Series comparison

-[PULL 00/25] target-arm queue
+[PULL 00/16] target-arm queue
-Last lot of target-arm changes to squeeze in before rc1:
+Patches for rc1: nothing major, just some minor bugfixes and
- * various minor Arm bug fixes
+code cleanups.
  * David Carlier's Haiku build portability fixes
  * Wentong Wu's fixes for icount handling in the nios2 target
-The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:
+-- PMM
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
   Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/bcm2836: Remove unused 'cpu_type' field
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * target/arm: Fix mtedesc for do_mem_zpz
+ * Minor coding style fixes
- * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
+ * docs: add some notes on the sbsa-ref machine
- * target/arm: Don't do raw writes for PMINTENCLR
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * build: Fix various issues with building on Haiku
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * target/nios2: fix wrctl behaviour when using icount
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
- * hw/arm/tosa: Encapsulate misc GPIO handling in a device
+ * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
- * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+ * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
- * hw/arm/aspeed: Do not create and attach empty SD cards by default
+ * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Aaron Lindsay (1):
+Alex Bennée (1):
-      target/arm: Don't do raw writes for PMINTENCLR
+      docs: add some notes on the sbsa-ref machine
-David CARLIER (8):
+AlexChen (1):
-      build: Enable BSD symbols for Haiku
+      ssi: Fix bad printf format specifiers
       util/qemu-openpty.c: Don't assume pty.h is glibc-only
       build: Check that mlockall() exists
       osdep.h: Always include <sys/signal.h> if it exists
       osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
       bswap.h: Include <endian.h> on Haiku for bswap operations
       util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
       util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
-Eric Auger (1):
+Andrew Jones (1):
-      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
-Gerd Hoffmann (1):
+Havard Skinnemoen (1):
-      util/drm: make portable by avoiding struct dirent d_type
+      tests/qtest/npcm7xx_rng-test: count runs properly
-Jean-Christophe Dubois (3):
+Peter Maydell (2):
-      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+      hw/arm/nseries: Check return value from load_image_targphys()
-      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
       Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
-Peter Maydell (4):
+Philippe Mathieu-Daudé (6):
-      hw/arm/tosa.c: Detabify
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
-      hw/arm/tosa: Encapsulate misc GPIO handling in a device
+      hw/arm/armsse: Correct expansion MPC interrupt lines
-      hw/arm/palm.c: Detabify
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
-      hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-Philippe Mathieu-Daudé (2):
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
       hw/arm/bcm2836: Remove unused 'cpu_type' field
       hw/arm/aspeed: Do not create and attach empty SD cards by default
 Richard Henderson (1):
-      target/arm: Fix mtedesc for do_mem_zpz
+      target/arm: Fix neon VTBL/VTBX for len > 1
-Wentong Wu (4):
+Xinhao Zhang (3):
-      target/nios2: add DISAS_NORETURN case for nothing more to generate
+      target/arm: add spaces around operator
-      target/nios2: in line the semantics of DISAS_UPDATE with other targets
+      target/arm: Don't use '#' flag of printf format
-      target/nios2: Use gen_io_start around wrctl instruction
+      target/arm: add space before the open parenthesis '('
       hw/nios2: exit to main CPU loop only when unmasking interrupts
- configure                   |  38 ++++++++++++-
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
- include/hw/arm/bcm2836.h    |   1 -
+ docs/system/target-arm.rst         |  1 +
- include/hw/arm/fsl-imx25.h  |   1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
- include/hw/arm/fsl-imx6.h   |   1 +
+ target/arm/helper.h                |  2 +-
- include/hw/arm/fsl-imx7.h   |   1 +
+ hw/arm/armsse.c                    |  3 +-
- include/qemu/bswap.h        |   2 +
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
- include/qemu/osdep.h        |   6 +-
+ hw/arm/nseries.c                   | 26 ++++++++----------
- hw/arm/aspeed.c             |   9 +--
+ hw/arm/stm32f205_soc.c             |  1 -
- hw/arm/fsl-imx25.c          |   7 +++
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
- hw/arm/fsl-imx6.c           |   7 +++
+ hw/ssi/imx_spi.c                   |  2 +-
- hw/arm/fsl-imx7.c           |   9 +++
+ hw/ssi/xilinx_spi.c                |  2 +-
- hw/arm/palm.c               | 111 +++++++++++++++++++++++++------------
+ target/arm/arch_dump.c             |  8 +++---
- hw/arm/tosa.c               | 132 +++++++++++++++++++++++++++++---------------
+ target/arm/arm-semi.c              |  8 +++---
- hw/nios2/cpu_pic.c          |   3 +-
+ target/arm/helper.c                |  2 +-
- hw/virtio/virtio-iommu.c    |   1 +
+ target/arm/op_helper.c             | 23 +++++++++-------
- hw/xen/xen-legacy-backend.c |   1 -
+ target/arm/translate-a64.c         |  4 +--
- os-posix.c                  |   4 ++
+ target/arm/translate.c             |  2 +-
- target/arm/helper.c         |   4 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
- target/arm/translate-sve.c  |   2 +-
+ hw/arm/Kconfig                     |  3 +-
- target/nios2/translate.c    |  12 +++-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
- util/compatfd.c             |   2 +
+files changed, 123 insertions(+), 98 deletions(-)
- util/drm.c                  |  19 +++++--
+ create mode 100644 docs/system/arm/sbsa.rst
  util/oslib-posix.c          |  20 ++++++-
  util/qemu-openpty.c         |   2 +-
 files changed, 292 insertions(+), 103 deletions(-)

-[PULL 07/25] virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
-From: Eric Auger <eric.auger@redhat.com>
+From: Andrew Jones <drjones@redhat.com>
-Coverity points out (CID 1430180) that the new case is missing
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
-break or a /* fallthrough */ comment. Break is the right thing to
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
-do as in that case, tail is not used.
+in the build when building armv7m_systick.
-Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20201104103343.30392-1-drjones@redhat.com
 Message-id: 20200708160147.18426-1-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/virtio/virtio-iommu.c | 1 +
+ hw/arm/Kconfig | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-iommu.c
+--- a/hw/arm/Kconfig
-+++ b/hw/virtio/virtio-iommu.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
-             ptail = (struct virtio_iommu_req_tail *)
-                         (buf + s->config.probe_size);
+ config ARM_V7M
-             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+     bool
-+            break;
++    select PTIMER
-         }
-         default:
+ config ALLWINNER_A10
-             tail.status = VIRTIO_IOMMU_S_UNSUPP;
+     bool
 --
 .20.1

-[PULL 24/25] hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+[PULL 02/16] ssi: Fix bad printf format specifiers
-Replace the free-floating set of IRQs and palmte_onoff_gpios()
+From: AlexChen <alex.chen@huawei.com>
 function with a simple QOM device that encapsulates this
 behaviour.
-This fixes Coverity issue CID 1421944, which points out that
+We should use printf format specifier "%u" instead of "%d" for
-the memory returned by qemu_allocate_irqs() is leaked.
+argument of type "unsigned int".
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628214230.2592-3-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 61 +++++++++++++++++++++++++++++++++++++++++++--------
+ hw/ssi/imx_spi.c    | 2 +-
-file changed, 52 insertions(+), 9 deletions(-)
+ hw/ssi/xilinx_spi.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/hw/ssi/imx_spi.c
-+++ b/hw/arm/palm.c
++++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@ static void palmte_button_event(void *opaque, int keycode)
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
-                         !(keycode & 0x80));
+     case ECSPI_MSGDATA:
- }
+         return  "ECSPI_MSGDATA";
+     default:
-+/*
+-        sprintf(unknown, "%d ?", reg);
-+ * Encapsulation of some GPIO line behaviour for the Palm board
++        sprintf(unknown, "%u ?", reg);
-+ *
+         return unknown;
 + * QEMU interface:
 + *  + unnamed GPIO inputs 0..6: for the various miscellaneous input lines
 + */
 +
 +#define TYPE_PALM_MISC_GPIO "palm-misc-gpio"
 +#define PALM_MISC_GPIO(obj) \
 +    OBJECT_CHECK(PalmMiscGPIOState, (obj), TYPE_PALM_MISC_GPIO)
 +
 +typedef struct PalmMiscGPIOState {
 +    SysBusDevice parent_obj;
 +} PalmMiscGPIOState;
 +
  static void palmte_onoff_gpios(void *opaque, int line, int level)
  {
      switch (line) {
@@ -XXX,XX +XXX,XX @@ static void palmte_onoff_gpios(void *opaque, int line, int level)
      }
  }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
-+static void palm_misc_gpio_init(Object *obj)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/hw/ssi/xilinx_spi.c
-+    DeviceState *dev = DEVICE(obj);
++++ b/hw/ssi/xilinx_spi.c
-+
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
-+    qdev_init_gpio_in(dev, palmte_onoff_gpios, 7);
+        irq chain unless things really changed.  */
-+}
+     if (pending != s->irqline) {
-+
+         s->irqline = pending;
-+static const TypeInfo palm_misc_gpio_info = {
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
-+    .name = TYPE_PALM_MISC_GPIO,
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
-+    .parent = TYPE_SYS_BUS_DEVICE,
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
-+    .instance_size = sizeof(PalmMiscGPIOState),
+         qemu_set_irq(s->irq, pending);
-+    .instance_init = palm_misc_gpio_init,
+     }
 +    /*
 +     * No class init required: device has no internal state so does not
 +     * need to set up reset or vmstate, and has no realize method.
 +     */
 +};
 +
  static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
  {
 -    qemu_irq *misc_gpio;
 +    DeviceState *misc_gpio;
 +
 +    misc_gpio = sysbus_create_simple(TYPE_PALM_MISC_GPIO, -1, NULL);
      omap_mmc_handlers(cpu->mmc,
                      qdev_get_gpio_in(cpu->gpio, PALMTE_MMC_WP_GPIO),
                      qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
                              [PALMTE_MMC_SWITCH_GPIO]));
 -    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
 -    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
 -    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
 -    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
 -    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
 -    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,
 +                          qdev_get_gpio_in(misc_gpio, 0));
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,
 +                          qdev_get_gpio_in(misc_gpio, 1));
 +    qdev_connect_gpio_out(cpu->gpio, 11, qdev_get_gpio_in(misc_gpio, 2));
 +    qdev_connect_gpio_out(cpu->gpio, 12, qdev_get_gpio_in(misc_gpio, 3));
 +    qdev_connect_gpio_out(cpu->gpio, 13, qdev_get_gpio_in(misc_gpio, 4));
 +    omap_mpuio_out_set(cpu->mpuio, 1, qdev_get_gpio_in(misc_gpio, 5));
 +    omap_mpuio_out_set(cpu->mpuio, 3, qdev_get_gpio_in(misc_gpio, 6));
      /* Reset some inputs to initial state.  */
      qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
@@ -XXX,XX +XXX,XX @@ static void palmte_machine_init(MachineClass *mc)
  }
  DEFINE_MACHINE("cheetah", palmte_machine_init)
 +
 +static void palm_register_types(void)
 +{
 +    type_register_static(&palm_misc_gpio_info);
 +}
 +
 +type_init(palm_register_types)
 --
 .20.1

-[PULL 06/25] target/arm: Don't do raw writes for PMINTENCLR
+[PULL 03/16] target/arm: add spaces around operator
-From: Aaron Lindsay <aaron@os.amperecomputing.com>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Raw writes to this register when in KVM mode can cause interrupts to be
+Fix code style. Operator needs spaces both sides.
 raised (even when the PMU is disabled). Because the underlying state is
 already aliased to PMINTENSET (which already provides raw write
 functions), we can safely disable raw accesses to PMINTENCLR entirely.
-Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
 Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 4 ++--
+ target/arm/arch_dump.c | 8 ++++----
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/arm-semi.c  | 8 ++++----
  target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arch_dump.c
++++ b/target/arm/arch_dump.c
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     }
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
+         for (i = 0; i < 32; ++i) {
+             uint64_t tmp = note.vfp.vregs[2*i];
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-            note.vfp.vregs[2*i+1] = tmp;
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++            note.vfp.vregs[2 * i + 1] = tmp;
+         }
+     }
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         if (use_gdb_syscalls()) {
+             arm_semi_open_guestfd = guestfd;
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
+         } else {
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
+             if (ret == (uint32_t)-1) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
+-                                  arg0, (int)arg1+1);
++                                  arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(3);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
+         } else {
+             char *s2;
+             s = lock_user_string(arg0);
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
+-                                   arg0, (int)arg1+1);
++                                   arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
-       .resetvalue = 0x0 },
+     uint32_t sum;
-     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
+     sum = do_usad(a, b);
-       .access = PL1_RW, .accessfn = access_tpm,
+     sum += do_usad(a >> 8, b >> 8);
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
+-    sum += do_usad(a >> 16, b >>16);
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
++    sum += do_usad(a >> 16, b >> 16);
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+     sum += do_usad(a >> 24, b >> 24);
-       .writefn = pmintenclr_write, },
+     return sum;
-     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
+ }
        .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
        .access = PL1_RW, .accessfn = access_tpm,
 -      .type = ARM_CP_ALIAS | ARM_CP_IO,
 +      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
        .writefn = pmintenclr_write },
      { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
 --
 .20.1

-[PULL 10/25] build: Check that mlockall() exists
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-From: David CARLIER <devnexen@gmail.com>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Instead of assuming that all POSIX platforms provide mlockall(),
+Fix code style. Don't use '#' flag of printf format ('%#') in
-test for it in configure. If the host doesn't provide this platform
+format strings, use '0x' prefix instead
 then os_mlock() will fail -ENOSYS, as it does already on Windows.
-This is necessary for Haiku, which does not have mlockall().
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Signed-off-by: David Carlier <devnexen@gmail.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200703145614.16684-4-peter.maydell@linaro.org
 [PMM: Expanded commit message; rename to HAVE_MLOCKALL]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- configure  | 15 +++++++++++++++
+ target/arm/translate-a64.c | 4 ++--
- os-posix.c |  4 ++++
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 19 insertions(+)
-diff --git a/configure b/configure
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
@@ -XXX,XX +XXX,XX @@ else
    pty_h=no
  fi
 +cat > $TMPC <<EOF
 +#include <sys/mman.h>
 +int main(int argc, char *argv[]) {
 +    return mlockall(MCL_FUTURE);
 +}
 +EOF
 +if compile_prog "" "" ; then
 +  have_mlockall=yes
 +else
 +  have_mlockall=no
 +fi
 +
  #########################################
  # vhost interdependencies and host support
@@ -XXX,XX +XXX,XX @@ fi
  if test "$pty_h" = "yes" ; then
    echo "HAVE_PTY_H=y" >> $config_host_mak
  fi
 +if test "$have_mlockall" = "yes" ; then
 +  echo "HAVE_MLOCKALL=y" >> $config_host_mak
 +fi
  if test "$fuzzing" = "yes" ; then
    if test "$have_fuzzer" = "yes"; then
      FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
 diff --git a/os-posix.c b/os-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/os-posix.c
+--- a/target/arm/translate-a64.c
-+++ b/os-posix.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ bool is_daemonized(void)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
- int os_mlock(void)
+                 break;
- {
+             default:
-+#ifdef HAVE_MLOCKALL
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-     int ret = 0;
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
+                         __func__, insn, fpopcode, s->pc_curr);
-     ret = mlockall(MCL_CURRENT | MCL_FUTURE);
+                 g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ int os_mlock(void)
+             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      case 0x7f: /* FSQRT (vector) */
          break;
      default:
 -        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
 +        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
-     return ret;
-+#else
-+    return -ENOSYS;
-+#endif
- }
 --
 .20.1

-[PULL 19/25] target/nios2: Use gen_io_start around wrctl instruction
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-From: Wentong Wu <wentong.wu@intel.com>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-wrctl instruction on nios2 target will cause checking cpu
+Fix code style. Space required before the open parenthesis '('.
 interrupt but tcg_handle_interrupt() will call cpu_abort()
 if the CPU gets an interrupt while it's not in 'can do IO'
 state, so add gen_io_start around wrctl instruction. Also
 at the same time, end the onging TB with DISAS_UPDATE.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Message-id: 20200710233433.19729-3-wentong.wu@intel.com
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
 Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/nios2/translate.c | 5 +++++
+ target/arm/translate.c | 2 +-
-file changed, 5 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/target/arm/translate.c
-+++ b/target/nios2/translate.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
- #include "exec/cpu_ldst.h"
+             - Hardware watchpoints.
- #include "exec/translator.h"
+            Hardware breakpoints have already been handled and skip this code.
- #include "qemu/qemu-print.h"
+          */
-+#include "exec/gen-icount.h"
+-        switch(dc->base.is_jmp) {
++        switch (dc->base.is_jmp) {
- /* is_jmp field values */
+         case DISAS_NEXT:
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
+         case DISAS_TOO_MANY:
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
+             gen_goto_tb(dc, 1, dc->base.pc_next);
      /* If interrupts were enabled using WRCTL, trigger them. */
  #if !defined(CONFIG_USER_ONLY)
      if ((instr.imm5 + CR_BASE) == CR_STATUS) {
 +        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
 +            gen_io_start();
 +        }
          gen_helper_check_interrupts(dc->cpu_env);
 +        dc->is_jmp = DISAS_UPDATE;
      }
  #endif
  }
 --
 .20.1

-[PULL 18/25] target/nios2: in line the semantics of DISAS_UPDATE with other targets
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-From: Wentong Wu <wentong.wu@intel.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-In line the semantics of DISAS_UPDATE on nios2 target with other targets
+We should at least document what this machine is about.
 which is to explicitly write the PC back into the cpu state before doing
 a tcg_gen_exit_tb().
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Message-id: 20200710233433.19729-2-wentong.wu@intel.com
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
 Cc: Leif Lindholm <leif@nuviainc.com>
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/nios2/translate.c | 2 +-
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+), 1 deletion(-)
+ docs/system/target-arm.rst |  1 +
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
 +Arm Server Base System Architecture Reference board (``sbsa-ref``)
 +==================================================================
 +
 +While the `virt` board is a generic board platform that doesn't match
 +any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
+--- a/docs/system/target-arm.rst
-+++ b/target/nios2/translate.c
++++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-     /* Indicate where the next block should start */
+    arm/mps2
-     switch (dc->is_jmp) {
+    arm/musca
-     case DISAS_NEXT:
+    arm/realview
-+    case DISAS_UPDATE:
++   arm/sbsa
-         /* Save the current PC back into the CPU register */
+    arm/versatile
-         tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
+    arm/vexpress
-         tcg_gen_exit_tb(NULL, 0);
+    arm/aspeed
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
      default:
      case DISAS_JUMP:
 -    case DISAS_UPDATE:
          /* The jump will already have updated the PC register */
          tcg_gen_exit_tb(NULL, 0);
          break;
 --
 .20.1

-[PULL 16/25] util/drm: make portable by avoiding struct dirent d_type
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
-From: Gerd Hoffmann <kraxel@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Given this isn't perforance critical at all lets avoid the non-portable
+When using a Cortex-A15, the Virt machine does not use any
-d_type and use fstat instead to check whenever the file is a chardev.
+MPCore peripherals. Remove the dependency.
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
-Reported-by: David Carlier <devnexen@gmail.com>
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20201107114852.271922-1-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200703145614.16684-10-peter.maydell@linaro.org
 Message-id: 20200701180302.14821-1-kraxel@redhat.com
 [PMM: fixed comment style; tweaked subject line]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/drm.c | 19 ++++++++++++++-----
+ hw/arm/Kconfig | 1 -
-file changed, 14 insertions(+), 5 deletions(-)
+file changed, 1 deletion(-)
-diff --git a/util/drm.c b/util/drm.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/util/drm.c
+--- a/hw/arm/Kconfig
-+++ b/util/drm.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
- {
+     imply VFIO_PLATFORM
-     DIR *dir;
+     imply VFIO_XGMAC
-     struct dirent *e;
+     imply TPM_TIS_SYSBUS
--    int r, fd;
+-    select A15MPCORE
-+    struct stat st;
+     select ACPI
-+    int r, fd, ret;
+     select ARM_SMMUV3
-     char *p;
+     select GPIO_KEY
      if (rendernode) {
@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
      fd = -1;
      while ((e = readdir(dir))) {
 -        if (e->d_type != DT_CHR) {
 -            continue;
 -        }
 -
          if (strncmp(e->d_name, "renderD", 7)) {
              continue;
          }
@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
              g_free(p);
              continue;
          }
 +
 +        /*
 +         * prefer fstat() over checking e->d_type == DT_CHR for
 +         * portability reasons
 +         */
 +        ret = fstat(r, &st);
 +        if (ret < 0 || (st.st_mode & S_IFMT) != S_IFCHR) {
 +            close(r);
 +            g_free(p);
 +            continue;
 +        }
 +
          fd = r;
          g_free(p);
          break;
 --
 .20.1

-[PULL 02/25] target/arm: Fix mtedesc for do_mem_zpz
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
 From: Richard Henderson <richard.henderson@linaro.org>
-The mtedesc that was constructed was not actually passed in.
+The helper function did not get updated when we reorganized
-Found by Coverity (CID 1429996).
+the vector register file for SVE.  Since then, the neon dregs
 are non-sequential and cannot be simply indexed.
-Fixes: d28d12f008e
+At the same time, make the helper function operate on 64-bit
 quantities so that we do not have to call it twice.
 Fixes: c39c2b9043e
 Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+[PMM: use aa32_vfp_dreg() rather than opencoding]
-Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
+Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-sve.c | 2 +-
+ target/arm/helper.h             |  2 +-
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/op_helper.c          | 23 +++++++++--------
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/target/arm/helper.h
-+++ b/target/arm/translate-sve.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
-         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
-         desc <<= SVE_MTEDESC_SHIFT;
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
  DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
 -DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
 -uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
 -                          uint32_t maxindex)
 +uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
 +                          uint64_t ireg, uint64_t def)
  {
 -    uint32_t val, shift;
 -    uint64_t *table = vn;
 +    uint64_t tmp, val = 0;
 +    uint32_t maxindex = ((desc & 3) + 1) * 8;
 +    uint32_t base_reg = desc >> 2;
 +    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
--    desc = simd_desc(vsz, vsz, scale);
+     return val;
-+    desc = simd_desc(vsz, vsz, desc | scale);
+ }
-     t_desc = tcg_const_i32(desc);
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+index XXXXXXX..XXXXXXX 100644
-     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
+--- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
 +    tcg_temp_free_i64(def);
 +    tcg_temp_free_i64(val);
 +    tcg_temp_free_i32(desc);
      return true;
  }
 --
 .20.1

-[PULL 25/25] hw/arm/aspeed: Do not create and attach empty SD cards by default
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Since added in commit 2bea128c3d, each SDHCI is wired with a SD
+We can use one MPC per SRAM bank, but we currently only wire the
-card, using empty card when no block drive provided. This is not
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
 the desired behavior. The SDHCI exposes a SD bus to plug cards
 on, if no card available, it is fine to have an unplugged bus.
-Avoid creating unnecessary SD card device when no block drive
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
 provided.
 Fixes: 2bea128c3d ("hw/sd/aspeed_sdhci: New device")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200705173402.15620-1-f4bug@amsat.org
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed.c | 9 +++++----
+ hw/arm/armsse.c | 3 ++-
-file changed, 5 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/arm/armsse.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
- {
+                                         qdev_get_gpio_in(dev_splitter, 0));
-         DeviceState *card;
+             qdev_connect_gpio_out(dev_splitter, 0,
+                                   qdev_get_gpio_in_named(dev_secctl,
--        card = qdev_new(TYPE_SD_CARD);
+-                                                         "mpc_status", 0));
--        if (dinfo) {
++                                                         "mpc_status",
--            qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
++                                                         i - IOTS_NUM_EXP_MPC));
 -                                    &error_fatal);
 +        if (!dinfo) {
 +            return;
          }
-+        card = qdev_new(TYPE_SD_CARD);
-+        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
+         qdev_connect_gpio_out(dev_splitter, 1,
 +                                &error_fatal);
          qdev_realize_and_unref(card,
                                 qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
                                 &error_fatal);
 --
 .20.1

-[PULL 15/25] util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
-From: David CARLIER <devnexen@gmail.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The qemu_init_exec_dir() function is inherently non-portable;
+The system configuration controller (SYSCFG) doesn't have
-provide an implementation for Haiku hosts.
+any output IRQ (and the INTC input #71 belongs to the UART6).
 Remove the invalid code.
-Signed-off-by: David Carlier <devnexen@gmail.com>
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
 Message-id: 20200703145614.16684-9-peter.maydell@linaro.org
 [PMM: Expanded commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/oslib-posix.c | 19 +++++++++++++++++++
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
-file changed, 19 insertions(+)
+ hw/arm/stm32f205_soc.c             | 1 -
  hw/misc/stm32f2xx_syscfg.c         | 2 --
 files changed, 5 deletions(-)
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/util/oslib-posix.c
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
- #include <mach-o/dyld.h>
+     uint32_t syscfg_exticr3;
- #endif
+     uint32_t syscfg_exticr4;
+     uint32_t syscfg_cmpcr;
-+#ifdef __HAIKU__
+-
-+#include <kernel/image.h>
+-    qemu_irq irq;
-+#endif
+ };
-+
- #include "qemu/mmap-alloc.h"
+ #endif /* HW_STM32F2XX_SYSCFG_H */
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
- #ifdef CONFIG_DEBUG_STACK_USAGE
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ void qemu_init_exec_dir(const char *argv0)
+--- a/hw/arm/stm32f205_soc.c
-             }
++++ b/hw/arm/stm32f205_soc.c
-         }
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
      }
-+#elif defined(__HAIKU__)
+     busdev = SYS_BUS_DEVICE(dev);
-+    {
+     sysbus_mmio_map(busdev, 0, 0x40013800);
-+        image_info ii;
+-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
-+        int32_t c = 0;
-+
+     /* Attach UART (uses USART registers) and USART controllers */
-+        *buf = '\0';
+     for (i = 0; i < STM_NUM_USARTS; i++) {
-+        while (get_next_image_info(0, &c, &ii) == B_OK) {
+diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
-+            if (ii.type == B_APP_IMAGE) {
+index XXXXXXX..XXXXXXX 100644
-+                strncpy(buf, ii.name, sizeof(buf));
+--- a/hw/misc/stm32f2xx_syscfg.c
-+                buf[sizeof(buf) - 1] = 0;
++++ b/hw/misc/stm32f2xx_syscfg.c
-+                p = buf;
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
-+                break;
+ {
-+            }
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
-+        }
-+    }
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
- #endif
+-
-     /* If we don't have any way of figuring out the actual executable
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
-        location then try argv[0].  */
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
      sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 --
 .20.1

-[PULL 20/25] hw/nios2: exit to main CPU loop only when unmasking interrupts
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-From: Wentong Wu <wentong.wu@intel.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Only when guest code is unmasking interrupts, terminate the excution
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-of translated code and exit to the main CPU loop to handle previous
+OMAP2 chip support") takes care of creating the 3 UARTs.
 pended interrupts because of the interrupts mask by guest code.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
+Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
-Message-id: 20200710233433.19729-4-wentong.wu@intel.com
+extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
 Fortunately we don't need to fix this, because commit 6da68df7f9b
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/nios2/cpu_pic.c | 3 ++-
+ hw/arm/nseries.c | 11 -----------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 11 deletions(-)
-diff --git a/hw/nios2/cpu_pic.c b/hw/nios2/cpu_pic.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/nios2/cpu_pic.c
+--- a/hw/arm/nseries.c
-+++ b/hw/nios2/cpu_pic.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_pic_cpu_handler(void *opaque, int irq, int level)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
- void nios2_check_interrupts(CPUNios2State *env)
+ }
 -static void n8x0_uart_setup(struct n800_s *s)
 -{
 -    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
 -    /*
 -     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
 -     * here, but this code has been removed with the bluetooth backend.
 -     */
 -    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -}
 -
  static void n8x0_usb_setup(struct n800_s *s)
  {
--    if (env->irq_pending) {
+     SysBusDevice *dev;
-+    if (env->irq_pending &&
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-+        (env->regs[CR_STATUS] & CR_STATUS_PIE)) {
+     n8x0_spi_setup(s);
-         env->irq_pending = 0;
+     n8x0_dss_setup(s);
-         cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HARD);
+     n8x0_cbus_setup(s);
 -    n8x0_uart_setup(s);
      if (machine_usb(machine)) {
          n8x0_usb_setup(s);
      }
 --
 .20.1

-[PULL 14/25] util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-From: David CARLIER <devnexen@gmail.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-util/compatfd.c includes <sys/syscall.h> so that the CONFIG_SIGNALFD
+The MusicPal board code connects both of the IRQ outputs of the UART
-code can use SYS_signalfd. Guard the #include with CONFIG_SIGNALFD
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-to avoid portability issues on hosts like Haiku which do not
+to the same input is not valid as it produces subtly wrong behaviour
-provide that header file.
+(for instance if both the IRQ lines are high, and then one goes
 low, the INTC input will see this as a high-to-low transition
 even though the second IRQ line should still be holding it high).
-Signed-off-by: David Carlier <devnexen@gmail.com>
+This kind of wiring needs an explicitly created OR gate; add one.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200703145614.16684-8-peter.maydell@linaro.org
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
 [PMM: Expanded commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/compatfd.c | 2 ++
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 2 insertions(+)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/util/compatfd.c b/util/compatfd.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/compatfd.c
+--- a/hw/arm/musicpal.c
-+++ b/util/compatfd.c
++++ b/hw/arm/musicpal.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
+ #include "ui/console.h"
- #include "qemu/thread.h"
+ #include "hw/i2c/i2c.h"
+ #include "hw/irq.h"
-+#if defined(CONFIG_SIGNALFD)
++#include "hw/or-irq.h"
- #include <sys/syscall.h>
+ #include "hw/audio/wm8750.h"
-+#endif
+ #include "sysemu/block-backend.h"
+ #include "sysemu/runstate.h"
- struct sigfd_compat_info
+@@ -XXX,XX +XXX,XX @@
- {
+ #define MP_TIMER4_IRQ           7
  #define MP_EHCI_IRQ             8
  #define MP_ETH_IRQ              9
 -#define MP_UART1_IRQ            11
 -#define MP_UART2_IRQ            11
 +#define MP_UART_SHARED_IRQ      11
  #define MP_GPIO_IRQ             12
  #define MP_RTC_IRQ              28
  #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
      ARMCPU *cpu;
      qemu_irq pic[32];
      DeviceState *dev;
 +    DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
 +    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 0),
                     1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 -    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
 +    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 1),
                     1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
      /* Register flash */
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
  config MUSICPAL
      bool
 +    select OR_IRQ
      select BITBANG_I2C
      select MARVELL_88W8618
      select PTIMER
 --
 .20.1

-[PULL 01/25] hw/arm/bcm2836: Remove unused 'cpu_type' field
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The 'cpu_type' has been moved from BCM283XState to BCM283XClass
+We don't need to fill the full pic[] array if we only use
-in commit 210f47840d, but we forgot to remove the old variable.
+few of the interrupt lines. Directly call qdev_get_gpio_in()
-Do it now.
+when necessary.
-Fixes: 210f47840d ("hw/arm/bcm2836: Hardcode correct CPU type")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Message-id: 20200703200459.23294-1-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2836.h | 1 -
+ hw/arm/musicpal.c | 25 +++++++++++++------------
-file changed, 1 deletion(-)
+file changed, 13 insertions(+), 12 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/hw/arm/musicpal.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-     DeviceState parent_obj;
+ static void musicpal_init(MachineState *machine)
-     /*< public >*/
+ {
+     ARMCPU *cpu;
--    char *cpu_type;
+-    qemu_irq pic[32];
-     uint32_t enabled_cpus;
+     DeviceState *dev;
++    DeviceState *pic;
-     struct {
+     DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                             &error_fatal);
      memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 -    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
 +    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                 qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
 -    for (i = 0; i < 32; i++) {
 -        pic[i] = qdev_get_gpio_in(dev, i);
 -    }
 -    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
 -                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
 -                          pic[MP_TIMER4_IRQ], NULL);
 +    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
 +                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
 +                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
      /* Logically OR both UART IRQs together */
      uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
      object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
      qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 -    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
 +                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
      serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                     qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               OBJECT(get_system_memory()), &error_fatal);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
 .20.1

-[PULL 03/25] Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx25.h | 1 +
- hw/arm/fsl-imx25.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
-     MemoryRegion   rom[2];
-     MemoryRegion   iram;
-     MemoryRegion   iram_alias;
-+    uint32_t       phy_num;
- } FslIMX25State;
- /**
-diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx25.c
-+++ b/hw/arm/fsl-imx25.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                             epit_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                 &s->iram_alias);
- }
-+static Property fsl_imx25_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx25_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx25_properties);
-     dc->realize = fsl_imx25_realize;
-     dc->desc = "i.MX25 SOC";
-     /*
---
-.20.1

-[PULL 04/25] Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx6.h | 1 +
- hw/arm/fsl-imx6.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
-+++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
-     MemoryRegion   caam;
-     MemoryRegion   ocram;
-     MemoryRegion   ocram_alias;
-+    uint32_t       phy_num;
- } FslIMX6State;
-diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
-+++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                             spi_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                 &s->ocram_alias);
- }
-+static Property fsl_imx6_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx6_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx6_properties);
-     dc->realize = fsl_imx6_realize;
-     dc->desc = "i.MX6 SOC";
-     /* Reason: Uses serial_hd() in the realize() function */
---
-.20.1

-[PULL 05/25] Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx7.h | 1 +
- hw/arm/fsl-imx7.c         | 9 +++++++++
-files changed, 10 insertions(+)
-diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx7.h
-+++ b/include/hw/arm/fsl-imx7.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
-     IMX7GPRState       gpr;
-     ChipideaState      usb[FSL_IMX7_NUM_USBS];
-     DesignwarePCIEHost pcie;
-+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
- } FslIMX7State;
- enum FslIMX7MemoryMap {
-diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx7.c
-+++ b/hw/arm/fsl-imx7.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-             FSL_IMX7_ENET2_ADDR,
-         };
-+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
-+                                 s->phy_num[i], &error_abort);
-         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
-                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
-         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-                                 FSL_IMX7_PCIE_PHY_SIZE);
- }
-+static Property fsl_imx7_properties[] = {
-+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
-+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx7_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx7_properties);
-     dc->realize = fsl_imx7_realize;
-     /* Reason: Uses serial_hds and nd_table in realize() directly */
---
-.20.1

-[PULL 08/25] build: Enable BSD symbols for Haiku
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Tell Haiku to provide various BSD functions by setting BSD_SOURCE
-and linking libbsd.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-2-peter.maydell@linaro.org
-[PMM: expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ SunOS)
- ;;
- Haiku)
-   haiku="yes"
--  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS $QEMU_CFLAGS"
--  LIBS="-lposix_error_mapper -lnetwork $LIBS"
-+  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS -DBSD_SOURCE $QEMU_CFLAGS"
-+  LIBS="-lposix_error_mapper -lnetwork -lbsd $LIBS"
- ;;
- Linux)
-   audio_drv_list="try-pa oss"
---
-.20.1

-[PULL 09/25] util/qemu-openpty.c: Don't assume pty.h is glibc-only
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Instead of using an OS-specific ifdef test to select the "openpty()
-is in pty.h" codepath, make configure check for the existence of
-the header and use the new CONFIG_PTY instead.
-This is necessary to build on Haiku, which also provides openpty()
-via pty.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-3-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_PTY_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure           | 9 +++++++++
- util/qemu-openpty.c | 2 +-
-files changed, 10 insertions(+), 1 deletion(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ else
-   l2tpv3=no
- fi
-+if check_include "pty.h" ; then
-+  pty_h=yes
-+else
-+  pty_h=no
-+fi
-+
- #########################################
- # vhost interdependencies and host support
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$sheepdog" = "yes" ; then
-   echo "CONFIG_SHEEPDOG=y" >> $config_host_mak
- fi
-+if test "$pty_h" = "yes" ; then
-+  echo "HAVE_PTY_H=y" >> $config_host_mak
-+fi
- if test "$fuzzing" = "yes" ; then
-   if test "$have_fuzzer" = "yes"; then
-     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
-diff --git a/util/qemu-openpty.c b/util/qemu-openpty.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-openpty.c
-+++ b/util/qemu-openpty.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
--#if defined(__GLIBC__)
-+#if defined HAVE_PTY_H
- # include <pty.h>
- #elif defined CONFIG_BSD
- # include <termios.h>
---
-.20.1

-[PULL 11/25] osdep.h: Always include <sys/signal.h> if it exists
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Regularize our handling of <sys/signal.h>: currently we include it in
-osdep.h, but only for OpenBSD, and we include it without an ifdef
-guard in a couple of C files.  This causes problems for Haiku, which
-doesn't have that header.
-Instead, check in configure whether sys/signal.h exists, and if it
-does then always include it from osdep.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-5-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_SYS_SIGNAL_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure                   | 10 ++++++++++
- include/qemu/osdep.h        |  2 +-
- hw/xen/xen-legacy-backend.c |  1 -
- util/oslib-posix.c          |  1 -
-files changed, 11 insertions(+), 3 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ if check_include "libdrm/drm.h" ; then
-     have_drm_h=yes
- fi
-+#########################################
-+# sys/signal.h check
-+have_sys_signal_h=no
-+if check_include "sys/signal.h" ; then
-+  have_sys_signal_h=yes
-+fi
-+
- ##########################################
- # VTE probe
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$have_openpty" = "yes" ; then
-     echo "HAVE_OPENPTY=y" >> $config_host_mak
- fi
-+if test "$have_sys_signal_h" = "yes" ; then
-+    echo "HAVE_SYS_SIGNAL_H=y" >> $config_host_mak
-+fi
- # Work around a system header bug with some kernel/XFS header
- # versions where they both try to define 'struct fsxattr':
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
- #include <setjmp.h>
- #include <signal.h>
--#ifdef __OpenBSD__
-+#ifdef HAVE_SYS_SIGNAL_H
- #include <sys/signal.h>
- #endif
-diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/xen/xen-legacy-backend.c
-+++ b/hw/xen/xen-legacy-backend.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
--#include <sys/signal.h>
- #include "hw/sysbus.h"
- #include "hw/boards.h"
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
-+++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/sockets.h"
- #include "qemu/thread.h"
- #include <libgen.h>
--#include <sys/signal.h>
- #include "qemu/cutils.h"
- #ifdef CONFIG_LINUX
---
-.20.1

-[PULL 12/25] osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Haiku doesn't provide SIGIO; fix this up in osdep.h by defining it as
-equal to SIGPOLL.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-6-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/osdep.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
- #define HAVE_CHARDEV_PARPORT 1
- #endif
-+#if defined(__HAIKU__)
-+#define SIGIO SIGPOLL
-+#endif
-+
- #if defined(CONFIG_LINUX)
- #ifndef BUS_MCEERR_AR
- #define BUS_MCEERR_AR 4
---
-.20.1

-[PULL 22/25] hw/arm/tosa: Encapsulate misc GPIO handling in a device
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
-Currently we have a free-floating set of IRQs and a function
+The nseries machines have a codepath that allows them to load a
-tosa_out_switch() which handle the GPIO lines on the tosa board which
+secondary bootloader.  This code wasn't checking that the
-connect to LEDs, and another free-floating IRQ and tosa_reset()
+load_image_targphys() succeeded.  Check the return value and report
-function to handle the GPIO line that resets the system.  Encapsulate
+the error to the user.
 this behaviour in a simple QOM device.
-This commit fixes Coverity issue CID 1421929 (which pointed out that
+While we're in the vicinity, fix the comment style of the
-the 'outsignals' in tosa_gpio_setup() were leaked), because it
+comment documenting what this image load is doing.
 removes the use of the qemu_allocate_irqs() API from this code
 entirely.
+Fixes: Coverity CID 1192904
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628203748.14250-3-peter.maydell@linaro.org
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
 ---
- hw/arm/tosa.c | 88 +++++++++++++++++++++++++++++++++++++--------------
+ hw/arm/nseries.c | 15 +++++++++++----
-file changed, 64 insertions(+), 24 deletions(-)
+file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
+--- a/hw/arm/nseries.c
-+++ b/hw/arm/tosa.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static void tosa_microdrive_attach(PXA2xxState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-     pxa2xx_pcmcia_attach(cpu->pcmcia[0], md);
+         /* No, wait, better start at the ROM.  */
- }
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
--static void tosa_out_switch(void *opaque, int line, int level)
+-        /* This is intended for loading the `secondary.bin' program from
-+/*
++        /*
-+ * Encapsulation of some GPIO line behaviour for the Tosa board
++         * This is intended for loading the `secondary.bin' program from
-+ *
+          * Nokia images (the NOLO bootloader).  The entry point seems
-+ * QEMU interface:
+          * to be at OMAP2_Q2_BASE + 0x400000.
-+ *  + named GPIO inputs "leds[0..3]": assert to light LEDs
+          *
-+ *  + named GPIO input "reset": when asserted, resets the system
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-+ */
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
-+
+          *
-+#define TYPE_TOSA_MISC_GPIO "tosa-misc-gpio"
+          * The code above is for loading the `zImage' file from Nokia
-+#define TOSA_MISC_GPIO(obj) \
+-         * images.  */
-+    OBJECT_CHECK(TosaMiscGPIOState, (obj), TYPE_TOSA_MISC_GPIO)
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-+
+-                            machine->ram_size - 0x400000);
-+typedef struct TosaMiscGPIOState {
++         * images.
-+    SysBusDevice parent_obj;
++         */
-+} TosaMiscGPIOState;
++        if (load_image_targphys(option_rom[0].name,
-+
++                                OMAP2_Q2_BASE + 0x400000,
-+static void tosa_gpio_leds(void *opaque, int line, int level)
++                                machine->ram_size - 0x400000) < 0) {
- {
++            error_report("Failed to load secondary bootloader %s",
-     switch (line) {
++                         option_rom[0].name);
--        case 0:
++            exit(EXIT_FAILURE);
--            fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
++        }
--            break;
--        case 1:
+         n800_setup_nolo_tags(nolo_tags);
--            fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
+         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
 -            break;
 -        case 2:
 -            fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 3:
 -            fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 -            break;
 -        default:
 -            fprintf(stderr, "Uhandled out event: %d = %d\n", line, level);
 -            break;
 +    case 0:
 +        fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 1:
 +        fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 2:
 +        fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 3:
 +        fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 +        break;
 +    default:
 +        g_assert_not_reached();
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tosa_reset(void *opaque, int line, int level)
      }
  }
 +static void tosa_misc_gpio_init(Object *obj)
 +{
 +    DeviceState *dev = DEVICE(obj);
 +
 +    qdev_init_gpio_in_named(dev, tosa_gpio_leds, "leds", 4);
 +    qdev_init_gpio_in_named(dev, tosa_reset, "reset", 1);
 +}
 +
  static void tosa_gpio_setup(PXA2xxState *cpu,
                  DeviceState *scp0,
                  DeviceState *scp1,
                  TC6393xbState *tmio)
  {
 -    qemu_irq *outsignals = qemu_allocate_irqs(tosa_out_switch, cpu, 4);
 -    qemu_irq reset;
 +    DeviceState *misc_gpio;
 +
 +    misc_gpio = sysbus_create_simple(TYPE_TOSA_MISC_GPIO, -1, NULL);
      /* MMC/SD host */
      pxa2xx_mmci_handlers(cpu->mmc,
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                      qemu_irq_invert(qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_nSD_DETECT)));
      /* Handle reset */
 -    reset = qemu_allocate_irq(tosa_reset, cpu, 0);
 -    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET, reset);
 +    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET,
 +                          qdev_get_gpio_in_named(misc_gpio, "reset", 0));
      /* PCMCIA signals: card's IRQ and Card-Detect */
      pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0],
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                          qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_JC_CF_IRQ),
                          NULL);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED, outsignals[0]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED, outsignals[1]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED, outsignals[2]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED, outsignals[3]);
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 0));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 1));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 2));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 3));
      qdev_connect_gpio_out(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
@@ -XXX,XX +XXX,XX @@ static const TypeInfo tosa_ssp_info = {
      .class_init    = tosa_ssp_class_init,
  };
 +static const TypeInfo tosa_misc_gpio_info = {
 +    .name          = "tosa-misc-gpio",
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(TosaMiscGPIOState),
 +    .instance_init = tosa_misc_gpio_init,
 +    /*
 +     * No class init required: device has no internal state so does not
 +     * need to set up reset or vmstate, and has no realize method.
 +     */
 +};
 +
  static void tosa_register_types(void)
  {
      type_register_static(&tosa_dac_info);
      type_register_static(&tosa_ssp_info);
 +    type_register_static(&tosa_misc_gpio_info);
  }
  type_init(tosa_register_types)
 --
 .20.1

-[PULL 13/25] bswap.h: Include <endian.h> on Haiku for bswap operations
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: David CARLIER <devnexen@gmail.com>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-Haiku puts the bswap* functions in <endian.h>; pull in that
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
-include file on that platform.
+plus one. Currently, it's counting the number of times these transitions
 do _not_ happen, plus one.
-Signed-off-by: David Carlier <devnexen@gmail.com>
+Source:
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+section 2.3.4 point (3).
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
-Message-id: 20200703145614.16684-7-peter.maydell@linaro.org
+Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 [PMM: Expanded commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qemu/bswap.h | 2 ++
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
-file changed, 2 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/bswap.h
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/include/qemu/bswap.h
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
- # include <machine/bswap.h>
+     pi = (double)nr_ones / nr_bits;
- #elif defined(__FreeBSD__)
- # include <sys/endian.h>
+     for (k = 0; k < nr_bits - 1; k++) {
-+#elif defined(__HAIKU__)
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+# include <endian.h>
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
- #elif defined(CONFIG_BYTESWAP_H)
+     }
- # include <byteswap.h>
+     vn_obs += 1;
 --
 .20.1

-[PULL 17/25] target/nios2: add DISAS_NORETURN case for nothing more to generate
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-Add DISAS_NORETURN case for nothing more to generate because at runtime
-execution will never return from some helper call. And at the same time
-replace DISAS_UPDATE in t_gen_helper_raise_exception and gen_exception
-with the newly added DISAS_NORETURN.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-1-wentong.wu@intel.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
-     tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(dc->cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- static bool use_goto_tb(DisasContext *dc, uint32_t dest)
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
-     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- /* generate intermediate code for basic block 'tb'.  */
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         tcg_gen_exit_tb(NULL, 0);
-         break;
-+    case DISAS_NORETURN:
-     case DISAS_TB_JUMP:
-         /* nothing more to generate */
-         break;
---
-.20.1

-[PULL 21/25] hw/arm/tosa.c: Detabify
+Deleted patch
-Remove the hardcoded tabs from hw/arm/tosa.c. There aren't
-many, but since they're all in constant #defines they're not
-going to go away with our usual "only when we touch a function"
-policy on reformatting.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628203748.14250-2-peter.maydell@linaro.org
----
- hw/arm/tosa.c | 44 ++++++++++++++++++++++----------------------
-file changed, 22 insertions(+), 22 deletions(-)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
-+++ b/hw/arm/tosa.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "exec/address-spaces.h"
--#define TOSA_RAM    0x04000000
--#define TOSA_ROM    0x00800000
-+#define TOSA_RAM 0x04000000
-+#define TOSA_ROM 0x00800000
--#define TOSA_GPIO_USB_IN        (5)
--#define TOSA_GPIO_nSD_DETECT    (9)
--#define TOSA_GPIO_ON_RESET        (19)
--#define TOSA_GPIO_CF_IRQ        (21)    /* CF slot0 Ready */
--#define TOSA_GPIO_CF_CD            (13)
--#define TOSA_GPIO_TC6393XB_INT  (15)
--#define TOSA_GPIO_JC_CF_IRQ        (36)    /* CF slot1 Ready */
-+#define TOSA_GPIO_USB_IN                (5)
-+#define TOSA_GPIO_nSD_DETECT            (9)
-+#define TOSA_GPIO_ON_RESET              (19)
-+#define TOSA_GPIO_CF_IRQ                (21)    /* CF slot0 Ready */
-+#define TOSA_GPIO_CF_CD                 (13)
-+#define TOSA_GPIO_TC6393XB_INT          (15)
-+#define TOSA_GPIO_JC_CF_IRQ             (36)    /* CF slot1 Ready */
--#define TOSA_SCOOP_GPIO_BASE    1
--#define TOSA_GPIO_IR_POWERDWN    (TOSA_SCOOP_GPIO_BASE + 2)
--#define TOSA_GPIO_SD_WP            (TOSA_SCOOP_GPIO_BASE + 3)
--#define TOSA_GPIO_PWR_ON        (TOSA_SCOOP_GPIO_BASE + 4)
-+#define TOSA_SCOOP_GPIO_BASE            1
-+#define TOSA_GPIO_IR_POWERDWN           (TOSA_SCOOP_GPIO_BASE + 2)
-+#define TOSA_GPIO_SD_WP                 (TOSA_SCOOP_GPIO_BASE + 3)
-+#define TOSA_GPIO_PWR_ON                (TOSA_SCOOP_GPIO_BASE + 4)
--#define TOSA_SCOOP_JC_GPIO_BASE        1
--#define TOSA_GPIO_BT_LED        (TOSA_SCOOP_JC_GPIO_BASE + 0)
--#define TOSA_GPIO_NOTE_LED        (TOSA_SCOOP_JC_GPIO_BASE + 1)
--#define TOSA_GPIO_CHRG_ERR_LED        (TOSA_SCOOP_JC_GPIO_BASE + 2)
--#define TOSA_GPIO_TC6393XB_L3V_ON    (TOSA_SCOOP_JC_GPIO_BASE + 5)
--#define TOSA_GPIO_WLAN_LED        (TOSA_SCOOP_JC_GPIO_BASE + 7)
-+#define TOSA_SCOOP_JC_GPIO_BASE         1
-+#define TOSA_GPIO_BT_LED                (TOSA_SCOOP_JC_GPIO_BASE + 0)
-+#define TOSA_GPIO_NOTE_LED              (TOSA_SCOOP_JC_GPIO_BASE + 1)
-+#define TOSA_GPIO_CHRG_ERR_LED          (TOSA_SCOOP_JC_GPIO_BASE + 2)
-+#define TOSA_GPIO_TC6393XB_L3V_ON       (TOSA_SCOOP_JC_GPIO_BASE + 5)
-+#define TOSA_GPIO_WLAN_LED              (TOSA_SCOOP_JC_GPIO_BASE + 7)
--#define    DAC_BASE    0x4e
--#define DAC_CH1        0
--#define DAC_CH2        1
-+#define DAC_BASE 0x4e
-+#define DAC_CH1 0
-+#define DAC_CH2 1
- static void tosa_microdrive_attach(PXA2xxState *cpu)
- {
---
-.20.1

-[PULL 23/25] hw/arm/palm.c: Detabify
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-Remove hard-tabs from palm.c.
+Checks for UNDEF cases should go before the "is VFP enabled?" access
 check, except in special cases. Move a stray UNDEF check in the VTBL
 trans function up above the access check.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 Message-id: 20200628214230.2592-2-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 64 +++++++++++++++++++++++++--------------------------
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 32 insertions(+), 32 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/target/arm/translate-neon.c.inc
-+++ b/hw/arm/palm.c
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps static_ops = {
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- /* Palm Tunsgten|E support */
+         return false;
+     }
- /* Shared GPIOs */
--#define PALMTE_USBDETECT_GPIO    0
+-    if (!vfp_access_check(s)) {
--#define PALMTE_USB_OR_DC_GPIO    1
+-        return true;
--#define PALMTE_TSC_GPIO        4
+-    }
--#define PALMTE_PINTDAV_GPIO    6
+-
--#define PALMTE_MMC_WP_GPIO    8
+     if ((a->vn + a->len + 1) > 32) {
--#define PALMTE_MMC_POWER_GPIO    9
+         /*
--#define PALMTE_HDQ_GPIO        11
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
--#define PALMTE_HEADPHONES_GPIO    14
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
--#define PALMTE_SPEAKER_GPIO    15
+         return false;
-+#define PALMTE_USBDETECT_GPIO   0
+     }
-+#define PALMTE_USB_OR_DC_GPIO   1
-+#define PALMTE_TSC_GPIO                 4
++    if (!vfp_access_check(s)) {
-+#define PALMTE_PINTDAV_GPIO     6
++        return true;
-+#define PALMTE_MMC_WP_GPIO      8
++    }
-+#define PALMTE_MMC_POWER_GPIO   9
++
-+#define PALMTE_HDQ_GPIO                 11
+     desc = tcg_const_i32((a->vn << 2) | a->len);
-+#define PALMTE_HEADPHONES_GPIO  14
+     def = tcg_temp_new_i64();
-+#define PALMTE_SPEAKER_GPIO     15
+     if (a->op) {
  /* MPU private GPIOs */
 -#define PALMTE_DC_GPIO        2
 -#define PALMTE_MMC_SWITCH_GPIO    4
 -#define PALMTE_MMC1_GPIO    6
 -#define PALMTE_MMC2_GPIO    7
 -#define PALMTE_MMC3_GPIO    11
 +#define PALMTE_DC_GPIO          2
 +#define PALMTE_MMC_SWITCH_GPIO  4
 +#define PALMTE_MMC1_GPIO        6
 +#define PALMTE_MMC2_GPIO        7
 +#define PALMTE_MMC3_GPIO        11
  static MouseTransformInfo palmte_pointercal = {
      .x = 320,
@@ -XXX,XX +XXX,XX @@ static struct {
      int column;
  } palmte_keymap[0x80] = {
      [0 ... 0x7f] = { -1, -1 },
 -    [0x3b] = { 0, 0 },    /* F1    -> Calendar */
 -    [0x3c] = { 1, 0 },    /* F2    -> Contacts */
 -    [0x3d] = { 2, 0 },    /* F3    -> Tasks List */
 -    [0x3e] = { 3, 0 },    /* F4    -> Note Pad */
 -    [0x01] = { 4, 0 },    /* Esc    -> Power */
 -    [0x4b] = { 0, 1 },    /*        Left */
 -    [0x50] = { 1, 1 },    /*        Down */
 -    [0x48] = { 2, 1 },    /*       Up */
 -    [0x4d] = { 3, 1 },    /*       Right */
 -    [0x4c] = { 4, 1 },    /*        Centre */
 -    [0x39] = { 4, 1 },    /* Spc    -> Centre */
 +    [0x3b] = { 0, 0 },  /* F1   -> Calendar */
 +    [0x3c] = { 1, 0 },  /* F2   -> Contacts */
 +    [0x3d] = { 2, 0 },  /* F3   -> Tasks List */
 +    [0x3e] = { 3, 0 },  /* F4   -> Note Pad */
 +    [0x01] = { 4, 0 },  /* Esc  -> Power */
 +    [0x4b] = { 0, 1 },  /*         Left */
 +    [0x50] = { 1, 1 },  /*         Down */
 +    [0x48] = { 2, 1 },  /*         Up */
 +    [0x4d] = { 3, 1 },  /*         Right */
 +    [0x4c] = { 4, 1 },  /*         Centre */
 +    [0x39] = { 4, 1 },  /* Spc  -> Centre */
  };
  static void palmte_button_event(void *opaque, int keycode)
@@ -XXX,XX +XXX,XX @@ static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
                              [PALMTE_MMC_SWITCH_GPIO]));
      misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,    misc_gpio[0]);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,    misc_gpio[1]);
 -    qdev_connect_gpio_out(cpu->gpio, 11,            misc_gpio[2]);
 -    qdev_connect_gpio_out(cpu->gpio, 12,            misc_gpio[3]);
 -    qdev_connect_gpio_out(cpu->gpio, 13,            misc_gpio[4]);
 -    omap_mpuio_out_set(cpu->mpuio, 1,                misc_gpio[5]);
 -    omap_mpuio_out_set(cpu->mpuio, 3,                misc_gpio[6]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
 +    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
 +    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
 +    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
 +    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
 +    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
      /* Reset some inputs to initial state.  */
      qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
 --
 .20.1

Last lot of target-arm changes to squeeze in before rc1:
 * various minor Arm bug fixes
 * David Carlier's Haiku build portability fixes
 * Wentong Wu's fixes for icount handling in the nios2 target

The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713

for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:

hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/bcm2836: Remove unused 'cpu_type' field
 * target/arm: Fix mtedesc for do_mem_zpz
 * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
 * target/arm: Don't do raw writes for PMINTENCLR
 * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
 * build: Fix various issues with building on Haiku
 * target/nios2: fix wrctl behaviour when using icount
 * hw/arm/tosa: Encapsulate misc GPIO handling in a device
 * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
 * hw/arm/aspeed: Do not create and attach empty SD cards by default

----------------------------------------------------------------
Aaron Lindsay (1):
      target/arm: Don't do raw writes for PMINTENCLR

David CARLIER (8):
      build: Enable BSD symbols for Haiku
      util/qemu-openpty.c: Don't assume pty.h is glibc-only
      build: Check that mlockall() exists
      osdep.h: Always include <sys/signal.h> if it exists
      osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
      bswap.h: Include <endian.h> on Haiku for bswap operations
      util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
      util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku

Eric Auger (1):
      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()

Gerd Hoffmann (1):
      util/drm: make portable by avoiding struct dirent d_type

Jean-Christophe Dubois (3):
      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
      Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor

Peter Maydell (4):
      hw/arm/tosa.c: Detabify
      hw/arm/tosa: Encapsulate misc GPIO handling in a device
      hw/arm/palm.c: Detabify
      hw/arm/palm.c: Encapsulate misc GPIO handling in a device

Philippe Mathieu-Daudé (2):
      hw/arm/bcm2836: Remove unused 'cpu_type' field
      hw/arm/aspeed: Do not create and attach empty SD cards by default

Richard Henderson (1):
      target/arm: Fix mtedesc for do_mem_zpz

Wentong Wu (4):
      target/nios2: add DISAS_NORETURN case for nothing more to generate
      target/nios2: in line the semantics of DISAS_UPDATE with other targets
      target/nios2: Use gen_io_start around wrctl instruction
      hw/nios2: exit to main CPU loop only when unmasking interrupts

From: Richard Henderson <richard.henderson@linaro.org>

The mtedesc that was constructed was not actually passed in.
Found by Coverity (CID 1429996).

Fixes: d28d12f008e
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
         desc <<= SVE_MTEDESC_SHIFT;
     }
-    desc = simd_desc(vsz, vsz, scale);
+    desc = simd_desc(vsz, vsz, desc | scale);
     t_desc = tcg_const_i32(desc);
 
     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 1 +
 hw/arm/fsl-imx25.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     MemoryRegion   rom[2];
     MemoryRegion   iram;
     MemoryRegion   iram_alias;
+    uint32_t       phy_num;
 } FslIMX25State;
 
 /**
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                             epit_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                 &s->iram_alias);
 }
 
+static Property fsl_imx25_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx25_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx25_properties);
     dc->realize = fsl_imx25_realize;
     dc->desc = "i.MX25 SOC";
     /*
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 1 +
 hw/arm/fsl-imx6.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     MemoryRegion   caam;
     MemoryRegion   ocram;
     MemoryRegion   ocram_alias;
+    uint32_t       phy_num;
 } FslIMX6State;
 
 
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             spi_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                 &s->ocram_alias);
 }
 
+static Property fsl_imx6_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx6_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx6_properties);
     dc->realize = fsl_imx6_realize;
     dc->desc = "i.MX6 SOC";
     /* Reason: Uses serial_hd() in the realize() function */
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx7.h | 1 +
 hw/arm/fsl-imx7.c         | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
 } FslIMX7State;
 
 enum FslIMX7MemoryMap {
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
             FSL_IMX7_ENET2_ADDR,
         };
 
+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
+                                 s->phy_num[i], &error_abort);
         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                 FSL_IMX7_PCIE_PHY_SIZE);
 }
 
+static Property fsl_imx7_properties[] = {
+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx7_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx7_properties);
     dc->realize = fsl_imx7_realize;
 
     /* Reason: Uses serial_hds and nd_table in realize() directly */
-- 
2.20.1

From: Aaron Lindsay <aaron@os.amperecomputing.com>

Raw writes to this register when in KVM mode can cause interrupts to be
raised (even when the PMU is disabled). Because the underlying state is
already aliased to PMINTENSET (which already provides raw write
functions), we can safely disable raw accesses to PMINTENCLR entirely.

Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write, },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Coverity points out (CID 1430180) that the new case is missing
break or a /* fallthrough */ comment. Break is the right thing to
do as in that case, tail is not used.

Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200708160147.18426-1-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/virtio/virtio-iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
             ptail = (struct virtio_iommu_req_tail *)
                         (buf + s->config.probe_size);
             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+            break;
         }
         default:
             tail.status = VIRTIO_IOMMU_S_UNSUPP;
-- 
2.20.1