sphinx this is
unavoidable.

The upstream Sphinx developers kindly added a feature to allow
conf.py to report errors to the user without the backtrace:
  https://github.com/sphinx-doc/sphinx/commit/be608ca2313fc08eb842f3dc19d0f5d2d8227d08
but the exception type they chose for this was ConfigError.

Switch to ConfigError, which won't make any difference with currently
deployed Sphinx versions, but will be prettier one day when the user
is using a Sphinx version with the new feature.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20200313163616.30674-1-peter.maydell@linaro.org
---
 docs/conf.py | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 import os
 import sys
 import sphinx
-from sphinx.errors import VersionRequirementError
+from sphinx.errors import ConfigError
 
 # Make Sphinx fail cleanly if using an old Python, rather than obscurely
 # failing because some code in one of our extensions doesn't work there.
-# Unfortunately this doesn't display very neatly (there's an unavoidable
-# Python backtrace) but at least the information gets printed...
+# In newer versions of Sphinx this will display nicely; in older versions
+# Sphinx will also produce a Python backtrace but at least the information
+# gets printed...
 if sys.version_info < (3,5):
-    raise VersionRequirementError(
+    raise ConfigError(
         "QEMU requires a Sphinx that uses Python 3.5 or better\n")
 
 # The per-manual conf.py will set qemu_docdir for a single-manual build;
-- 
2.20.1

In xlnx_zynqmp_realize() if the attempt to realize the SD
controller object fails then the error-return path will leak
the 'bus_name' string. Fix this by deferring the allocation
until after the realize has succeeded.

Fixes: Coverity CID 1421911
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200324134947.15384-2-peter.maydell@linaro.org
---
 hw/arm/xlnx-zynqmp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) {
-        char *bus_name = g_strdup_printf("sd-bus%d", i);
+        char *bus_name;
         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]);
         Object *sdhci = OBJECT(&s->sdhci[i]);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         sysbus_connect_irq(sbd, 0, gic_spi[sdhci_intr[i]]);
 
         /* Alias controller SD bus to the SoC itself */
+        bus_name = g_strdup_printf("sd-bus%d", i);
         object_property_add_alias(OBJECT(s), bus_name, sdhci, "sd-bus",
                                   &error_abort);
         g_free(bus_name);
-- 
2.20.1

In some places in xlnx_zynqmp_realize() we were putting an
error into our local Error*, but forgetting to check for
failure and pass it back to the caller. Add the missing code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200324134947.15384-3-peter.maydell@linaro.org
---
 hw/arm/xlnx-zynqmp.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          * - eMMC Specification Version 4.51
          */
         object_property_set_uint(sdhci, 3, "sd-spec-version", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
         object_property_set_uint(sdhci, SDHCI_CAPABILITIES, "capareg", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
         object_property_set_uint(sdhci, UHS_I, "uhs", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
         object_property_set_bool(sdhci, true, "realized", &err);
         if (err) {
             error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         gchar *bus_name;
 
         object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0, spi_addr[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     }
 
     object_property_set_bool(OBJECT(&s->qspi), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 0, QSPI_ADDR);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi), 1, LQSPI_ADDR);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->qspi), 0, gic_spi[QSPI_IRQ]);
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
         object_property_set_uint(OBJECT(&s->gdma[i]), 128, "bus-width", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
         object_property_set_bool(OBJECT(&s->gdma[i]), true, "realized", &err);
         if (err) {
             error_propagate(errp, err);
-- 
2.20.1

From: Changbin Du <changbin.du@gmail.com>

The arm_current_el() should be invoked after mode switching. Otherwise, we
get a wrong current EL value, since current EL is also determined by
current mode.

Fixes: 4a2696c0d4 ("target/arm: Set PAN bit as required on exception entry")
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200328140232.17278-1-changbin.du@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
 
     /* Change the CPU state so as to actually take the exception. */
     switch_mode(env, new_mode);
-    new_el = arm_current_el(env);
 
     /*
      * For exceptions taken to AArch32 we must clear the SS bit in both
@@ -XXX,XX +XXX,XX @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
     env->condexec_bits = 0;
     /* Switch to the new mode, and to the correct instruction set.  */
     env->uncached_cpsr = (env->uncached_cpsr & ~CPSR_M) | new_mode;
+
+    /* This must be after mode switching. */
+    new_el = arm_current_el(env);
+
     /* Set new mode endianness */
     env->uncached_cpsr &= ~CPSR_E;
     if (env->cp15.sctlr_el[new_el] & SCTLR_EE) {
-- 
2.20.1

Hi; some minor changes for 6.2, which I think can be classified
as bug fixes and are OK for this point in the release cycle.
(Wouldn't be the end of the world if they slipped to 7.0.)

-- PMM

The following changes since commit 42f6c9179be4401974dd3a75ee72defd16b5092d:

Merge tag 'pull-ppc-20211112' of https://github.com/legoater/qemu into staging (2021-11-12 12:28:25 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211115-1

for you to fetch changes up to 1adf528ec3bdf62ea3b580b7ad562534a3676ff5:

hw/rtc/pl031: Send RTC_CHANGE QMP event (2021-11-15 18:53:00 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support multiple redistributor regions for TCG GICv3
 * Send RTC_CHANGE QMP event from pl031

----------------------------------------------------------------
Eric Auger (1):
      hw/rtc/pl031: Send RTC_CHANGE QMP event

Peter Maydell (3):
      hw/intc/arm_gicv3: Move checking of redist-region-count to arm_gicv3_common_realize
      hw/intc/arm_gicv3: Set GICR_TYPER.Last correctly when nb_redist_regions > 1
      hw/intc/arm_gicv3: Support multiple redistributor regions

include/hw/intc/arm_gicv3_common.h | 14 ++++++++--
 hw/intc/arm_gicv3.c                | 12 +-------
 hw/intc/arm_gicv3_common.c         | 56 ++++++++++++++++++++++++--------------
 hw/intc/arm_gicv3_kvm.c            | 10 ++-----
 hw/intc/arm_gicv3_redist.c         | 40 +++++++++++++++------------
 hw/rtc/pl031.c                     | 10 ++++++-
 hw/rtc/meson.build                 |  2 +-
 7 files changed, 83 insertions(+), 61 deletions(-)

The GICv3 devices have an array property redist-region-count.
Currently we check this for errors (bad values) in
gicv3_init_irqs_and_mmio(), just before we use it.  Move this error
checking to the arm_gicv3_common_realize() function, where we
sanity-check all of the other base-class properties. (This will
always be before gicv3_init_irqs_and_mmio() is called, because
that function is called in the subclass realize methods, after
they have called the parent-class realize.)

The motivation for this refactor is:
 * we would like to use the redist_region_count[] values in
   arm_gicv3_common_realize() in a subsequent patch, so we need
   to have already done the sanity-checking first
 * this removes the only use of the Error** argument to
   gicv3_init_irqs_and_mmio(), so we can remove some error-handling
   boilerplate

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/intc/arm_gicv3_common.h |  2 +-
 hw/intc/arm_gicv3.c                |  6 +-----
 hw/intc/arm_gicv3_common.c         | 26 +++++++++++++-------------
 hw/intc/arm_gicv3_kvm.c            |  6 +-----
 4 files changed, 16 insertions(+), 24 deletions(-)

diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct ARMGICv3CommonClass {
 };
 
 void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
-                              const MemoryRegionOps *ops, Error **errp);
+                              const MemoryRegionOps *ops);
 
 #endif
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
+    gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
 
     gicv3_init_cpuif(s);
 }
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
 };
 
 void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
-                              const MemoryRegionOps *ops, Error **errp)
+                              const MemoryRegionOps *ops)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(s);
-    int rdist_capacity = 0;
     int i;
 
-    for (i = 0; i < s->nb_redist_regions; i++) {
-        rdist_capacity += s->redist_region_count[i];
-    }
-    if (rdist_capacity < s->num_cpu) {
-        error_setg(errp, "Capacity of the redist regions(%d) "
-                   "is less than number of vcpus(%d)",
-                   rdist_capacity, s->num_cpu);
-        return;
-    }
-
     /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
      * GPIO array layout is thus:
      *  [0..N-1] spi
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
 static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
 {
     GICv3State *s = ARM_GICV3_COMMON(dev);
-    int i;
+    int i, rdist_capacity;
 
     /* revision property is actually reserved and currently used only in order
      * to keep the interface compatible with GICv2 code, avoiding extra
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    rdist_capacity = 0;
+    for (i = 0; i < s->nb_redist_regions; i++) {
+        rdist_capacity += s->redist_region_count[i];
+    }
+    if (rdist_capacity < s->num_cpu) {
+        error_setg(errp, "Capacity of the redist regions(%d) "
+                   "is less than number of vcpus(%d)",
+                   rdist_capacity, s->num_cpu);
+        return;
+    }
+
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
+    gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL);
 
     for (i = 0; i < s->num_cpu; i++) {
         ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
-- 
2.25.1

The 'Last' bit in the GICR_TYPER GICv3 redistributor register is
supposed to be set to 1 if this is the last redistributor in a series
of contiguous redistributor pages.  Currently we set Last only for
the redistributor for CPU (num_cpu - 1).  This only works if there is
a single redistributor region; if there are multiple redistributor
regions then we need to set the Last bit for the last redistributor
in each region.

This doesn't cause any problems currently because only the KVM GICv3
supports multiple redistributor regions, and it ignores the value in
GICv3State::gicr_typer.  But we need to fix this before we can enable
support for multiple regions in the emulated GICv3.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/intc/arm_gicv3_common.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
 static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
 {
     GICv3State *s = ARM_GICV3_COMMON(dev);
-    int i, rdist_capacity;
+    int i, rdist_capacity, cpuidx;
 
     /* revision property is actually reserved and currently used only in order
      * to keep the interface compatible with GICv2 code, avoiding extra
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < s->num_cpu; i++) {
         CPUState *cpu = qemu_get_cpu(i);
         uint64_t cpu_affid;
-        int last;
 
         s->cpu[i].cpu = cpu;
         s->cpu[i].gic = s;
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
          *  PLPIS == 0 (physical LPIs not supported)
          */
         cpu_affid = object_property_get_uint(OBJECT(cpu), "mp-affinity", NULL);
-        last = (i == s->num_cpu - 1);
 
         /* The CPU mp-affinity property is in MPIDR register format; squash
          * the affinity bytes into 32 bits as the GICR_TYPER has them.
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
                      (cpu_affid & 0xFFFFFF);
         s->cpu[i].gicr_typer = (cpu_affid << 32) |
             (1 << 24) |
-            (i << 8) |
-            (last << 4);
+            (i << 8);
 
         if (s->lpi_enable) {
             s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
         }
     }
+
+    /*
+     * Now go through and set GICR_TYPER.Last for the final
+     * redistributor in each region.
+     */
+    cpuidx = 0;
+    for (i = 0; i < s->nb_redist_regions; i++) {
+        cpuidx += s->redist_region_count[i];
+        s->cpu[cpuidx - 1].gicr_typer |= GICR_TYPER_LAST;
+    }
 }
 
 static void arm_gicv3_finalize(Object *obj)
-- 
2.25.1

Our GICv3 QOM interface includes an array property
redist-region-count which allows board models to specify that the
registributor registers are not in a single contiguous range, but
split into multiple pieces.  We implemented this for KVM, but
currently the TCG GICv3 model insists that there is only one region.
You can see the limit being hit with a setup like:
  qemu-system-aarch64 -machine virt,gic-version=3 -smp 124

Add support for split regions to the TCG GICv3.  To do this we switch
from allocating a simple array of MemoryRegions to an array of
GICv3RedistRegion structs so that we can use the GICv3RedistRegion as
the opaque pointer in the MemoryRegion read/write callbacks.  Each
GICv3RedistRegion contains the MemoryRegion, a backpointer allowing
the read/write callback to get hold of the GICv3State, and an index
which allows us to calculate which CPU's redistributor is being
accessed.

Note that arm_gicv3_kvm always passes in NULL as the ops argument
to gicv3_init_irqs_and_mmio(), so the only MemoryRegion read/write
callbacks we need to update to handle this new scheme are the
gicv3_redist_read/write functions used by the emulated GICv3.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/intc/arm_gicv3_common.h | 12 ++++++++-
 hw/intc/arm_gicv3.c                |  6 -----
 hw/intc/arm_gicv3_common.c         | 15 ++++++++---
 hw/intc/arm_gicv3_kvm.c            |  4 +--
 hw/intc/arm_gicv3_redist.c         | 40 ++++++++++++++++--------------
 5 files changed, 46 insertions(+), 31 deletions(-)

diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
     bool seenbetter;
 };
 
+/*
+ * The redistributor pages might be split into more than one region
+ * on some machine types if there are many CPUs.
+ */
+typedef struct GICv3RedistRegion {
+    GICv3State *gic;
+    MemoryRegion iomem;
+    uint32_t cpuidx; /* index of first CPU this region covers */
+} GICv3RedistRegion;
+
 struct GICv3State {
     /*< private >*/
     SysBusDevice parent_obj;
     /*< public >*/
 
     MemoryRegion iomem_dist; /* Distributor */
-    MemoryRegion *iomem_redist; /* Redistributor Regions */
+    GICv3RedistRegion *redist_regions; /* Redistributor Regions */
     uint32_t *redist_region_count; /* redistributor count within each region */
     uint32_t nb_redist_regions; /* number of redist regions */
 
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    if (s->nb_redist_regions != 1) {
-        error_setg(errp, "VGICv3 redist region number(%d) not equal to 1",
-                   s->nb_redist_regions);
-        return;
-    }
-
     gicv3_init_irqs_and_mmio(s, gicv3_set_irq, gic_ops);
 
     gicv3_init_cpuif(s);
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(s);
     int i;
+    int cpuidx;
 
     /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU.
      * GPIO array layout is thus:
@@ -XXX,XX +XXX,XX @@ void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
                           "gicv3_dist", 0x10000);
     sysbus_init_mmio(sbd, &s->iomem_dist);
 
-    s->iomem_redist = g_new0(MemoryRegion, s->nb_redist_regions);
+    s->redist_regions = g_new0(GICv3RedistRegion, s->nb_redist_regions);
+    cpuidx = 0;
     for (i = 0; i < s->nb_redist_regions; i++) {
         char *name = g_strdup_printf("gicv3_redist_region[%d]", i);
+        GICv3RedistRegion *region = &s->redist_regions[i];
 
-        memory_region_init_io(&s->iomem_redist[i], OBJECT(s),
-                              ops ? &ops[1] : NULL, s, name,
+        region->gic = s;
+        region->cpuidx = cpuidx;
+        cpuidx += s->redist_region_count[i];
+
+        memory_region_init_io(&region->iomem, OBJECT(s),
+                              ops ? &ops[1] : NULL, region, name,
                               s->redist_region_count[i] * GICV3_REDIST_SIZE);
-        sysbus_init_mmio(sbd, &s->iomem_redist[i]);
+        sysbus_init_mmio(sbd, &region->iomem);
         g_free(name);
     }
 }
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
                             KVM_VGIC_V3_ADDR_TYPE_DIST, s->dev_fd, 0);
 
     if (!multiple_redist_region_allowed) {
-        kvm_arm_register_device(&s->iomem_redist[0], -1,
+        kvm_arm_register_device(&s->redist_regions[0].iomem, -1,
                                 KVM_DEV_ARM_VGIC_GRP_ADDR,
                                 KVM_VGIC_V3_ADDR_TYPE_REDIST, s->dev_fd, 0);
     } else {
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
             uint64_t addr_ormask =
                         i | ((uint64_t)s->redist_region_count[i] << 52);
 
-            kvm_arm_register_device(&s->iomem_redist[i], -1,
+            kvm_arm_register_device(&s->redist_regions[i].iomem, -1,
                                     KVM_DEV_ARM_VGIC_GRP_ADDR,
                                     KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION,
                                     s->dev_fd, addr_ormask);
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writell(GICv3CPUState *cs, hwaddr offset,
 MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
                               unsigned size, MemTxAttrs attrs)
 {
-    GICv3State *s = opaque;
+    GICv3RedistRegion *region = opaque;
+    GICv3State *s = region->gic;
     GICv3CPUState *cs;
     MemTxResult r;
     int cpuidx;
 
     assert((offset & (size - 1)) == 0);
 
-    /* This region covers all the redistributor pages; there are
-     * (for GICv3) two 64K pages per CPU. At the moment they are
-     * all contiguous (ie in this one region), though we might later
-     * want to allow splitting of redistributor pages into several
-     * blocks so we can support more CPUs.
+    /*
+     * There are (for GICv3) two 64K redistributor pages per CPU.
+     * In some cases the redistributor pages for all CPUs are not
+     * contiguous (eg on the virt board they are split into two
+     * parts if there are too many CPUs to all fit in the same place
+     * in the memory map); if so then the GIC has multiple MemoryRegions
+     * for the redistributors.
      */
-    cpuidx = offset / 0x20000;
-    offset %= 0x20000;
-    assert(cpuidx < s->num_cpu);
+    cpuidx = region->cpuidx + offset / GICV3_REDIST_SIZE;
+    offset %= GICV3_REDIST_SIZE;
 
     cs = &s->cpu[cpuidx];
 
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
 MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                unsigned size, MemTxAttrs attrs)
 {
-    GICv3State *s = opaque;
+    GICv3RedistRegion *region = opaque;
+    GICv3State *s = region->gic;
     GICv3CPUState *cs;
     MemTxResult r;
     int cpuidx;
 
     assert((offset & (size - 1)) == 0);
 
-    /* This region covers all the redistributor pages; there are
-     * (for GICv3) two 64K pages per CPU. At the moment they are
-     * all contiguous (ie in this one region), though we might later
-     * want to allow splitting of redistributor pages into several
-     * blocks so we can support more CPUs.
+    /*
+     * There are (for GICv3) two 64K redistributor pages per CPU.
+     * In some cases the redistributor pages for all CPUs are not
+     * contiguous (eg on the virt board they are split into two
+     * parts if there are too many CPUs to all fit in the same place
+     * in the memory map); if so then the GIC has multiple MemoryRegions
+     * for the redistributors.
      */
-    cpuidx = offset / 0x20000;
-    offset %= 0x20000;
-    assert(cpuidx < s->num_cpu);
+    cpuidx = region->cpuidx + offset / GICV3_REDIST_SIZE;
+    offset %= GICV3_REDIST_SIZE;
 
     cs = &s->cpu[cpuidx];
 
-- 
2.25.1

From: Eric Auger <eric.auger@redhat.com>

The PL031 currently is not able to report guest RTC change to the QMP
monitor as opposed to mc146818 or spapr RTCs. This patch adds the call
to qapi_event_send_rtc_change() when the Load Register is written. The
value which is reported corresponds to the difference between the guest
reference time and the reference time kept in softmmu/rtc.c.

For instance adding 20s to the guest RTC value will report 20. Adding
an extra 20s to the guest RTC value will report 20 + 20 = 40.

The inclusion of qapi/qapi-types-misc-target.h in hw/rtl/pl031.c
require to compile the PL031 with specific_ss.add() to avoid
./qapi/qapi-types-misc-target.h:18:13: error: attempt to use poisoned
"TARGET_<ARCH>".

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210920122535.269988-1-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/rtc/pl031.c     | 10 +++++++++-
 hw/rtc/meson.build |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/rtc/pl031.c b/hw/rtc/pl031.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/pl031.c
+++ b/hw/rtc/pl031.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "trace.h"
+#include "qapi/qapi-events-misc-target.h"
 
 #define RTC_DR      0x00    /* Data read register */
 #define RTC_MR      0x04    /* Match register */
@@ -XXX,XX +XXX,XX @@ static void pl031_write(void * opaque, hwaddr offset,
     trace_pl031_write(offset, value);
 
     switch (offset) {
-    case RTC_LR:
+    case RTC_LR: {
+        struct tm tm;
+
         s->tick_offset += value - pl031_get_count(s);
+
+        qemu_get_timedate(&tm, s->tick_offset);
+        qapi_event_send_rtc_change(qemu_timedate_diff(&tm));
+
         pl031_set_alarm(s);
         break;
+    }
     case RTC_MR:
         s->mr = value;
         pl031_set_alarm(s);
diff --git a/hw/rtc/meson.build b/hw/rtc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/meson.build
+++ b/hw/rtc/meson.build
@@ -XXX,XX +XXX,XX @@
 softmmu_ss.add(when: 'CONFIG_DS1338', if_true: files('ds1338.c'))
 softmmu_ss.add(when: 'CONFIG_M41T80', if_true: files('m41t80.c'))
 softmmu_ss.add(when: 'CONFIG_M48T59', if_true: files('m48t59.c'))
-softmmu_ss.add(when: 'CONFIG_PL031', if_true: files('pl031.c'))
+specific_ss.add(when: 'CONFIG_PL031', if_true: files('pl031.c'))
 softmmu_ss.add(when: 'CONFIG_TWL92230', if_true: files('twl92230.c'))
 softmmu_ss.add(when: ['CONFIG_ISA_BUS', 'CONFIG_M48T59'], if_true: files('m48t59-isa.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP', if_true: files('xlnx-zynqmp-rtc.c'))
-- 
2.25.1