Series comparison

-[PULL 00/25] target-arm queue
+[PULL 0/8] target-arm queue
-Last lot of target-arm changes to squeeze in before rc1:
+Handful of bugfixes for rc2. None of these are particularly critical
- * various minor Arm bug fixes
+or exciting.
  * David Carlier's Haiku build portability fixes
  * Wentong Wu's fixes for icount handling in the nios2 target
-The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:
+-- PMM
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)
+The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345:
   Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803
-for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:
+for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8:
-  hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)
+  hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/bcm2836: Remove unused 'cpu_type' field
+ * hw/timer/imx_epit: Avoid assertion when CR.SWR is written
- * target/arm: Fix mtedesc for do_mem_zpz
+ * netduino2, netduinoplus2, microbit: set system_clock_scale so that
- * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
+   SysTick running on the CPU clock works
- * target/arm: Don't do raw writes for PMINTENCLR
+ * target/arm: Avoid maybe-uninitialized warning with gcc 4.9
- * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+ * target/arm: Fix AddPAC error indication
- * build: Fix various issues with building on Haiku
+ * Make AIRCR.SYSRESETREQ actually reset the system for the
- * target/nios2: fix wrctl behaviour when using icount
+   microbit, mps2-*, musca-*, netduino* boards
  * hw/arm/tosa: Encapsulate misc GPIO handling in a device
  * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
  * hw/arm/aspeed: Do not create and attach empty SD cards by default
 ----------------------------------------------------------------
-Aaron Lindsay (1):
+Kaige Li (1):
-      target/arm: Don't do raw writes for PMINTENCLR
+      target/arm: Avoid maybe-uninitialized warning with gcc 4.9
-David CARLIER (8):
+Peter Maydell (6):
-      build: Enable BSD symbols for Haiku
+      hw/arm/netduino2, netduinoplus2: Set system_clock_scale
-      util/qemu-openpty.c: Don't assume pty.h is glibc-only
+      include/hw/irq.h: New function qemu_irq_is_connected()
-      build: Check that mlockall() exists
+      hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
-      osdep.h: Always include <sys/signal.h> if it exists
+      msf2-soc, stellaris: Don't wire up SYSRESETREQ
-      osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
+      hw/arm/nrf51_soc: Set system_clock_scale
-      bswap.h: Include <endian.h> on Haiku for bswap operations
+      hw/timer/imx_epit: Avoid assertion when CR.SWR is written
       util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
       util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
 Eric Auger (1):
       virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
 Gerd Hoffmann (1):
       util/drm: make portable by avoiding struct dirent d_type
 Jean-Christophe Dubois (3):
       Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
       Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
       Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
 Peter Maydell (4):
       hw/arm/tosa.c: Detabify
       hw/arm/tosa: Encapsulate misc GPIO handling in a device
       hw/arm/palm.c: Detabify
       hw/arm/palm.c: Encapsulate misc GPIO handling in a device
 Philippe Mathieu-Daudé (2):
       hw/arm/bcm2836: Remove unused 'cpu_type' field
       hw/arm/aspeed: Do not create and attach empty SD cards by default
 Richard Henderson (1):
-      target/arm: Fix mtedesc for do_mem_zpz
+      target/arm: Fix AddPAC error indication
-Wentong Wu (4):
+ include/hw/arm/armv7m.h           |  4 +++-
-      target/nios2: add DISAS_NORETURN case for nothing more to generate
+ include/hw/irq.h                  | 18 ++++++++++++++++++
-      target/nios2: in line the semantics of DISAS_UPDATE with other targets
+ hw/arm/msf2-soc.c                 | 11 -----------
-      target/nios2: Use gen_io_start around wrctl instruction
+ hw/arm/netduino2.c                | 10 ++++++++++
-      hw/nios2: exit to main CPU loop only when unmasking interrupts
+ hw/arm/netduinoplus2.c            | 10 ++++++++++
  hw/arm/nrf51_soc.c                |  5 +++++
  hw/arm/stellaris.c                | 12 ------------
  hw/intc/armv7m_nvic.c             | 17 ++++++++++++++++-
  hw/timer/imx_epit.c               | 13 ++++++++++---
  target/arm/pauth_helper.c         |  6 +++++-
  target/arm/translate-a64.c        |  2 +-
  tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 112 insertions(+), 31 deletions(-)
  create mode 100644 tests/tcg/aarch64/pauth-5.c
- configure                   |  38 ++++++++++++-
- include/hw/arm/bcm2836.h    |   1 -
- include/hw/arm/fsl-imx25.h  |   1 +
- include/hw/arm/fsl-imx6.h   |   1 +
- include/hw/arm/fsl-imx7.h   |   1 +
- include/qemu/bswap.h        |   2 +
- include/qemu/osdep.h        |   6 +-
- hw/arm/aspeed.c             |   9 +--
- hw/arm/fsl-imx25.c          |   7 +++
- hw/arm/fsl-imx6.c           |   7 +++
- hw/arm/fsl-imx7.c           |   9 +++
- hw/arm/palm.c               | 111 +++++++++++++++++++++++++------------
- hw/arm/tosa.c               | 132 +++++++++++++++++++++++++++++---------------
- hw/nios2/cpu_pic.c          |   3 +-
- hw/virtio/virtio-iommu.c    |   1 +
- hw/xen/xen-legacy-backend.c |   1 -
- os-posix.c                  |   4 ++
- target/arm/helper.c         |   4 +-
- target/arm/translate-sve.c  |   2 +-
- target/nios2/translate.c    |  12 +++-
- util/compatfd.c             |   2 +
- util/drm.c                  |  19 +++++--
- util/oslib-posix.c          |  20 ++++++-
- util/qemu-openpty.c         |   2 +-
-files changed, 292 insertions(+), 103 deletions(-)

-[PULL 01/25] hw/arm/bcm2836: Remove unused 'cpu_type' field
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The 'cpu_type' has been moved from BCM283XState to BCM283XClass
-in commit 210f47840d, but we forgot to remove the old variable.
-Do it now.
-Fixes: 210f47840d ("hw/arm/bcm2836: Hardcode correct CPU type")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20200703200459.23294-1-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/bcm2836.h | 1 -
-file changed, 1 deletion(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
-+++ b/include/hw/arm/bcm2836.h
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
-     DeviceState parent_obj;
-     /*< public >*/
--    char *cpu_type;
-     uint32_t enabled_cpus;
-     struct {
---
-.20.1

-[PULL 25/25] hw/arm/aspeed: Do not create and attach empty SD cards by default
+[PULL 1/8] hw/arm/netduino2, netduinoplus2: Set system_clock_scale
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale
 global, which meant that if guest code used the systick timer in "use
 the processor clock" mode it would hang because time never advances.
-Since added in commit 2bea128c3d, each SDHCI is wired with a SD
+Set the global to match the documented CPU clock speed of these boards.
-card, using empty card when no block drive provided. This is not
+Judging by the data sheet this is slightly simplistic because the
-the desired behavior. The SDHCI exposes a SD bus to plug cards
+SoC allows configuration of the SYSCLK source and frequency via the
-on, if no card available, it is fine to have an unplugged bus.
+RCC (reset and clock control) module, but we don't model that.
-Avoid creating unnecessary SD card device when no block drive
+Fixes: https://bugs.launchpad.net/qemu/+bug/1876187
-provided.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200727162617.26227-1-peter.maydell@linaro.org
 ---
  hw/arm/netduino2.c     | 10 ++++++++++
  hw/arm/netduinoplus2.c | 10 ++++++++++
 files changed, 20 insertions(+)
-Fixes: 2bea128c3d ("hw/sd/aspeed_sdhci: New device")
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200705173402.15620-1-f4bug@amsat.org
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/aspeed.c | 9 +++++----
 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/arm/netduino2.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/arm/netduino2.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
+@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/stm32f205_soc.h"
  #include "hw/arm/boot.h"
 +/* Main SYSCLK frequency in Hz (120MHz) */
 +#define SYSCLK_FRQ 120000000ULL
 +
  static void netduino2_init(MachineState *machine)
  {
-         DeviceState *card;
+     DeviceState *dev;
--        card = qdev_new(TYPE_SD_CARD);
++    /*
--        if (dinfo) {
++     * TODO: ideally we would model the SoC RCC and let it handle
--            qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
++     * system_clock_scale, including its ability to define different
--                                    &error_fatal);
++     * possible SYSCLK sources.
-+        if (!dinfo) {
++     */
-+            return;
++    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
-         }
++
-+        card = qdev_new(TYPE_SD_CARD);
+     dev = qdev_new(TYPE_STM32F205_SOC);
-+        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
+     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));
-+                                &error_fatal);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-         qdev_realize_and_unref(card,
+diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
-                                qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
+index XXXXXXX..XXXXXXX 100644
-                                &error_fatal);
+--- a/hw/arm/netduinoplus2.c
 +++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/stm32f405_soc.h"
  #include "hw/arm/boot.h"
 +/* Main SYSCLK frequency in Hz (168MHz) */
 +#define SYSCLK_FRQ 168000000ULL
 +
  static void netduinoplus2_init(MachineState *machine)
  {
      DeviceState *dev;
 +    /*
 +     * TODO: ideally we would model the SoC RCC and let it handle
 +     * system_clock_scale, including its ability to define different
 +     * possible SYSCLK sources.
 +     */
 +    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 +
      dev = qdev_new(TYPE_STM32F405_SOC);
      qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 --
 .20.1

-[PULL 24/25] hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+[PULL 2/8] include/hw/irq.h: New function qemu_irq_is_connected()
-Replace the free-floating set of IRQs and palmte_onoff_gpios()
+Mostly devices don't need to care whether one of their output
-function with a simple QOM device that encapsulates this
+qemu_irq lines is connected, because functions like qemu_set_irq()
-behaviour.
+silently do nothing if there is nothing on the other end.  However
 sometimes a device might want to implement default behaviour for the
 case where the machine hasn't wired the line up to anywhere.
-This fixes Coverity issue CID 1421944, which points out that
+Provide a function qemu_irq_is_connected() that devices can use for
-the memory returned by qemu_allocate_irqs() is leaked.
+this purpose.  (The test is trivial but encapsulating it in a
 function makes it easier to see where we're doing it in case we need
 to change the implementation later.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628214230.2592-3-peter.maydell@linaro.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 61 +++++++++++++++++++++++++++++++++++++++++++--------
+ include/hw/irq.h | 18 ++++++++++++++++++
-file changed, 52 insertions(+), 9 deletions(-)
+file changed, 18 insertions(+)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/include/hw/irq.h b/include/hw/irq.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/include/hw/irq.h
-+++ b/hw/arm/palm.c
++++ b/include/hw/irq.h
-@@ -XXX,XX +XXX,XX @@ static void palmte_button_event(void *opaque, int keycode)
+@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
-                         !(keycode & 0x80));
+    on an existing vector of qemu_irq.  */
- }
+ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
-+/*
++/**
-+ * Encapsulation of some GPIO line behaviour for the Palm board
++ * qemu_irq_is_connected: Return true if IRQ line is wired up
 + *
-+ * QEMU interface:
++ * If a qemu_irq has a device on the other (receiving) end of it,
-+ *  + unnamed GPIO inputs 0..6: for the various miscellaneous input lines
++ * return true; otherwise return false.
 + *
 + * Usually device models don't need to care whether the machine model
 + * has wired up their outbound qemu_irq lines, because functions like
 + * qemu_set_irq() silently do nothing if there is nothing on the other
 + * end of the line. However occasionally a device model will want to
 + * provide default behaviour if its output is left floating, and
 + * it can use this function to identify when that is the case.
 + */
-+
++static inline bool qemu_irq_is_connected(qemu_irq irq)
 +#define TYPE_PALM_MISC_GPIO "palm-misc-gpio"
 +#define PALM_MISC_GPIO(obj) \
 +    OBJECT_CHECK(PalmMiscGPIOState, (obj), TYPE_PALM_MISC_GPIO)
 +
 +typedef struct PalmMiscGPIOState {
 +    SysBusDevice parent_obj;
 +} PalmMiscGPIOState;
 +
  static void palmte_onoff_gpios(void *opaque, int line, int level)
  {
      switch (line) {
@@ -XXX,XX +XXX,XX @@ static void palmte_onoff_gpios(void *opaque, int line, int level)
      }
  }
 +static void palm_misc_gpio_init(Object *obj)
 +{
-+    DeviceState *dev = DEVICE(obj);
++    return irq != NULL;
 +
 +    qdev_init_gpio_in(dev, palmte_onoff_gpios, 7);
 +}
 +
-+static const TypeInfo palm_misc_gpio_info = {
+ #endif
 +    .name = TYPE_PALM_MISC_GPIO,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(PalmMiscGPIOState),
 +    .instance_init = palm_misc_gpio_init,
 +    /*
 +     * No class init required: device has no internal state so does not
 +     * need to set up reset or vmstate, and has no realize method.
 +     */
 +};
 +
  static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
  {
 -    qemu_irq *misc_gpio;
 +    DeviceState *misc_gpio;
 +
 +    misc_gpio = sysbus_create_simple(TYPE_PALM_MISC_GPIO, -1, NULL);
      omap_mmc_handlers(cpu->mmc,
                      qdev_get_gpio_in(cpu->gpio, PALMTE_MMC_WP_GPIO),
                      qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
                              [PALMTE_MMC_SWITCH_GPIO]));
 -    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
 -    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
 -    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
 -    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
 -    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
 -    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,
 +                          qdev_get_gpio_in(misc_gpio, 0));
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,
 +                          qdev_get_gpio_in(misc_gpio, 1));
 +    qdev_connect_gpio_out(cpu->gpio, 11, qdev_get_gpio_in(misc_gpio, 2));
 +    qdev_connect_gpio_out(cpu->gpio, 12, qdev_get_gpio_in(misc_gpio, 3));
 +    qdev_connect_gpio_out(cpu->gpio, 13, qdev_get_gpio_in(misc_gpio, 4));
 +    omap_mpuio_out_set(cpu->mpuio, 1, qdev_get_gpio_in(misc_gpio, 5));
 +    omap_mpuio_out_set(cpu->mpuio, 3, qdev_get_gpio_in(misc_gpio, 6));
      /* Reset some inputs to initial state.  */
      qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
@@ -XXX,XX +XXX,XX @@ static void palmte_machine_init(MachineClass *mc)
  }
  DEFINE_MACHINE("cheetah", palmte_machine_init)
 +
 +static void palm_register_types(void)
 +{
 +    type_register_static(&palm_misc_gpio_info);
 +}
 +
 +type_init(palm_register_types)
 --
 .20.1

-[PULL 23/25] hw/arm/palm.c: Detabify
+[PULL 3/8] hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
-Remove hard-tabs from palm.c.
+The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals
 when the guest sets the SYSRESETREQ bit in the AIRCR register.  This
 matches the hardware design (where the CPU has a signal of this name
 and it is up to the SoC to connect that up to an actual reset
 mechanism), but in QEMU it mostly results in duplicated code in SoC
 objects and bugs where SoC model implementors forget to wire up the
 SYSRESETREQ line.
 Provide a default behaviour for the case where SYSRESETREQ is not
 actually connected to anything: use qemu_system_reset_request() to
 perform a system reset.  This will allow us to remove the
 implementations of SYSRESETREQ handling from the boards where that's
 exactly what it does, and also fixes the bugs in the board models
 which forgot to wire up the signal:
  * microbit
  * mps2-an385
  * mps2-an505
  * mps2-an511
  * mps2-an521
  * musca-a
  * musca-b1
  * netduino
  * netduinoplus2
 We still allow the board to wire up the signal if it needs to, in case
 we need to model more complicated reset controller logic or to model
 buggy SoC hardware which forgot to wire up the line itself. But
 defaulting to "reset the system" is more often going to be correct
 than defaulting to "do nothing".
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628214230.2592-2-peter.maydell@linaro.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 64 +++++++++++++++++++++++++--------------------------
+ include/hw/arm/armv7m.h |  4 +++-
-file changed, 32 insertions(+), 32 deletions(-)
+ hw/intc/armv7m_nvic.c   | 17 ++++++++++++++++-
 files changed, 19 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/include/hw/arm/armv7m.h
-+++ b/hw/arm/palm.c
++++ b/include/hw/arm/armv7m.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps static_ops = {
+@@ -XXX,XX +XXX,XX @@ typedef struct {
- /* Palm Tunsgten|E support */
+ /* ARMv7M container object.
- /* Shared GPIOs */
+  * + Unnamed GPIO input lines: external IRQ lines for the NVIC
--#define PALMTE_USBDETECT_GPIO    0
+- * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ
--#define PALMTE_USB_OR_DC_GPIO    1
++ * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ.
--#define PALMTE_TSC_GPIO        4
++ *   If this GPIO is not wired up then the NVIC will default to performing
--#define PALMTE_PINTDAV_GPIO    6
++ *   a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET).
--#define PALMTE_MMC_WP_GPIO    8
+  * + Property "cpu-type": CPU type to instantiate
--#define PALMTE_MMC_POWER_GPIO    9
+  * + Property "num-irq": number of external IRQ lines
--#define PALMTE_HDQ_GPIO        11
+  * + Property "memory": MemoryRegion defining the physical address space
--#define PALMTE_HEADPHONES_GPIO    14
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
--#define PALMTE_SPEAKER_GPIO    15
+index XXXXXXX..XXXXXXX 100644
-+#define PALMTE_USBDETECT_GPIO   0
+--- a/hw/intc/armv7m_nvic.c
-+#define PALMTE_USB_OR_DC_GPIO   1
++++ b/hw/intc/armv7m_nvic.c
-+#define PALMTE_TSC_GPIO                 4
+@@ -XXX,XX +XXX,XX @@
-+#define PALMTE_PINTDAV_GPIO     6
+ #include "hw/intc/armv7m_nvic.h"
-+#define PALMTE_MMC_WP_GPIO      8
+ #include "hw/irq.h"
-+#define PALMTE_MMC_POWER_GPIO   9
+ #include "hw/qdev-properties.h"
-+#define PALMTE_HDQ_GPIO                 11
++#include "sysemu/runstate.h"
-+#define PALMTE_HEADPHONES_GPIO  14
+ #include "target/arm/cpu.h"
-+#define PALMTE_SPEAKER_GPIO     15
+ #include "exec/exec-all.h"
- /* MPU private GPIOs */
+ #include "exec/memop.h"
--#define PALMTE_DC_GPIO        2
+@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
--#define PALMTE_MMC_SWITCH_GPIO    4
+x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
 -#define PALMTE_MMC1_GPIO    6
 -#define PALMTE_MMC2_GPIO    7
 -#define PALMTE_MMC3_GPIO    11
 +#define PALMTE_DC_GPIO          2
 +#define PALMTE_MMC_SWITCH_GPIO  4
 +#define PALMTE_MMC1_GPIO        6
 +#define PALMTE_MMC2_GPIO        7
 +#define PALMTE_MMC3_GPIO        11
  static MouseTransformInfo palmte_pointercal = {
      .x = 320,
@@ -XXX,XX +XXX,XX @@ static struct {
      int column;
  } palmte_keymap[0x80] = {
      [0 ... 0x7f] = { -1, -1 },
 -    [0x3b] = { 0, 0 },    /* F1    -> Calendar */
 -    [0x3c] = { 1, 0 },    /* F2    -> Contacts */
 -    [0x3d] = { 2, 0 },    /* F3    -> Tasks List */
 -    [0x3e] = { 3, 0 },    /* F4    -> Note Pad */
 -    [0x01] = { 4, 0 },    /* Esc    -> Power */
 -    [0x4b] = { 0, 1 },    /*        Left */
 -    [0x50] = { 1, 1 },    /*        Down */
 -    [0x48] = { 2, 1 },    /*       Up */
 -    [0x4d] = { 3, 1 },    /*       Right */
 -    [0x4c] = { 4, 1 },    /*        Centre */
 -    [0x39] = { 4, 1 },    /* Spc    -> Centre */
 +    [0x3b] = { 0, 0 },  /* F1   -> Calendar */
 +    [0x3c] = { 1, 0 },  /* F2   -> Contacts */
 +    [0x3d] = { 2, 0 },  /* F3   -> Tasks List */
 +    [0x3e] = { 3, 0 },  /* F4   -> Note Pad */
 +    [0x01] = { 4, 0 },  /* Esc  -> Power */
 +    [0x4b] = { 0, 1 },  /*         Left */
 +    [0x50] = { 1, 1 },  /*         Down */
 +    [0x48] = { 2, 1 },  /*         Up */
 +    [0x4d] = { 3, 1 },  /*         Right */
 +    [0x4c] = { 4, 1 },  /*         Centre */
 +    [0x39] = { 4, 1 },  /* Spc  -> Centre */
  };
- static void palmte_button_event(void *opaque, int keycode)
++static void signal_sysresetreq(NVICState *s)
-@@ -XXX,XX +XXX,XX @@ static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
++{
-                             [PALMTE_MMC_SWITCH_GPIO]));
++    if (qemu_irq_is_connected(s->sysresetreq)) {
++        qemu_irq_pulse(s->sysresetreq);
-     misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
++    } else {
--    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,    misc_gpio[0]);
++        /*
--    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,    misc_gpio[1]);
++         * Default behaviour if the SoC doesn't need to wire up
--    qdev_connect_gpio_out(cpu->gpio, 11,            misc_gpio[2]);
++         * SYSRESETREQ (eg to a system reset controller of some kind):
--    qdev_connect_gpio_out(cpu->gpio, 12,            misc_gpio[3]);
++         * perform a system reset via the usual QEMU API.
--    qdev_connect_gpio_out(cpu->gpio, 13,            misc_gpio[4]);
++         */
--    omap_mpuio_out_set(cpu->mpuio, 1,                misc_gpio[5]);
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
--    omap_mpuio_out_set(cpu->mpuio, 3,                misc_gpio[6]);
++    }
-+    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
++}
-+    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
++
-+    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
+ static int nvic_pending_prio(NVICState *s)
-+    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
+ {
-+    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
+     /* return the group priority of the current pending interrupt,
-+    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
+@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-+    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
+             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
+                 if (attrs.secure ||
-     /* Reset some inputs to initial state.  */
+                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
-     qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
+-                    qemu_irq_pulse(s->sysresetreq);
 +                    signal_sysresetreq(s);
                  }
              }
              if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
 --
 .20.1

-[PULL 22/25] hw/arm/tosa: Encapsulate misc GPIO handling in a device
+[PULL 4/8] msf2-soc, stellaris: Don't wire up SYSRESETREQ
-Currently we have a free-floating set of IRQs and a function
+The MSF2 SoC model and the Stellaris board code both wire
-tosa_out_switch() which handle the GPIO lines on the tosa board which
+SYSRESETREQ up to a function that just invokes
-connect to LEDs, and another free-floating IRQ and tosa_reset()
+    qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-function to handle the GPIO line that resets the system.  Encapsulate
+This is now the default action that the NVIC does if the line is
-this behaviour in a simple QOM device.
+not connected, so we can delete the handling code.
 This commit fixes Coverity issue CID 1421929 (which pointed out that
 the 'outsignals' in tosa_gpio_setup() were leaked), because it
 removes the use of the qemu_allocate_irqs() API from this code
 entirely.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628203748.14250-3-peter.maydell@linaro.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200728103744.6909-4-peter.maydell@linaro.org
 ---
- hw/arm/tosa.c | 88 +++++++++++++++++++++++++++++++++++++--------------
+ hw/arm/msf2-soc.c  | 11 -----------
-file changed, 64 insertions(+), 24 deletions(-)
+ hw/arm/stellaris.c | 12 ------------
 files changed, 23 deletions(-)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
+--- a/hw/arm/msf2-soc.c
-+++ b/hw/arm/tosa.c
++++ b/hw/arm/msf2-soc.c
-@@ -XXX,XX +XXX,XX @@ static void tosa_microdrive_attach(PXA2xxState *cpu)
+@@ -XXX,XX +XXX,XX @@
-     pxa2xx_pcmcia_attach(cpu->pcmcia[0], md);
+ #include "hw/irq.h"
  #include "hw/arm/msf2-soc.h"
  #include "hw/misc/unimp.h"
 -#include "sysemu/runstate.h"
  #include "sysemu/sysemu.h"
  #define MSF2_TIMER_BASE       0x40004000
@@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 };
  static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 };
  static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 };
 -static void do_sys_reset(void *opaque, int n, int level)
 -{
 -    if (level) {
 -        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 -    }
 -}
 -
  static void m2sxxx_soc_initfn(Object *obj)
  {
      MSF2State *s = MSF2_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp)
          return;
      }
 -    qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0,
 -                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
 -
      system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk;
      for (i = 0; i < MSF2_NUM_UARTS; i++) {
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "qemu/log.h"
  #include "exec/address-spaces.h"
 -#include "sysemu/runstate.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/armv7m.h"
  #include "hw/char/pl011.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
      qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
  }
--static void tosa_out_switch(void *opaque, int line, int level)
+-static
-+/*
+-void do_sys_reset(void *opaque, int n, int level)
-+ * Encapsulation of some GPIO line behaviour for the Tosa board
+-{
-+ *
+-    if (level) {
-+ * QEMU interface:
+-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-+ *  + named GPIO inputs "leds[0..3]": assert to light LEDs
+-    }
-+ *  + named GPIO input "reset": when asserted, resets the system
+-}
-+ */
+-
-+
+ /* Board init.  */
-+#define TYPE_TOSA_MISC_GPIO "tosa-misc-gpio"
+ static stellaris_board_info stellaris_boards[] = {
-+#define TOSA_MISC_GPIO(obj) \
+   { "LM3S811EVB",
-+    OBJECT_CHECK(TosaMiscGPIOState, (obj), TYPE_TOSA_MISC_GPIO)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+
+     /* This will exit with an error if the user passed us a bad cpu_type */
-+typedef struct TosaMiscGPIOState {
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
-+    SysBusDevice parent_obj;
-+} TosaMiscGPIOState;
+-    qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
-+
+-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-+static void tosa_gpio_leds(void *opaque, int line, int level)
+-
- {
+     if (board->dc1 & (1 << 16)) {
-     switch (line) {
+         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
--        case 0:
+                                     qdev_get_gpio_in(nvic, 14),
 -            fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 1:
 -            fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 2:
 -            fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 3:
 -            fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 -            break;
 -        default:
 -            fprintf(stderr, "Uhandled out event: %d = %d\n", line, level);
 -            break;
 +    case 0:
 +        fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 1:
 +        fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 2:
 +        fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 3:
 +        fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 +        break;
 +    default:
 +        g_assert_not_reached();
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tosa_reset(void *opaque, int line, int level)
      }
  }
 +static void tosa_misc_gpio_init(Object *obj)
 +{
 +    DeviceState *dev = DEVICE(obj);
 +
 +    qdev_init_gpio_in_named(dev, tosa_gpio_leds, "leds", 4);
 +    qdev_init_gpio_in_named(dev, tosa_reset, "reset", 1);
 +}
 +
  static void tosa_gpio_setup(PXA2xxState *cpu,
                  DeviceState *scp0,
                  DeviceState *scp1,
                  TC6393xbState *tmio)
  {
 -    qemu_irq *outsignals = qemu_allocate_irqs(tosa_out_switch, cpu, 4);
 -    qemu_irq reset;
 +    DeviceState *misc_gpio;
 +
 +    misc_gpio = sysbus_create_simple(TYPE_TOSA_MISC_GPIO, -1, NULL);
      /* MMC/SD host */
      pxa2xx_mmci_handlers(cpu->mmc,
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                      qemu_irq_invert(qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_nSD_DETECT)));
      /* Handle reset */
 -    reset = qemu_allocate_irq(tosa_reset, cpu, 0);
 -    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET, reset);
 +    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET,
 +                          qdev_get_gpio_in_named(misc_gpio, "reset", 0));
      /* PCMCIA signals: card's IRQ and Card-Detect */
      pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0],
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                          qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_JC_CF_IRQ),
                          NULL);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED, outsignals[0]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED, outsignals[1]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED, outsignals[2]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED, outsignals[3]);
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 0));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 1));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 2));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 3));
      qdev_connect_gpio_out(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
@@ -XXX,XX +XXX,XX @@ static const TypeInfo tosa_ssp_info = {
      .class_init    = tosa_ssp_class_init,
  };
 +static const TypeInfo tosa_misc_gpio_info = {
 +    .name          = "tosa-misc-gpio",
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(TosaMiscGPIOState),
 +    .instance_init = tosa_misc_gpio_init,
 +    /*
 +     * No class init required: device has no internal state so does not
 +     * need to set up reset or vmstate, and has no realize method.
 +     */
 +};
 +
  static void tosa_register_types(void)
  {
      type_register_static(&tosa_dac_info);
      type_register_static(&tosa_ssp_info);
 +    type_register_static(&tosa_misc_gpio_info);
  }
  type_init(tosa_register_types)
 --
 .20.1

-[PULL 02/25] target/arm: Fix mtedesc for do_mem_zpz
+[PULL 5/8] target/arm: Fix AddPAC error indication
 From: Richard Henderson <richard.henderson@linaro.org>
-The mtedesc that was constructed was not actually passed in.
+The definition of top_bit used in this function is one higher
-Found by Coverity (CID 1429996).
+than that used in the Arm ARM psuedo-code, which put the error
 indication at top_bit - 1 at the wrong place, which meant that
 it wasn't visible to Auth.
-Fixes: d28d12f008e
+Fixing the definition of top_bit requires more changes, because
 its most common use is for the count of bits in top_bit:bot_bit,
 which would then need to be computed as top_bit - bot_bit + 1.
 For now, prefer the minimal fix to the error indication alone.
 Fixes: 63ff0ca94cb
 Reported-by: Derrick McKee <derrick.mckee@gmail.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200728195706.11087-1-richard.henderson@linaro.org
-Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: added comment about the divergence from the pseudocode]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-sve.c | 2 +-
+ target/arm/pauth_helper.c         |  6 +++++-
-file changed, 1 insertion(+), 1 deletion(-)
+ tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++
  tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 39 insertions(+), 2 deletions(-)
  create mode 100644 tests/tcg/aarch64/pauth-5.c
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/target/arm/pauth_helper.c
-+++ b/target/arm/translate-sve.c
++++ b/target/arm/pauth_helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
+@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
-         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
+      */
-         desc <<= SVE_MTEDESC_SHIFT;
+     test = sextract64(ptr, bot_bit, top_bit - bot_bit);
      if (test != 0 && test != -1) {
 -        pac ^= MAKE_64BIT_MASK(top_bit - 1, 1);
 +        /*
 +         * Note that our top_bit is one greater than the pseudocode's
 +         * version, hence "- 2" here.
 +         */
 +        pac ^= MAKE_64BIT_MASK(top_bit - 2, 1);
      }
--    desc = simd_desc(vsz, vsz, scale);
-+    desc = simd_desc(vsz, vsz, desc | scale);
+     /*
-     t_desc = tcg_const_i32(desc);
+diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c
+new file mode 100644
-     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
+index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/pauth-5.c
@@ -XXX,XX +XXX,XX @@
 +#include <assert.h>
 +
 +static int x;
 +
 +int main()
 +{
 +    int *p0 = &x, *p1, *p2, *p3;
 +    unsigned long salt = 0;
 +
 +    /*
 +     * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so
 +     * a 1/128 chance of auth = pac(ptr,key,salt) producing zero.
 +     * Find a salt that creates auth != 0.
 +     */
 +    do {
 +        salt++;
 +        asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0));
 +    } while (p0 == p1);
 +
 +    /*
 +     * This pac must fail, because the input pointer bears an encryption,
 +     * and so is not properly extended within bits [55:47].  This will
 +     * toggle bit 54 in the output...
 +     */
 +    asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1));
 +
 +    /* ... so that the aut must fail, setting bit 53 in the output ... */
 +    asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2));
 +
 +    /* ... which means this equality must not hold. */
 +    assert(p3 != p0);
 +    return 0;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
  # Pauth Tests
  ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),)
 -AARCH64_TESTS += pauth-1 pauth-2 pauth-4
 +AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5
  pauth-%: CFLAGS += -march=armv8.3-a
  run-pauth-%: QEMU_OPTS += -cpu max
  run-plugin-pauth-%: QEMU_OPTS += -cpu max
 --
 .20.1

-[PULL 03/25] Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx25.h | 1 +
- hw/arm/fsl-imx25.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
-     MemoryRegion   rom[2];
-     MemoryRegion   iram;
-     MemoryRegion   iram_alias;
-+    uint32_t       phy_num;
- } FslIMX25State;
- /**
-diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx25.c
-+++ b/hw/arm/fsl-imx25.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                             epit_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                 &s->iram_alias);
- }
-+static Property fsl_imx25_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx25_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx25_properties);
-     dc->realize = fsl_imx25_realize;
-     dc->desc = "i.MX25 SOC";
-     /*
---
-.20.1

-[PULL 04/25] Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx6.h | 1 +
- hw/arm/fsl-imx6.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
-+++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
-     MemoryRegion   caam;
-     MemoryRegion   ocram;
-     MemoryRegion   ocram_alias;
-+    uint32_t       phy_num;
- } FslIMX6State;
-diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
-+++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                             spi_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                 &s->ocram_alias);
- }
-+static Property fsl_imx6_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx6_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx6_properties);
-     dc->realize = fsl_imx6_realize;
-     dc->desc = "i.MX6 SOC";
-     /* Reason: Uses serial_hd() in the realize() function */
---
-.20.1

-[PULL 05/25] Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx7.h | 1 +
- hw/arm/fsl-imx7.c         | 9 +++++++++
-files changed, 10 insertions(+)
-diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx7.h
-+++ b/include/hw/arm/fsl-imx7.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
-     IMX7GPRState       gpr;
-     ChipideaState      usb[FSL_IMX7_NUM_USBS];
-     DesignwarePCIEHost pcie;
-+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
- } FslIMX7State;
- enum FslIMX7MemoryMap {
-diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx7.c
-+++ b/hw/arm/fsl-imx7.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-             FSL_IMX7_ENET2_ADDR,
-         };
-+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
-+                                 s->phy_num[i], &error_abort);
-         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
-                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
-         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-                                 FSL_IMX7_PCIE_PHY_SIZE);
- }
-+static Property fsl_imx7_properties[] = {
-+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
-+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx7_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx7_properties);
-     dc->realize = fsl_imx7_realize;
-     /* Reason: Uses serial_hds and nd_table in realize() directly */
---
-.20.1

-[PULL 06/25] target/arm: Don't do raw writes for PMINTENCLR
+Deleted patch
-From: Aaron Lindsay <aaron@os.amperecomputing.com>
-Raw writes to this register when in KVM mode can cause interrupts to be
-raised (even when the PMU is disabled). Because the underlying state is
-already aliased to PMINTENSET (which already provides raw write
-functions), we can safely disable raw accesses to PMINTENCLR entirely.
-Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
-Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
-       .resetvalue = 0x0 },
-     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
-       .access = PL1_RW, .accessfn = access_tpm,
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-       .writefn = pmintenclr_write, },
-     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
-       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
-       .access = PL1_RW, .accessfn = access_tpm,
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-       .writefn = pmintenclr_write },
-     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
---
-.20.1

-[PULL 07/25] virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-Coverity points out (CID 1430180) that the new case is missing
-break or a /* fallthrough */ comment. Break is the right thing to
-do as in that case, tail is not used.
-Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200708160147.18426-1-eric.auger@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/virtio/virtio-iommu.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-iommu.c
-+++ b/hw/virtio/virtio-iommu.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
-             ptail = (struct virtio_iommu_req_tail *)
-                         (buf + s->config.probe_size);
-             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
-+            break;
-         }
-         default:
-             tail.status = VIRTIO_IOMMU_S_UNSUPP;
---
-.20.1

-[PULL 08/25] build: Enable BSD symbols for Haiku
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Tell Haiku to provide various BSD functions by setting BSD_SOURCE
-and linking libbsd.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-2-peter.maydell@linaro.org
-[PMM: expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ SunOS)
- ;;
- Haiku)
-   haiku="yes"
--  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS $QEMU_CFLAGS"
--  LIBS="-lposix_error_mapper -lnetwork $LIBS"
-+  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS -DBSD_SOURCE $QEMU_CFLAGS"
-+  LIBS="-lposix_error_mapper -lnetwork -lbsd $LIBS"
- ;;
- Linux)
-   audio_drv_list="try-pa oss"
---
-.20.1

-[PULL 09/25] util/qemu-openpty.c: Don't assume pty.h is glibc-only
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Instead of using an OS-specific ifdef test to select the "openpty()
-is in pty.h" codepath, make configure check for the existence of
-the header and use the new CONFIG_PTY instead.
-This is necessary to build on Haiku, which also provides openpty()
-via pty.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-3-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_PTY_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure           | 9 +++++++++
- util/qemu-openpty.c | 2 +-
-files changed, 10 insertions(+), 1 deletion(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ else
-   l2tpv3=no
- fi
-+if check_include "pty.h" ; then
-+  pty_h=yes
-+else
-+  pty_h=no
-+fi
-+
- #########################################
- # vhost interdependencies and host support
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$sheepdog" = "yes" ; then
-   echo "CONFIG_SHEEPDOG=y" >> $config_host_mak
- fi
-+if test "$pty_h" = "yes" ; then
-+  echo "HAVE_PTY_H=y" >> $config_host_mak
-+fi
- if test "$fuzzing" = "yes" ; then
-   if test "$have_fuzzer" = "yes"; then
-     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
-diff --git a/util/qemu-openpty.c b/util/qemu-openpty.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-openpty.c
-+++ b/util/qemu-openpty.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
--#if defined(__GLIBC__)
-+#if defined HAVE_PTY_H
- # include <pty.h>
- #elif defined CONFIG_BSD
- # include <termios.h>
---
-.20.1

-[PULL 10/25] build: Check that mlockall() exists
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Instead of assuming that all POSIX platforms provide mlockall(),
-test for it in configure. If the host doesn't provide this platform
-then os_mlock() will fail -ENOSYS, as it does already on Windows.
-This is necessary for Haiku, which does not have mlockall().
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-4-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_MLOCKALL]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure  | 15 +++++++++++++++
- os-posix.c |  4 ++++
-files changed, 19 insertions(+)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ else
-   pty_h=no
- fi
-+cat > $TMPC <<EOF
-+#include <sys/mman.h>
-+int main(int argc, char *argv[]) {
-+    return mlockall(MCL_FUTURE);
-+}
-+EOF
-+if compile_prog "" "" ; then
-+  have_mlockall=yes
-+else
-+  have_mlockall=no
-+fi
-+
- #########################################
- # vhost interdependencies and host support
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$pty_h" = "yes" ; then
-   echo "HAVE_PTY_H=y" >> $config_host_mak
- fi
-+if test "$have_mlockall" = "yes" ; then
-+  echo "HAVE_MLOCKALL=y" >> $config_host_mak
-+fi
- if test "$fuzzing" = "yes" ; then
-   if test "$have_fuzzer" = "yes"; then
-     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
-diff --git a/os-posix.c b/os-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/os-posix.c
-+++ b/os-posix.c
-@@ -XXX,XX +XXX,XX @@ bool is_daemonized(void)
- int os_mlock(void)
- {
-+#ifdef HAVE_MLOCKALL
-     int ret = 0;
-     ret = mlockall(MCL_CURRENT | MCL_FUTURE);
-@@ -XXX,XX +XXX,XX @@ int os_mlock(void)
-     }
-     return ret;
-+#else
-+    return -ENOSYS;
-+#endif
- }
---
-.20.1

-[PULL 11/25] osdep.h: Always include <sys/signal.h> if it exists
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Regularize our handling of <sys/signal.h>: currently we include it in
-osdep.h, but only for OpenBSD, and we include it without an ifdef
-guard in a couple of C files.  This causes problems for Haiku, which
-doesn't have that header.
-Instead, check in configure whether sys/signal.h exists, and if it
-does then always include it from osdep.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-5-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_SYS_SIGNAL_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure                   | 10 ++++++++++
- include/qemu/osdep.h        |  2 +-
- hw/xen/xen-legacy-backend.c |  1 -
- util/oslib-posix.c          |  1 -
-files changed, 11 insertions(+), 3 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ if check_include "libdrm/drm.h" ; then
-     have_drm_h=yes
- fi
-+#########################################
-+# sys/signal.h check
-+have_sys_signal_h=no
-+if check_include "sys/signal.h" ; then
-+  have_sys_signal_h=yes
-+fi
-+
- ##########################################
- # VTE probe
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$have_openpty" = "yes" ; then
-     echo "HAVE_OPENPTY=y" >> $config_host_mak
- fi
-+if test "$have_sys_signal_h" = "yes" ; then
-+    echo "HAVE_SYS_SIGNAL_H=y" >> $config_host_mak
-+fi
- # Work around a system header bug with some kernel/XFS header
- # versions where they both try to define 'struct fsxattr':
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
- #include <setjmp.h>
- #include <signal.h>
--#ifdef __OpenBSD__
-+#ifdef HAVE_SYS_SIGNAL_H
- #include <sys/signal.h>
- #endif
-diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/xen/xen-legacy-backend.c
-+++ b/hw/xen/xen-legacy-backend.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
--#include <sys/signal.h>
- #include "hw/sysbus.h"
- #include "hw/boards.h"
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
-+++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/sockets.h"
- #include "qemu/thread.h"
- #include <libgen.h>
--#include <sys/signal.h>
- #include "qemu/cutils.h"
- #ifdef CONFIG_LINUX
---
-.20.1

-[PULL 12/25] osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Haiku doesn't provide SIGIO; fix this up in osdep.h by defining it as
-equal to SIGPOLL.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-6-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/osdep.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
- #define HAVE_CHARDEV_PARPORT 1
- #endif
-+#if defined(__HAIKU__)
-+#define SIGIO SIGPOLL
-+#endif
-+
- #if defined(CONFIG_LINUX)
- #ifndef BUS_MCEERR_AR
- #define BUS_MCEERR_AR 4
---
-.20.1

-[PULL 18/25] target/nios2: in line the semantics of DISAS_UPDATE with other targets
+[PULL 6/8] target/arm: Avoid maybe-uninitialized warning with gcc 4.9
-From: Wentong Wu <wentong.wu@intel.com>
+From: Kaige Li <likaige@loongson.cn>
-In line the semantics of DISAS_UPDATE on nios2 target with other targets
+GCC version 4.9.4 isn't clever enough to figure out that all
-which is to explicitly write the PC back into the cpu state before doing
+execution paths in disas_ldst() that use 'fn' will have initialized
-a tcg_gen_exit_tb().
+it first, and so it warns:
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+/home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’:
-Message-id: 20200710233433.19729-2-wentong.wu@intel.com
+/home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+     fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
      ^
 /home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here
      AtomicThreeOpFn *fn;
                       ^
 Make it happy by initializing the variable to NULL.
 Signed-off-by: Kaige Li <likaige@loongson.cn>
 Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: Clean up commit message and note which gcc version this was]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/nios2/translate.c | 2 +-
+ target/arm/translate-a64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/target/arm/translate-a64.c
-+++ b/target/nios2/translate.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
-     /* Indicate where the next block should start */
+     bool r = extract32(insn, 22, 1);
-     switch (dc->is_jmp) {
+     bool a = extract32(insn, 23, 1);
-     case DISAS_NEXT:
+     TCGv_i64 tcg_rs, clean_addr;
-+    case DISAS_UPDATE:
+-    AtomicThreeOpFn *fn;
-         /* Save the current PC back into the CPU register */
++    AtomicThreeOpFn *fn = NULL;
-         tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
-         tcg_gen_exit_tb(NULL, 0);
+     if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+         unallocated_encoding(s);
      default:
      case DISAS_JUMP:
 -    case DISAS_UPDATE:
          /* The jump will already have updated the PC register */
          tcg_gen_exit_tb(NULL, 0);
          break;
 --
 .20.1

-[PULL 21/25] hw/arm/tosa.c: Detabify
+[PULL 7/8] hw/arm/nrf51_soc: Set system_clock_scale
-Remove the hardcoded tabs from hw/arm/tosa.c. There aren't
+The nrf51 SoC model wasn't setting the system_clock_scale
-many, but since they're all in constant #defines they're not
+global.which meant that if guest code used the systick timer in "use
-going to go away with our usual "only when we touch a function"
+the processor clock" mode it would hang because time never advances.
-policy on reformatting.
 Set the global to match the documented CPU clock speed for this SoC.
 This SoC in fact doesn't have a SysTick timer (which is the only thing
 currently that cares about the system_clock_scale), because it's
 a configurable option in the Cortex-M0. However our Cortex-M0 and
 thus our nrf51 and our micro:bit board do provide a SysTick, so
 we ought to provide a functional one rather than a broken one.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628203748.14250-2-peter.maydell@linaro.org
+Message-id: 20200727193458.31250-1-peter.maydell@linaro.org
 ---
- hw/arm/tosa.c | 44 ++++++++++++++++++++++----------------------
+ hw/arm/nrf51_soc.c | 5 +++++
-file changed, 22 insertions(+), 22 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
+--- a/hw/arm/nrf51_soc.c
-+++ b/hw/arm/tosa.c
++++ b/hw/arm/nrf51_soc.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "exec/address-spaces.h"
+ #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
--#define TOSA_RAM    0x04000000
++/* HCLK (the main CPU clock) on this SoC is always 16MHz */
--#define TOSA_ROM    0x00800000
++#define HCLK_FRQ 16000000
-+#define TOSA_RAM 0x04000000
++
-+#define TOSA_ROM 0x00800000
+ static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size)
 -#define TOSA_GPIO_USB_IN        (5)
 -#define TOSA_GPIO_nSD_DETECT    (9)
 -#define TOSA_GPIO_ON_RESET        (19)
 -#define TOSA_GPIO_CF_IRQ        (21)    /* CF slot0 Ready */
 -#define TOSA_GPIO_CF_CD            (13)
 -#define TOSA_GPIO_TC6393XB_INT  (15)
 -#define TOSA_GPIO_JC_CF_IRQ        (36)    /* CF slot1 Ready */
 +#define TOSA_GPIO_USB_IN                (5)
 +#define TOSA_GPIO_nSD_DETECT            (9)
 +#define TOSA_GPIO_ON_RESET              (19)
 +#define TOSA_GPIO_CF_IRQ                (21)    /* CF slot0 Ready */
 +#define TOSA_GPIO_CF_CD                 (13)
 +#define TOSA_GPIO_TC6393XB_INT          (15)
 +#define TOSA_GPIO_JC_CF_IRQ             (36)    /* CF slot1 Ready */
 -#define TOSA_SCOOP_GPIO_BASE    1
 -#define TOSA_GPIO_IR_POWERDWN    (TOSA_SCOOP_GPIO_BASE + 2)
 -#define TOSA_GPIO_SD_WP            (TOSA_SCOOP_GPIO_BASE + 3)
 -#define TOSA_GPIO_PWR_ON        (TOSA_SCOOP_GPIO_BASE + 4)
 +#define TOSA_SCOOP_GPIO_BASE            1
 +#define TOSA_GPIO_IR_POWERDWN           (TOSA_SCOOP_GPIO_BASE + 2)
 +#define TOSA_GPIO_SD_WP                 (TOSA_SCOOP_GPIO_BASE + 3)
 +#define TOSA_GPIO_PWR_ON                (TOSA_SCOOP_GPIO_BASE + 4)
 -#define TOSA_SCOOP_JC_GPIO_BASE        1
 -#define TOSA_GPIO_BT_LED        (TOSA_SCOOP_JC_GPIO_BASE + 0)
 -#define TOSA_GPIO_NOTE_LED        (TOSA_SCOOP_JC_GPIO_BASE + 1)
 -#define TOSA_GPIO_CHRG_ERR_LED        (TOSA_SCOOP_JC_GPIO_BASE + 2)
 -#define TOSA_GPIO_TC6393XB_L3V_ON    (TOSA_SCOOP_JC_GPIO_BASE + 5)
 -#define TOSA_GPIO_WLAN_LED        (TOSA_SCOOP_JC_GPIO_BASE + 7)
 +#define TOSA_SCOOP_JC_GPIO_BASE         1
 +#define TOSA_GPIO_BT_LED                (TOSA_SCOOP_JC_GPIO_BASE + 0)
 +#define TOSA_GPIO_NOTE_LED              (TOSA_SCOOP_JC_GPIO_BASE + 1)
 +#define TOSA_GPIO_CHRG_ERR_LED          (TOSA_SCOOP_JC_GPIO_BASE + 2)
 +#define TOSA_GPIO_TC6393XB_L3V_ON       (TOSA_SCOOP_JC_GPIO_BASE + 5)
 +#define TOSA_GPIO_WLAN_LED              (TOSA_SCOOP_JC_GPIO_BASE + 7)
 -#define    DAC_BASE    0x4e
 -#define DAC_CH1        0
 -#define DAC_CH2        1
 +#define DAC_BASE 0x4e
 +#define DAC_CH1 0
 +#define DAC_CH2 1
  static void tosa_microdrive_attach(PXA2xxState *cpu)
  {
+     qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+         return;
+     }
++    system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ;
++
+     object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
+                              &error_abort);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
 --
 .20.1

-[PULL 13/25] bswap.h: Include <endian.h> on Haiku for bswap operations
+[PULL 8/8] hw/timer/imx_epit: Avoid assertion when CR.SWR is written
-From: David CARLIER <devnexen@gmail.com>
+The imx_epit device has a software-controllable reset triggered by
 setting the SWR bit in the CR register. An error in commit cc2722ec83ad9
 means that we will end up assert()ing if the guest does this, because
 the code in imx_epit_write() starts ptimer transactions, and then
 imx_epit_reset() also starts ptimer transactions, triggering
 "ptimer_transaction_begin: Assertion `!s->in_transaction' failed".
-Haiku puts the bswap* functions in <endian.h>; pull in that
+The cleanest way to avoid this double-transaction is to move the
-include file on that platform.
+start-transaction for the CR write handling down below the check of
 the SWR bit.
-Signed-off-by: David Carlier <devnexen@gmail.com>
+Fixes: https://bugs.launchpad.net/qemu/+bug/1880424
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Fixes: cc2722ec83ad944505fe
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-7-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-[PMM: Expanded commit message]
+Message-id: 20200727154550.3409-1-peter.maydell@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qemu/bswap.h | 2 ++
+ hw/timer/imx_epit.c | 13 ++++++++++---
-file changed, 2 insertions(+)
+file changed, 10 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
+diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/bswap.h
+--- a/hw/timer/imx_epit.c
-+++ b/include/qemu/bswap.h
++++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
- # include <machine/bswap.h>
- #elif defined(__FreeBSD__)
+     switch (offset >> 2) {
- # include <sys/endian.h>
+     case 0: /* CR */
-+#elif defined(__HAIKU__)
+-        ptimer_transaction_begin(s->timer_cmp);
-+# include <endian.h>
+-        ptimer_transaction_begin(s->timer_reload);
- #elif defined(CONFIG_BYTESWAP_H)
- # include <byteswap.h>
+         oldcr = s->cr;
          s->cr = value & 0x03ffffff;
          if (s->cr & CR_SWR) {
              /* handle the reset */
              imx_epit_reset(DEVICE(s));
 -        } else {
 +            /*
 +             * TODO: could we 'break' here? following operations appear
 +             * to duplicate the work imx_epit_reset() already did.
 +             */
 +        }
 +
 +        ptimer_transaction_begin(s->timer_cmp);
 +        ptimer_transaction_begin(s->timer_reload);
 +
 +        if (!(s->cr & CR_SWR)) {
              imx_epit_set_freq(s);
          }
 --
 .20.1

-[PULL 14/25] util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-util/compatfd.c includes <sys/syscall.h> so that the CONFIG_SIGNALFD
-code can use SYS_signalfd. Guard the #include with CONFIG_SIGNALFD
-to avoid portability issues on hosts like Haiku which do not
-provide that header file.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-8-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- util/compatfd.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/util/compatfd.c b/util/compatfd.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/compatfd.c
-+++ b/util/compatfd.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu/thread.h"
-+#if defined(CONFIG_SIGNALFD)
- #include <sys/syscall.h>
-+#endif
- struct sigfd_compat_info
- {
---
-.20.1

-[PULL 15/25] util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-The qemu_init_exec_dir() function is inherently non-portable;
-provide an implementation for Haiku hosts.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-9-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- util/oslib-posix.c | 19 +++++++++++++++++++
-file changed, 19 insertions(+)
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
-+++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include <mach-o/dyld.h>
- #endif
-+#ifdef __HAIKU__
-+#include <kernel/image.h>
-+#endif
-+
- #include "qemu/mmap-alloc.h"
- #ifdef CONFIG_DEBUG_STACK_USAGE
-@@ -XXX,XX +XXX,XX @@ void qemu_init_exec_dir(const char *argv0)
-             }
-         }
-     }
-+#elif defined(__HAIKU__)
-+    {
-+        image_info ii;
-+        int32_t c = 0;
-+
-+        *buf = '\0';
-+        while (get_next_image_info(0, &c, &ii) == B_OK) {
-+            if (ii.type == B_APP_IMAGE) {
-+                strncpy(buf, ii.name, sizeof(buf));
-+                buf[sizeof(buf) - 1] = 0;
-+                p = buf;
-+                break;
-+            }
-+        }
-+    }
- #endif
-     /* If we don't have any way of figuring out the actual executable
-        location then try argv[0].  */
---
-.20.1

-[PULL 16/25] util/drm: make portable by avoiding struct dirent d_type
+Deleted patch
-From: Gerd Hoffmann <kraxel@redhat.com>
-Given this isn't perforance critical at all lets avoid the non-portable
-d_type and use fstat instead to check whenever the file is a chardev.
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reported-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-10-peter.maydell@linaro.org
-Message-id: 20200701180302.14821-1-kraxel@redhat.com
-[PMM: fixed comment style; tweaked subject line]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- util/drm.c | 19 ++++++++++++++-----
-file changed, 14 insertions(+), 5 deletions(-)
-diff --git a/util/drm.c b/util/drm.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/drm.c
-+++ b/util/drm.c
-@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
- {
-     DIR *dir;
-     struct dirent *e;
--    int r, fd;
-+    struct stat st;
-+    int r, fd, ret;
-     char *p;
-     if (rendernode) {
-@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
-     fd = -1;
-     while ((e = readdir(dir))) {
--        if (e->d_type != DT_CHR) {
--            continue;
--        }
--
-         if (strncmp(e->d_name, "renderD", 7)) {
-             continue;
-         }
-@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
-             g_free(p);
-             continue;
-         }
-+
-+        /*
-+         * prefer fstat() over checking e->d_type == DT_CHR for
-+         * portability reasons
-+         */
-+        ret = fstat(r, &st);
-+        if (ret < 0 || (st.st_mode & S_IFMT) != S_IFCHR) {
-+            close(r);
-+            g_free(p);
-+            continue;
-+        }
-+
-         fd = r;
-         g_free(p);
-         break;
---
-.20.1

-[PULL 17/25] target/nios2: add DISAS_NORETURN case for nothing more to generate
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-Add DISAS_NORETURN case for nothing more to generate because at runtime
-execution will never return from some helper call. And at the same time
-replace DISAS_UPDATE in t_gen_helper_raise_exception and gen_exception
-with the newly added DISAS_NORETURN.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-1-wentong.wu@intel.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
-     tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(dc->cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- static bool use_goto_tb(DisasContext *dc, uint32_t dest)
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
-     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- /* generate intermediate code for basic block 'tb'.  */
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         tcg_gen_exit_tb(NULL, 0);
-         break;
-+    case DISAS_NORETURN:
-     case DISAS_TB_JUMP:
-         /* nothing more to generate */
-         break;
---
-.20.1

-[PULL 19/25] target/nios2: Use gen_io_start around wrctl instruction
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-wrctl instruction on nios2 target will cause checking cpu
-interrupt but tcg_handle_interrupt() will call cpu_abort()
-if the CPU gets an interrupt while it's not in 'can do IO'
-state, so add gen_io_start around wrctl instruction. Also
-at the same time, end the onging TB with DISAS_UPDATE.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-3-wentong.wu@intel.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/cpu_ldst.h"
- #include "exec/translator.h"
- #include "qemu/qemu-print.h"
-+#include "exec/gen-icount.h"
- /* is_jmp field values */
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     /* If interrupts were enabled using WRCTL, trigger them. */
- #if !defined(CONFIG_USER_ONLY)
-     if ((instr.imm5 + CR_BASE) == CR_STATUS) {
-+        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
-+            gen_io_start();
-+        }
-         gen_helper_check_interrupts(dc->cpu_env);
-+        dc->is_jmp = DISAS_UPDATE;
-     }
- #endif
- }
---
-.20.1

-[PULL 20/25] hw/nios2: exit to main CPU loop only when unmasking interrupts
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-Only when guest code is unmasking interrupts, terminate the excution
-of translated code and exit to the main CPU loop to handle previous
-pended interrupts because of the interrupts mask by guest code.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-4-wentong.wu@intel.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/nios2/cpu_pic.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/nios2/cpu_pic.c b/hw/nios2/cpu_pic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nios2/cpu_pic.c
-+++ b/hw/nios2/cpu_pic.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_pic_cpu_handler(void *opaque, int irq, int level)
- void nios2_check_interrupts(CPUNios2State *env)
- {
--    if (env->irq_pending) {
-+    if (env->irq_pending &&
-+        (env->regs[CR_STATUS] & CR_STATUS_PIE)) {
-         env->irq_pending = 0;
-         cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HARD);
-     }
---
-.20.1

Last lot of target-arm changes to squeeze in before rc1:
 * various minor Arm bug fixes
 * David Carlier's Haiku build portability fixes
 * Wentong Wu's fixes for icount handling in the nios2 target

The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713

for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:

hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/bcm2836: Remove unused 'cpu_type' field
 * target/arm: Fix mtedesc for do_mem_zpz
 * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
 * target/arm: Don't do raw writes for PMINTENCLR
 * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
 * build: Fix various issues with building on Haiku
 * target/nios2: fix wrctl behaviour when using icount
 * hw/arm/tosa: Encapsulate misc GPIO handling in a device
 * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
 * hw/arm/aspeed: Do not create and attach empty SD cards by default

----------------------------------------------------------------
Aaron Lindsay (1):
      target/arm: Don't do raw writes for PMINTENCLR

David CARLIER (8):
      build: Enable BSD symbols for Haiku
      util/qemu-openpty.c: Don't assume pty.h is glibc-only
      build: Check that mlockall() exists
      osdep.h: Always include <sys/signal.h> if it exists
      osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
      bswap.h: Include <endian.h> on Haiku for bswap operations
      util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
      util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku

Eric Auger (1):
      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()

Gerd Hoffmann (1):
      util/drm: make portable by avoiding struct dirent d_type

Jean-Christophe Dubois (3):
      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
      Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor

Peter Maydell (4):
      hw/arm/tosa.c: Detabify
      hw/arm/tosa: Encapsulate misc GPIO handling in a device
      hw/arm/palm.c: Detabify
      hw/arm/palm.c: Encapsulate misc GPIO handling in a device

Philippe Mathieu-Daudé (2):
      hw/arm/bcm2836: Remove unused 'cpu_type' field
      hw/arm/aspeed: Do not create and attach empty SD cards by default

Richard Henderson (1):
      target/arm: Fix mtedesc for do_mem_zpz

Wentong Wu (4):
      target/nios2: add DISAS_NORETURN case for nothing more to generate
      target/nios2: in line the semantics of DISAS_UPDATE with other targets
      target/nios2: Use gen_io_start around wrctl instruction
      hw/nios2: exit to main CPU loop only when unmasking interrupts

From: Richard Henderson <richard.henderson@linaro.org>

The mtedesc that was constructed was not actually passed in.
Found by Coverity (CID 1429996).

Fixes: d28d12f008e
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
         desc <<= SVE_MTEDESC_SHIFT;
     }
-    desc = simd_desc(vsz, vsz, scale);
+    desc = simd_desc(vsz, vsz, desc | scale);
     t_desc = tcg_const_i32(desc);
 
     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 1 +
 hw/arm/fsl-imx25.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     MemoryRegion   rom[2];
     MemoryRegion   iram;
     MemoryRegion   iram_alias;
+    uint32_t       phy_num;
 } FslIMX25State;
 
 /**
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                             epit_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                 &s->iram_alias);
 }
 
+static Property fsl_imx25_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx25_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx25_properties);
     dc->realize = fsl_imx25_realize;
     dc->desc = "i.MX25 SOC";
     /*
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 1 +
 hw/arm/fsl-imx6.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     MemoryRegion   caam;
     MemoryRegion   ocram;
     MemoryRegion   ocram_alias;
+    uint32_t       phy_num;
 } FslIMX6State;
 
 
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             spi_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                 &s->ocram_alias);
 }
 
+static Property fsl_imx6_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx6_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx6_properties);
     dc->realize = fsl_imx6_realize;
     dc->desc = "i.MX6 SOC";
     /* Reason: Uses serial_hd() in the realize() function */
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx7.h | 1 +
 hw/arm/fsl-imx7.c         | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
 } FslIMX7State;
 
 enum FslIMX7MemoryMap {
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
             FSL_IMX7_ENET2_ADDR,
         };
 
+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
+                                 s->phy_num[i], &error_abort);
         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                 FSL_IMX7_PCIE_PHY_SIZE);
 }
 
+static Property fsl_imx7_properties[] = {
+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx7_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx7_properties);
     dc->realize = fsl_imx7_realize;
 
     /* Reason: Uses serial_hds and nd_table in realize() directly */
-- 
2.20.1

From: Aaron Lindsay <aaron@os.amperecomputing.com>

Raw writes to this register when in KVM mode can cause interrupts to be
raised (even when the PMU is disabled). Because the underlying state is
already aliased to PMINTENSET (which already provides raw write
functions), we can safely disable raw accesses to PMINTENCLR entirely.

Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write, },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Coverity points out (CID 1430180) that the new case is missing
break or a /* fallthrough */ comment. Break is the right thing to
do as in that case, tail is not used.

Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200708160147.18426-1-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/virtio/virtio-iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
             ptail = (struct virtio_iommu_req_tail *)
                         (buf + s->config.probe_size);
             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+            break;
         }
         default:
             tail.status = VIRTIO_IOMMU_S_UNSUPP;
-- 
2.20.1