Series comparison

-[PULL 00/25] target-arm queue
+[PULL 0/9] target-arm queue
-Last lot of target-arm changes to squeeze in before rc1:
+Arm queue; bugfixes only.
  * various minor Arm bug fixes
  * David Carlier's Haiku build portability fixes
  * Wentong Wu's fixes for icount handling in the nios2 target
-The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:
+thanks
 -- PMM
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)
+The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
   Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
-for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:
+for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
-  hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)
+  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/bcm2836: Remove unused 'cpu_type' field
+ * hw/arm/virt: ARM_VIRT must select ARM_GIC
- * target/arm: Fix mtedesc for do_mem_zpz
+ * exynos: Fix bad printf format specifiers
- * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
+ * hw/input/ps2.c: Remove remnants of printf debug
- * target/arm: Don't do raw writes for PMINTENCLR
+ * target/openrisc: Remove dead code attempting to check "is timer disabled"
- * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+ * register: Remove unnecessary NULL check
- * build: Fix various issues with building on Haiku
+ * util/cutils: Fix Coverity array overrun in freq_to_str()
- * target/nios2: fix wrctl behaviour when using icount
+ * configure: Make "does libgio work" test pull in some actual functions
- * hw/arm/tosa: Encapsulate misc GPIO handling in a device
+ * tmp105: reset the T_low and T_High registers
- * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+ * tmp105: Correct handling of temperature limit checks
  * hw/arm/aspeed: Do not create and attach empty SD cards by default
 ----------------------------------------------------------------
-Aaron Lindsay (1):
+Alex Chen (1):
-      target/arm: Don't do raw writes for PMINTENCLR
+      exynos: Fix bad printf format specifiers
-David CARLIER (8):
+Alistair Francis (1):
-      build: Enable BSD symbols for Haiku
+      register: Remove unnecessary NULL check
       util/qemu-openpty.c: Don't assume pty.h is glibc-only
       build: Check that mlockall() exists
       osdep.h: Always include <sys/signal.h> if it exists
       osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
       bswap.h: Include <endian.h> on Haiku for bswap operations
       util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
       util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
-Eric Auger (1):
+Andrew Jones (1):
-      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+      hw/arm/virt: ARM_VIRT must select ARM_GIC
-Gerd Hoffmann (1):
+Peter Maydell (5):
-      util/drm: make portable by avoiding struct dirent d_type
+      hw/input/ps2.c: Remove remnants of printf debug
       target/openrisc: Remove dead code attempting to check "is timer disabled"
       configure: Make "does libgio work" test pull in some actual functions
       hw/misc/tmp105: reset the T_low and T_High registers
       tmp105: Correct handling of temperature limit checks
-Jean-Christophe Dubois (3):
+Philippe Mathieu-Daudé (1):
-      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+      util/cutils: Fix Coverity array overrun in freq_to_str()
       Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
       Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
-Peter Maydell (4):
+ configure                    | 11 +++++--
-      hw/arm/tosa.c: Detabify
+ hw/misc/tmp105.h             |  7 +++++
-      hw/arm/tosa: Encapsulate misc GPIO handling in a device
+ hw/core/register.c           |  4 ---
-      hw/arm/palm.c: Detabify
+ hw/input/ps2.c               |  9 ------
-      hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+ hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
  hw/timer/exynos4210_mct.c    |  4 +--
  hw/timer/exynos4210_pwm.c    |  8 ++---
  target/openrisc/sys_helper.c |  3 --
  util/cutils.c                |  3 +-
  hw/arm/Kconfig               |  1 +
 files changed, 89 insertions(+), 34 deletions(-)
-Philippe Mathieu-Daudé (2):
-      hw/arm/bcm2836: Remove unused 'cpu_type' field
-      hw/arm/aspeed: Do not create and attach empty SD cards by default
-Richard Henderson (1):
-      target/arm: Fix mtedesc for do_mem_zpz
-Wentong Wu (4):
-      target/nios2: add DISAS_NORETURN case for nothing more to generate
-      target/nios2: in line the semantics of DISAS_UPDATE with other targets
-      target/nios2: Use gen_io_start around wrctl instruction
-      hw/nios2: exit to main CPU loop only when unmasking interrupts
- configure                   |  38 ++++++++++++-
- include/hw/arm/bcm2836.h    |   1 -
- include/hw/arm/fsl-imx25.h  |   1 +
- include/hw/arm/fsl-imx6.h   |   1 +
- include/hw/arm/fsl-imx7.h   |   1 +
- include/qemu/bswap.h        |   2 +
- include/qemu/osdep.h        |   6 +-
- hw/arm/aspeed.c             |   9 +--
- hw/arm/fsl-imx25.c          |   7 +++
- hw/arm/fsl-imx6.c           |   7 +++
- hw/arm/fsl-imx7.c           |   9 +++
- hw/arm/palm.c               | 111 +++++++++++++++++++++++++------------
- hw/arm/tosa.c               | 132 +++++++++++++++++++++++++++++---------------
- hw/nios2/cpu_pic.c          |   3 +-
- hw/virtio/virtio-iommu.c    |   1 +
- hw/xen/xen-legacy-backend.c |   1 -
- os-posix.c                  |   4 ++
- target/arm/helper.c         |   4 +-
- target/arm/translate-sve.c  |   2 +-
- target/nios2/translate.c    |  12 +++-
- util/compatfd.c             |   2 +
- util/drm.c                  |  19 +++++--
- util/oslib-posix.c          |  20 ++++++-
- util/qemu-openpty.c         |   2 +-
-files changed, 292 insertions(+), 103 deletions(-)

-[PULL 07/25] virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
+[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
-From: Eric Auger <eric.auger@redhat.com>
+From: Andrew Jones <drjones@redhat.com>
-Coverity points out (CID 1430180) that the new case is missing
+The removal of the selection of A15MPCORE from ARM_VIRT also
-break or a /* fallthrough */ comment. Break is the right thing to
+removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
 do as in that case, tail is not used.
-Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
+Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-Message-id: 20200708160147.18426-1-eric.auger@redhat.com
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201111143440.112763-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/virtio/virtio-iommu.c | 1 +
+ hw/arm/Kconfig | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-iommu.c
+--- a/hw/arm/Kconfig
-+++ b/hw/virtio/virtio-iommu.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-             ptail = (struct virtio_iommu_req_tail *)
+     imply VFIO_PLATFORM
-                         (buf + s->config.probe_size);
+     imply VFIO_XGMAC
-             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+     imply TPM_TIS_SYSBUS
-+            break;
++    select ARM_GIC
-         }
+     select ACPI
-         default:
+     select ARM_SMMUV3
-             tail.status = VIRTIO_IOMMU_S_UNSUPP;
+     select GPIO_KEY
 --
 .20.1

-[PULL 22/25] hw/arm/tosa: Encapsulate misc GPIO handling in a device
+[PULL 2/9] exynos: Fix bad printf format specifiers
-Currently we have a free-floating set of IRQs and a function
+From: Alex Chen <alex.chen@huawei.com>
 tosa_out_switch() which handle the GPIO lines on the tosa board which
 connect to LEDs, and another free-floating IRQ and tosa_reset()
 function to handle the GPIO line that resets the system.  Encapsulate
 this behaviour in a simple QOM device.
-This commit fixes Coverity issue CID 1421929 (which pointed out that
+We should use printf format specifier "%u" instead of "%d" for
-the 'outsignals' in tosa_gpio_setup() were leaked), because it
+argument of type "unsigned int".
 removes the use of the qemu_allocate_irqs() API from this code
 entirely.
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Message-id: 20201111073651.72804-1-alex.chen@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200628203748.14250-3-peter.maydell@linaro.org
 ---
- hw/arm/tosa.c | 88 +++++++++++++++++++++++++++++++++++++--------------
+ hw/timer/exynos4210_mct.c | 4 ++--
-file changed, 64 insertions(+), 24 deletions(-)
+ hw/timer/exynos4210_pwm.c | 8 ++++----
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
+--- a/hw/timer/exynos4210_mct.c
-+++ b/hw/arm/tosa.c
++++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static void tosa_microdrive_attach(PXA2xxState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
-     pxa2xx_pcmcia_attach(cpu->pcmcia[0], md);
+     /* If CSTAT is pending and IRQ is enabled */
- }
+     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
+             (s->reg.int_enb & G_INT_ENABLE(id))) {
--static void tosa_out_switch(void *opaque, int line, int level)
+-        DPRINTF("gcmp timer[%d] IRQ\n", id);
-+/*
++        DPRINTF("gcmp timer[%u] IRQ\n", id);
-+ * Encapsulation of some GPIO line behaviour for the Tosa board
+         qemu_irq_raise(s->irq[id]);
 + *
 + * QEMU interface:
 + *  + named GPIO inputs "leds[0..3]": assert to light LEDs
 + *  + named GPIO input "reset": when asserted, resets the system
 + */
 +
 +#define TYPE_TOSA_MISC_GPIO "tosa-misc-gpio"
 +#define TOSA_MISC_GPIO(obj) \
 +    OBJECT_CHECK(TosaMiscGPIOState, (obj), TYPE_TOSA_MISC_GPIO)
 +
 +typedef struct TosaMiscGPIOState {
 +    SysBusDevice parent_obj;
 +} TosaMiscGPIOState;
 +
 +static void tosa_gpio_leds(void *opaque, int line, int level)
  {
      switch (line) {
 -        case 0:
 -            fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 1:
 -            fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 2:
 -            fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 -            break;
 -        case 3:
 -            fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 -            break;
 -        default:
 -            fprintf(stderr, "Uhandled out event: %d = %d\n", line, level);
 -            break;
 +    case 0:
 +        fprintf(stderr, "blue LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 1:
 +        fprintf(stderr, "green LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 2:
 +        fprintf(stderr, "amber LED %s.\n", level ? "on" : "off");
 +        break;
 +    case 3:
 +        fprintf(stderr, "wlan LED %s.\n", level ? "on" : "off");
 +        break;
 +    default:
 +        g_assert_not_reached();
      }
  }
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
-@@ -XXX,XX +XXX,XX @@ static void tosa_reset(void *opaque, int line, int level)
+                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
      if (freq != s->freq) {
 -        DPRINTF("freq=%dHz\n", s->freq);
 +        DPRINTF("freq=%uHz\n", s->freq);
          /* global timer */
          tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/exynos4210_pwm.c
 +++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
  }
-+static void tosa_misc_gpio_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
-+{
+     uint32_t id = s->id;
-+    DeviceState *dev = DEVICE(obj);
+     bool cmp;
-+
-+    qdev_init_gpio_in_named(dev, tosa_gpio_leds, "leds", 4);
+-    DPRINTF("timer %d tick\n", id);
-+    qdev_init_gpio_in_named(dev, tosa_reset, "reset", 1);
++    DPRINTF("timer %u tick\n", id);
-+}
-+
+     /* set irq status */
- static void tosa_gpio_setup(PXA2xxState *cpu,
+     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
-                 DeviceState *scp0,
-                 DeviceState *scp1,
+     /* raise IRQ */
-                 TC6393xbState *tmio)
+     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
- {
+-        DPRINTF("timer %d IRQ\n", id);
--    qemu_irq *outsignals = qemu_allocate_irqs(tosa_out_switch, cpu, 4);
++        DPRINTF("timer %u IRQ\n", id);
--    qemu_irq reset;
+         qemu_irq_raise(p->timer[id].irq);
-+    DeviceState *misc_gpio;
+     }
-+
-+    misc_gpio = sysbus_create_simple(TYPE_TOSA_MISC_GPIO, -1, NULL);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
+     }
-     /* MMC/SD host */
-     pxa2xx_mmci_handlers(cpu->mmc,
+     if (cmp) {
-@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
+-        DPRINTF("auto reload timer %d count to %x\n", id,
-                     qemu_irq_invert(qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_nSD_DETECT)));
++        DPRINTF("auto reload timer %u count to %x\n", id,
+                 p->timer[id].reg_tcntb);
-     /* Handle reset */
+         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
--    reset = qemu_allocate_irq(tosa_reset, cpu, 0);
+         ptimer_run(p->timer[id].ptimer, 1);
 -    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET, reset);
 +    qdev_connect_gpio_out(cpu->gpio, TOSA_GPIO_ON_RESET,
 +                          qdev_get_gpio_in_named(misc_gpio, "reset", 0));
      /* PCMCIA signals: card's IRQ and Card-Detect */
      pxa2xx_pcmcia_set_irq_cb(cpu->pcmcia[0],
@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,
                          qdev_get_gpio_in(cpu->gpio, TOSA_GPIO_JC_CF_IRQ),
                          NULL);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED, outsignals[0]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED, outsignals[1]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED, outsignals[2]);
 -    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED, outsignals[3]);
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_BT_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 0));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_NOTE_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 1));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_CHRG_ERR_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 2));
 +    qdev_connect_gpio_out(scp1, TOSA_GPIO_WLAN_LED,
 +                          qdev_get_gpio_in_named(misc_gpio, "leds", 3));
      qdev_connect_gpio_out(scp1, TOSA_GPIO_TC6393XB_L3V_ON, tc6393xb_l3v_get(tmio));
@@ -XXX,XX +XXX,XX @@ static const TypeInfo tosa_ssp_info = {
      .class_init    = tosa_ssp_class_init,
  };
 +static const TypeInfo tosa_misc_gpio_info = {
 +    .name          = "tosa-misc-gpio",
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(TosaMiscGPIOState),
 +    .instance_init = tosa_misc_gpio_init,
 +    /*
 +     * No class init required: device has no internal state so does not
 +     * need to set up reset or vmstate, and has no realize method.
 +     */
 +};
 +
  static void tosa_register_types(void)
  {
      type_register_static(&tosa_dac_info);
      type_register_static(&tosa_ssp_info);
 +    type_register_static(&tosa_misc_gpio_info);
  }
  type_init(tosa_register_types)
 --
 .20.1

-[PULL 23/25] hw/arm/palm.c: Detabify
+[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
-Remove hard-tabs from palm.c.
+In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
 and mouse emulation. However we didn't remove all the debug-by-printf
 support. In fact there is only one printf() remaining, and it is
 redundant with the trace_ps2_write_mouse() event next to it.
 Remove the printf() and the now-unused DEBUG* macros.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20200628214230.2592-2-peter.maydell@linaro.org
+Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 64 +++++++++++++++++++++++++--------------------------
+ hw/input/ps2.c | 9 ---------
-file changed, 32 insertions(+), 32 deletions(-)
+file changed, 9 deletions(-)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/hw/input/ps2.c b/hw/input/ps2.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/hw/input/ps2.c
-+++ b/hw/arm/palm.c
++++ b/hw/input/ps2.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps static_ops = {
+@@ -XXX,XX +XXX,XX @@
- /* Palm Tunsgten|E support */
+ #include "trace.h"
- /* Shared GPIOs */
--#define PALMTE_USBDETECT_GPIO    0
+-/* debug PC keyboard */
--#define PALMTE_USB_OR_DC_GPIO    1
+-//#define DEBUG_KBD
--#define PALMTE_TSC_GPIO        4
+-
--#define PALMTE_PINTDAV_GPIO    6
+-/* debug PC keyboard : only mouse */
--#define PALMTE_MMC_WP_GPIO    8
+-//#define DEBUG_MOUSE
--#define PALMTE_MMC_POWER_GPIO    9
+-
--#define PALMTE_HDQ_GPIO        11
+ /* Keyboard Commands */
--#define PALMTE_HEADPHONES_GPIO    14
+ #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
--#define PALMTE_SPEAKER_GPIO    15
+ #define KBD_CMD_ECHO         0xEE
-+#define PALMTE_USBDETECT_GPIO   0
+@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
-+#define PALMTE_USB_OR_DC_GPIO   1
+     PS2MouseState *s = (PS2MouseState *)opaque;
-+#define PALMTE_TSC_GPIO                 4
-+#define PALMTE_PINTDAV_GPIO     6
+     trace_ps2_write_mouse(opaque, val);
-+#define PALMTE_MMC_WP_GPIO      8
+-#ifdef DEBUG_MOUSE
-+#define PALMTE_MMC_POWER_GPIO   9
+-    printf("kbd: write mouse 0x%02x\n", val);
-+#define PALMTE_HDQ_GPIO                 11
+-#endif
-+#define PALMTE_HEADPHONES_GPIO  14
+     switch(s->common.write_cmd) {
-+#define PALMTE_SPEAKER_GPIO     15
+     default:
- /* MPU private GPIOs */
+     case -1:
 -#define PALMTE_DC_GPIO        2
 -#define PALMTE_MMC_SWITCH_GPIO    4
 -#define PALMTE_MMC1_GPIO    6
 -#define PALMTE_MMC2_GPIO    7
 -#define PALMTE_MMC3_GPIO    11
 +#define PALMTE_DC_GPIO          2
 +#define PALMTE_MMC_SWITCH_GPIO  4
 +#define PALMTE_MMC1_GPIO        6
 +#define PALMTE_MMC2_GPIO        7
 +#define PALMTE_MMC3_GPIO        11
  static MouseTransformInfo palmte_pointercal = {
      .x = 320,
@@ -XXX,XX +XXX,XX @@ static struct {
      int column;
  } palmte_keymap[0x80] = {
      [0 ... 0x7f] = { -1, -1 },
 -    [0x3b] = { 0, 0 },    /* F1    -> Calendar */
 -    [0x3c] = { 1, 0 },    /* F2    -> Contacts */
 -    [0x3d] = { 2, 0 },    /* F3    -> Tasks List */
 -    [0x3e] = { 3, 0 },    /* F4    -> Note Pad */
 -    [0x01] = { 4, 0 },    /* Esc    -> Power */
 -    [0x4b] = { 0, 1 },    /*        Left */
 -    [0x50] = { 1, 1 },    /*        Down */
 -    [0x48] = { 2, 1 },    /*       Up */
 -    [0x4d] = { 3, 1 },    /*       Right */
 -    [0x4c] = { 4, 1 },    /*        Centre */
 -    [0x39] = { 4, 1 },    /* Spc    -> Centre */
 +    [0x3b] = { 0, 0 },  /* F1   -> Calendar */
 +    [0x3c] = { 1, 0 },  /* F2   -> Contacts */
 +    [0x3d] = { 2, 0 },  /* F3   -> Tasks List */
 +    [0x3e] = { 3, 0 },  /* F4   -> Note Pad */
 +    [0x01] = { 4, 0 },  /* Esc  -> Power */
 +    [0x4b] = { 0, 1 },  /*         Left */
 +    [0x50] = { 1, 1 },  /*         Down */
 +    [0x48] = { 2, 1 },  /*         Up */
 +    [0x4d] = { 3, 1 },  /*         Right */
 +    [0x4c] = { 4, 1 },  /*         Centre */
 +    [0x39] = { 4, 1 },  /* Spc  -> Centre */
  };
  static void palmte_button_event(void *opaque, int keycode)
@@ -XXX,XX +XXX,XX @@ static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
                              [PALMTE_MMC_SWITCH_GPIO]));
      misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,    misc_gpio[0]);
 -    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,    misc_gpio[1]);
 -    qdev_connect_gpio_out(cpu->gpio, 11,            misc_gpio[2]);
 -    qdev_connect_gpio_out(cpu->gpio, 12,            misc_gpio[3]);
 -    qdev_connect_gpio_out(cpu->gpio, 13,            misc_gpio[4]);
 -    omap_mpuio_out_set(cpu->mpuio, 1,                misc_gpio[5]);
 -    omap_mpuio_out_set(cpu->mpuio, 3,                misc_gpio[6]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
 +    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
 +    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
 +    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
 +    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
 +    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
      /* Reset some inputs to initial state.  */
      qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
 --
 .20.1

-[PULL 25/25] hw/arm/aspeed: Do not create and attach empty SD cards by default
+[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+In the mtspr helper we attempt to check for "is the timer disabled"
 with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
 is zero and the condition is always false (Coverity complains about
 the dead code.)
-Since added in commit 2bea128c3d, each SDHCI is wired with a SD
+The correct check would be to test whether the TTMR_M field in the
-card, using empty card when no block drive provided. This is not
+register is equal to TIMER_NONE instead.  However, the
-the desired behavior. The SDHCI exposes a SD bus to plug cards
+cpu_openrisc_timer_update() function checks whether the timer is
-on, if no card available, it is fine to have an unplugged bus.
+enabled (it looks at cpu->env.is_counting, which is set to 0 via
 cpu_openrisc_count_stop() when the TTMR_M field is set to
 TIMER_NONE), so there's no need to check for "timer disabled" in the
 target/openrisc code.  Instead, simply remove the dead code.
-Avoid creating unnecessary SD card device when no block drive
+Fixes: Coverity CID 1005812
-provided.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Acked-by: Stafford Horne <shorne@gmail.com>
 Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
 ---
  target/openrisc/sys_helper.c | 3 ---
 file changed, 3 deletions(-)
-Fixes: 2bea128c3d ("hw/sd/aspeed_sdhci: New device")
+diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200705173402.15620-1-f4bug@amsat.org
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/aspeed.c | 9 +++++----
 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/openrisc/sys_helper.c
-+++ b/hw/arm/aspeed.c
++++ b/target/openrisc/sys_helper.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
+@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
- {
-         DeviceState *card;
+     case TO_SPR(10, 1): /* TTCR */
+         cpu_openrisc_count_set(cpu, rb);
--        card = qdev_new(TYPE_SD_CARD);
+-        if (env->ttmr & TIMER_NONE) {
--        if (dinfo) {
+-            return;
--            qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
+-        }
--                                    &error_fatal);
+         cpu_openrisc_timer_update(cpu);
-+        if (!dinfo) {
+         break;
-+            return;
+ #endif
          }
 +        card = qdev_new(TYPE_SD_CARD);
 +        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
 +                                &error_fatal);
          qdev_realize_and_unref(card,
                                 qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
                                 &error_fatal);
 --
 .20.1

-[PULL 16/25] util/drm: make portable by avoiding struct dirent d_type
+[PULL 5/9] register: Remove unnecessary NULL check
-From: Gerd Hoffmann <kraxel@redhat.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-Given this isn't perforance critical at all lets avoid the non-portable
+This patch fixes CID 1432800 by removing an unnecessary check.
 d_type and use fstat instead to check whenever the file is a chardev.
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reported-by: David Carlier <devnexen@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200703145614.16684-10-peter.maydell@linaro.org
 Message-id: 20200701180302.14821-1-kraxel@redhat.com
 [PMM: fixed comment style; tweaked subject line]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/drm.c | 19 ++++++++++++++-----
+ hw/core/register.c | 4 ----
-file changed, 14 insertions(+), 5 deletions(-)
+file changed, 4 deletions(-)
-diff --git a/util/drm.c b/util/drm.c
+diff --git a/hw/core/register.c b/hw/core/register.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/drm.c
+--- a/hw/core/register.c
-+++ b/util/drm.c
++++ b/hw/core/register.c
-@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
+@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
- {
+         int index = rae[i].addr / data_size;
-     DIR *dir;
+         RegisterInfo *r = &ri[index];
-     struct dirent *e;
--    int r, fd;
+-        if (data + data_size * index == 0 || !&rae[i]) {
 +    struct stat st;
 +    int r, fd, ret;
      char *p;
      if (rendernode) {
@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
      fd = -1;
      while ((e = readdir(dir))) {
 -        if (e->d_type != DT_CHR) {
 -            continue;
 -        }
 -
-         if (strncmp(e->d_name, "renderD", 7)) {
+         /* Init the register, this will zero it. */
-             continue;
+         object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
-         }
@@ -XXX,XX +XXX,XX @@ int qemu_drm_rendernode_open(const char *rendernode)
              g_free(p);
              continue;
          }
 +
 +        /*
 +         * prefer fstat() over checking e->d_type == DT_CHR for
 +         * portability reasons
 +         */
 +        ret = fstat(r, &st);
 +        if (ret < 0 || (st.st_mode & S_IFMT) != S_IFCHR) {
 +            close(r);
 +            g_free(p);
 +            continue;
 +        }
 +
          fd = r;
          g_free(p);
          break;
 --
 .20.1

-[PULL 01/25] hw/arm/bcm2836: Remove unused 'cpu_type' field
+[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The 'cpu_type' has been moved from BCM283XState to BCM283XClass
+Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
 in commit 210f47840d, but we forgot to remove the old variable.
 Do it now.
-Fixes: 210f47840d ("hw/arm/bcm2836: Hardcode correct CPU type")
+>>> Overrunning array "suffixes" of 7 8-byte elements at element
     index 7 (byte offset 63) using index "idx" (which evaluates to 7).
 Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
 which is ~18.446 EHz, less than 1000 EHz.
 Reported-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703200459.23294-1-f4bug@amsat.org
+Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2836.h | 1 -
+ util/cutils.c | 3 ++-
-file changed, 1 deletion(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/util/cutils.c b/util/cutils.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/util/cutils.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/util/cutils.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
+@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
-     DeviceState parent_obj;
+     double freq = freq_hz;
-     /*< public >*/
+     size_t idx = 0;
--    char *cpu_type;
+-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
-     uint32_t enabled_cpus;
++    while (freq >= 1000.0) {
+         freq /= 1000.0;
-     struct {
+         idx++;
      }
 +    assert(idx < ARRAY_SIZE(suffixes));
      return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
  }
 --
 .20.1

-[PULL 02/25] target/arm: Fix mtedesc for do_mem_zpz
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The mtedesc that was constructed was not actually passed in.
-Found by Coverity (CID 1429996).
-Fixes: d28d12f008e
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-sve.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
-         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
-         desc <<= SVE_MTEDESC_SHIFT;
-     }
--    desc = simd_desc(vsz, vsz, scale);
-+    desc = simd_desc(vsz, vsz, desc | scale);
-     t_desc = tcg_const_i32(desc);
-     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
---
-.20.1

-[PULL 03/25] Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx25.h | 1 +
- hw/arm/fsl-imx25.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
-     MemoryRegion   rom[2];
-     MemoryRegion   iram;
-     MemoryRegion   iram_alias;
-+    uint32_t       phy_num;
- } FslIMX25State;
- /**
-diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx25.c
-+++ b/hw/arm/fsl-imx25.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                             epit_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-                                 &s->iram_alias);
- }
-+static Property fsl_imx25_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx25_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx25_properties);
-     dc->realize = fsl_imx25_realize;
-     dc->desc = "i.MX25 SOC";
-     /*
---
-.20.1

-[PULL 04/25] Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx6.h | 1 +
- hw/arm/fsl-imx6.c         | 7 +++++++
-files changed, 8 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
-+++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
-     MemoryRegion   caam;
-     MemoryRegion   ocram;
-     MemoryRegion   ocram_alias;
-+    uint32_t       phy_num;
- } FslIMX6State;
-diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
-+++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                             spi_table[i].irq));
-     }
-+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
-     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                 &s->ocram_alias);
- }
-+static Property fsl_imx6_properties[] = {
-+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx6_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx6_properties);
-     dc->realize = fsl_imx6_realize;
-     dc->desc = "i.MX6 SOC";
-     /* Reason: Uses serial_hd() in the realize() function */
---
-.20.1

-[PULL 05/25] Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: updated for object_property_set_uint() argument reordering]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx7.h | 1 +
- hw/arm/fsl-imx7.c         | 9 +++++++++
-files changed, 10 insertions(+)
-diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx7.h
-+++ b/include/hw/arm/fsl-imx7.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
-     IMX7GPRState       gpr;
-     ChipideaState      usb[FSL_IMX7_NUM_USBS];
-     DesignwarePCIEHost pcie;
-+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
- } FslIMX7State;
- enum FslIMX7MemoryMap {
-diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx7.c
-+++ b/hw/arm/fsl-imx7.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-             FSL_IMX7_ENET2_ADDR,
-         };
-+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
-+                                 s->phy_num[i], &error_abort);
-         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
-                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
-         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
-                                 FSL_IMX7_PCIE_PHY_SIZE);
- }
-+static Property fsl_imx7_properties[] = {
-+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
-+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
- static void fsl_imx7_class_init(ObjectClass *oc, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(oc);
-+    device_class_set_props(dc, fsl_imx7_properties);
-     dc->realize = fsl_imx7_realize;
-     /* Reason: Uses serial_hds and nd_table in realize() directly */
---
-.20.1

-[PULL 06/25] target/arm: Don't do raw writes for PMINTENCLR
+Deleted patch
-From: Aaron Lindsay <aaron@os.amperecomputing.com>
-Raw writes to this register when in KVM mode can cause interrupts to be
-raised (even when the PMU is disabled). Because the underlying state is
-already aliased to PMINTENSET (which already provides raw write
-functions), we can safely disable raw accesses to PMINTENCLR entirely.
-Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
-Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
-       .resetvalue = 0x0 },
-     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
-       .access = PL1_RW, .accessfn = access_tpm,
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-       .writefn = pmintenclr_write, },
-     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
-       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
-       .access = PL1_RW, .accessfn = access_tpm,
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-       .writefn = pmintenclr_write },
-     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
---
-.20.1

-[PULL 08/25] build: Enable BSD symbols for Haiku
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Tell Haiku to provide various BSD functions by setting BSD_SOURCE
-and linking libbsd.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-2-peter.maydell@linaro.org
-[PMM: expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ SunOS)
- ;;
- Haiku)
-   haiku="yes"
--  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS $QEMU_CFLAGS"
--  LIBS="-lposix_error_mapper -lnetwork $LIBS"
-+  QEMU_CFLAGS="-DB_USE_POSITIVE_POSIX_ERRORS -DBSD_SOURCE $QEMU_CFLAGS"
-+  LIBS="-lposix_error_mapper -lnetwork -lbsd $LIBS"
- ;;
- Linux)
-   audio_drv_list="try-pa oss"
---
-.20.1

-[PULL 09/25] util/qemu-openpty.c: Don't assume pty.h is glibc-only
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Instead of using an OS-specific ifdef test to select the "openpty()
-is in pty.h" codepath, make configure check for the existence of
-the header and use the new CONFIG_PTY instead.
-This is necessary to build on Haiku, which also provides openpty()
-via pty.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-3-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_PTY_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure           | 9 +++++++++
- util/qemu-openpty.c | 2 +-
-files changed, 10 insertions(+), 1 deletion(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ else
-   l2tpv3=no
- fi
-+if check_include "pty.h" ; then
-+  pty_h=yes
-+else
-+  pty_h=no
-+fi
-+
- #########################################
- # vhost interdependencies and host support
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$sheepdog" = "yes" ; then
-   echo "CONFIG_SHEEPDOG=y" >> $config_host_mak
- fi
-+if test "$pty_h" = "yes" ; then
-+  echo "HAVE_PTY_H=y" >> $config_host_mak
-+fi
- if test "$fuzzing" = "yes" ; then
-   if test "$have_fuzzer" = "yes"; then
-     FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
-diff --git a/util/qemu-openpty.c b/util/qemu-openpty.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-openpty.c
-+++ b/util/qemu-openpty.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
--#if defined(__GLIBC__)
-+#if defined HAVE_PTY_H
- # include <pty.h>
- #elif defined CONFIG_BSD
- # include <termios.h>
---
-.20.1

-[PULL 10/25] build: Check that mlockall() exists
+[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
-From: David CARLIER <devnexen@gmail.com>
+In commit 76346b6264a9b01979 we tried to add a configure check that
 the libgio pkg-config data was correct, which builds an executable
 linked against it.  Unfortunately this doesn't catch the problem
 (missing static library dependency info), because a "do nothing" test
 source file doesn't have any symbol references that cause the linker
 to pull in .o files from libgio.a, and so we don't see the "missing
 symbols from libmount" error that a full QEMU link triggers.
-Instead of assuming that all POSIX platforms provide mlockall(),
+(The ineffective test went unnoticed because of a typo that
-test for it in configure. If the host doesn't provide this platform
+effectively disabled libgio unconditionally, but after commit
-then os_mlock() will fail -ENOSYS, as it does already on Windows.
+a5dfc11f2 fixed that, a static link of the system emulator on
 Ubuntu stopped working again.)
-This is necessary for Haiku, which does not have mlockall().
+Improve the gio test by having the test source fragment reference a
 g_dbus function (which is what is indirectly causing us to end up
 wanting functions from libmount).
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-4-peter.maydell@linaro.org
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-[PMM: Expanded commit message; rename to HAVE_MLOCKALL]
+Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- configure  | 15 +++++++++++++++
+ configure | 11 +++++++++--
- os-posix.c |  4 ++++
+file changed, 9 insertions(+), 2 deletions(-)
 files changed, 19 insertions(+)
 diff --git a/configure b/configure
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
-@@ -XXX,XX +XXX,XX @@ else
+@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
-   pty_h=no
+     # Check that the libraries actually work -- Ubuntu 18.04 ships
- fi
+     # with pkg-config --static --libs data for gio-2.0 that is missing
+     # -lblkid and will give a link error.
-+cat > $TMPC <<EOF
+-    write_c_skeleton
-+#include <sys/mman.h>
+-    if compile_prog "" "$gio_libs" ; then
-+int main(int argc, char *argv[]) {
++    cat > $TMPC <<EOF
-+    return mlockall(MCL_FUTURE);
++#include <gio/gio.h>
 +int main(void)
 +{
 +    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
 +    return 0;
 +}
 +EOF
-+if compile_prog "" "" ; then
++    if compile_prog "$gio_cflags" "$gio_libs" ; then
-+  have_mlockall=yes
+         gio=yes
-+else
+     else
-+  have_mlockall=no
+         gio=no
 +fi
 +
  #########################################
  # vhost interdependencies and host support
@@ -XXX,XX +XXX,XX @@ fi
  if test "$pty_h" = "yes" ; then
    echo "HAVE_PTY_H=y" >> $config_host_mak
  fi
 +if test "$have_mlockall" = "yes" ; then
 +  echo "HAVE_MLOCKALL=y" >> $config_host_mak
 +fi
  if test "$fuzzing" = "yes" ; then
    if test "$have_fuzzer" = "yes"; then
      FUZZ_LDFLAGS=" -fsanitize=address,fuzzer"
 diff --git a/os-posix.c b/os-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/os-posix.c
 +++ b/os-posix.c
@@ -XXX,XX +XXX,XX @@ bool is_daemonized(void)
  int os_mlock(void)
  {
 +#ifdef HAVE_MLOCKALL
      int ret = 0;
      ret = mlockall(MCL_CURRENT | MCL_FUTURE);
@@ -XXX,XX +XXX,XX @@ int os_mlock(void)
      }
      return ret;
 +#else
 +    return -ENOSYS;
 +#endif
  }
 --
 .20.1

-[PULL 11/25] osdep.h: Always include <sys/signal.h> if it exists
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Regularize our handling of <sys/signal.h>: currently we include it in
-osdep.h, but only for OpenBSD, and we include it without an ifdef
-guard in a couple of C files.  This causes problems for Haiku, which
-doesn't have that header.
-Instead, check in configure whether sys/signal.h exists, and if it
-does then always include it from osdep.h.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-5-peter.maydell@linaro.org
-[PMM: Expanded commit message; rename to HAVE_SYS_SIGNAL_H]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- configure                   | 10 ++++++++++
- include/qemu/osdep.h        |  2 +-
- hw/xen/xen-legacy-backend.c |  1 -
- util/oslib-posix.c          |  1 -
-files changed, 11 insertions(+), 3 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ if check_include "libdrm/drm.h" ; then
-     have_drm_h=yes
- fi
-+#########################################
-+# sys/signal.h check
-+have_sys_signal_h=no
-+if check_include "sys/signal.h" ; then
-+  have_sys_signal_h=yes
-+fi
-+
- ##########################################
- # VTE probe
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$have_openpty" = "yes" ; then
-     echo "HAVE_OPENPTY=y" >> $config_host_mak
- fi
-+if test "$have_sys_signal_h" = "yes" ; then
-+    echo "HAVE_SYS_SIGNAL_H=y" >> $config_host_mak
-+fi
- # Work around a system header bug with some kernel/XFS header
- # versions where they both try to define 'struct fsxattr':
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
- #include <setjmp.h>
- #include <signal.h>
--#ifdef __OpenBSD__
-+#ifdef HAVE_SYS_SIGNAL_H
- #include <sys/signal.h>
- #endif
-diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/xen/xen-legacy-backend.c
-+++ b/hw/xen/xen-legacy-backend.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
--#include <sys/signal.h>
- #include "hw/sysbus.h"
- #include "hw/boards.h"
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
-+++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/sockets.h"
- #include "qemu/thread.h"
- #include <libgen.h>
--#include <sys/signal.h>
- #include "qemu/cutils.h"
- #ifdef CONFIG_LINUX
---
-.20.1

-[PULL 12/25] osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Haiku doesn't provide SIGIO; fix this up in osdep.h by defining it as
-equal to SIGPOLL.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-6-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/osdep.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
-+++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
- #define HAVE_CHARDEV_PARPORT 1
- #endif
-+#if defined(__HAIKU__)
-+#define SIGIO SIGPOLL
-+#endif
-+
- #if defined(CONFIG_LINUX)
- #ifndef BUS_MCEERR_AR
- #define BUS_MCEERR_AR 4
---
-.20.1

-[PULL 13/25] bswap.h: Include <endian.h> on Haiku for bswap operations
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-Haiku puts the bswap* functions in <endian.h>; pull in that
-include file on that platform.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-7-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/bswap.h | 2 ++
-file changed, 2 insertions(+)
-diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/bswap.h
-+++ b/include/qemu/bswap.h
-@@ -XXX,XX +XXX,XX @@
- # include <machine/bswap.h>
- #elif defined(__FreeBSD__)
- # include <sys/endian.h>
-+#elif defined(__HAIKU__)
-+# include <endian.h>
- #elif defined(CONFIG_BYTESWAP_H)
- # include <byteswap.h>
---
-.20.1

-[PULL 14/25] util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-util/compatfd.c includes <sys/syscall.h> so that the CONFIG_SIGNALFD
-code can use SYS_signalfd. Guard the #include with CONFIG_SIGNALFD
-to avoid portability issues on hosts like Haiku which do not
-provide that header file.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-8-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- util/compatfd.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/util/compatfd.c b/util/compatfd.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/compatfd.c
-+++ b/util/compatfd.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu/thread.h"
-+#if defined(CONFIG_SIGNALFD)
- #include <sys/syscall.h>
-+#endif
- struct sigfd_compat_info
- {
---
-.20.1

-[PULL 15/25] util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku
+Deleted patch
-From: David CARLIER <devnexen@gmail.com>
-The qemu_init_exec_dir() function is inherently non-portable;
-provide an implementation for Haiku hosts.
-Signed-off-by: David Carlier <devnexen@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200703145614.16684-9-peter.maydell@linaro.org
-[PMM: Expanded commit message]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- util/oslib-posix.c | 19 +++++++++++++++++++
-file changed, 19 insertions(+)
-diff --git a/util/oslib-posix.c b/util/oslib-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/oslib-posix.c
-+++ b/util/oslib-posix.c
-@@ -XXX,XX +XXX,XX @@
- #include <mach-o/dyld.h>
- #endif
-+#ifdef __HAIKU__
-+#include <kernel/image.h>
-+#endif
-+
- #include "qemu/mmap-alloc.h"
- #ifdef CONFIG_DEBUG_STACK_USAGE
-@@ -XXX,XX +XXX,XX @@ void qemu_init_exec_dir(const char *argv0)
-             }
-         }
-     }
-+#elif defined(__HAIKU__)
-+    {
-+        image_info ii;
-+        int32_t c = 0;
-+
-+        *buf = '\0';
-+        while (get_next_image_info(0, &c, &ii) == B_OK) {
-+            if (ii.type == B_APP_IMAGE) {
-+                strncpy(buf, ii.name, sizeof(buf));
-+                buf[sizeof(buf) - 1] = 0;
-+                p = buf;
-+                break;
-+            }
-+        }
-+    }
- #endif
-     /* If we don't have any way of figuring out the actual executable
-        location then try argv[0].  */
---
-.20.1

-[PULL 17/25] target/nios2: add DISAS_NORETURN case for nothing more to generate
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-Add DISAS_NORETURN case for nothing more to generate because at runtime
-execution will never return from some helper call. And at the same time
-replace DISAS_UPDATE in t_gen_helper_raise_exception and gen_exception
-with the newly added DISAS_NORETURN.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-1-wentong.wu@intel.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ static void t_gen_helper_raise_exception(DisasContext *dc,
-     tcg_gen_movi_tl(dc->cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(dc->cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- static bool use_goto_tb(DisasContext *dc, uint32_t dest)
-@@ -XXX,XX +XXX,XX @@ static void gen_exception(DisasContext *dc, uint32_t excp)
-     tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
-     gen_helper_raise_exception(cpu_env, tmp);
-     tcg_temp_free_i32(tmp);
--    dc->is_jmp = DISAS_UPDATE;
-+    dc->is_jmp = DISAS_NORETURN;
- }
- /* generate intermediate code for basic block 'tb'.  */
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-         tcg_gen_exit_tb(NULL, 0);
-         break;
-+    case DISAS_NORETURN:
-     case DISAS_TB_JUMP:
-         /* nothing more to generate */
-         break;
---
-.20.1

-[PULL 18/25] target/nios2: in line the semantics of DISAS_UPDATE with other targets
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-In line the semantics of DISAS_UPDATE on nios2 target with other targets
-which is to explicitly write the PC back into the cpu state before doing
-a tcg_gen_exit_tb().
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-2-wentong.wu@intel.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     /* Indicate where the next block should start */
-     switch (dc->is_jmp) {
-     case DISAS_NEXT:
-+    case DISAS_UPDATE:
-         /* Save the current PC back into the CPU register */
-         tcg_gen_movi_tl(cpu_R[R_PC], dc->pc);
-         tcg_gen_exit_tb(NULL, 0);
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUState *cs, TranslationBlock *tb, int max_insns)
-     default:
-     case DISAS_JUMP:
--    case DISAS_UPDATE:
-         /* The jump will already have updated the PC register */
-         tcg_gen_exit_tb(NULL, 0);
-         break;
---
-.20.1

-[PULL 19/25] target/nios2: Use gen_io_start around wrctl instruction
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-wrctl instruction on nios2 target will cause checking cpu
-interrupt but tcg_handle_interrupt() will call cpu_abort()
-if the CPU gets an interrupt while it's not in 'can do IO'
-state, so add gen_io_start around wrctl instruction. Also
-at the same time, end the onging TB with DISAS_UPDATE.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-3-wentong.wu@intel.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/nios2/translate.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/target/nios2/translate.c b/target/nios2/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/nios2/translate.c
-+++ b/target/nios2/translate.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/cpu_ldst.h"
- #include "exec/translator.h"
- #include "qemu/qemu-print.h"
-+#include "exec/gen-icount.h"
- /* is_jmp field values */
- #define DISAS_JUMP    DISAS_TARGET_0 /* only pc was modified dynamically */
-@@ -XXX,XX +XXX,XX @@ static void wrctl(DisasContext *dc, uint32_t code, uint32_t flags)
-     /* If interrupts were enabled using WRCTL, trigger them. */
- #if !defined(CONFIG_USER_ONLY)
-     if ((instr.imm5 + CR_BASE) == CR_STATUS) {
-+        if (tb_cflags(dc->tb) & CF_USE_ICOUNT) {
-+            gen_io_start();
-+        }
-         gen_helper_check_interrupts(dc->cpu_env);
-+        dc->is_jmp = DISAS_UPDATE;
-     }
- #endif
- }
---
-.20.1

-[PULL 20/25] hw/nios2: exit to main CPU loop only when unmasking interrupts
+Deleted patch
-From: Wentong Wu <wentong.wu@intel.com>
-Only when guest code is unmasking interrupts, terminate the excution
-of translated code and exit to the main CPU loop to handle previous
-pended interrupts because of the interrupts mask by guest code.
-Signed-off-by: Wentong Wu <wentong.wu@intel.com>
-Message-id: 20200710233433.19729-4-wentong.wu@intel.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/nios2/cpu_pic.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/nios2/cpu_pic.c b/hw/nios2/cpu_pic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nios2/cpu_pic.c
-+++ b/hw/nios2/cpu_pic.c
-@@ -XXX,XX +XXX,XX @@ static void nios2_pic_cpu_handler(void *opaque, int irq, int level)
- void nios2_check_interrupts(CPUNios2State *env)
- {
--    if (env->irq_pending) {
-+    if (env->irq_pending &&
-+        (env->regs[CR_STATUS] & CR_STATUS_PIE)) {
-         env->irq_pending = 0;
-         cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HARD);
-     }
---
-.20.1

-[PULL 21/25] hw/arm/tosa.c: Detabify
+[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
-Remove the hardcoded tabs from hw/arm/tosa.c. There aren't
+The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
-many, but since they're all in constant #defines they're not
+power-up reset values for the T_low and T_high registers are 80 degrees C
-going to go away with our usual "only when we touch a function"
+and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
-policy on reformatting.
+values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
 We were resetting these registers to zero, which is problematic for Linux
 guests which enable the alert interrupt and then immediately take an
 unexpected overtemperature alert because the current temperature is above
 freezing...
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20200628203748.14250-2-peter.maydell@linaro.org
+Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
 ---
- hw/arm/tosa.c | 44 ++++++++++++++++++++++----------------------
+ hw/misc/tmp105.c | 3 +++
-file changed, 22 insertions(+), 22 deletions(-)
+file changed, 3 insertions(+)
-diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/tosa.c
+--- a/hw/misc/tmp105.c
-+++ b/hw/arm/tosa.c
++++ b/hw/misc/tmp105.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
- #include "hw/sysbus.h"
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
- #include "exec/address-spaces.h"
+     s->alarm = 0;
--#define TOSA_RAM    0x04000000
++    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
--#define TOSA_ROM    0x00800000
++    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-+#define TOSA_RAM 0x04000000
++
-+#define TOSA_ROM 0x00800000
+     tmp105_interrupt_update(s);
+ }
--#define TOSA_GPIO_USB_IN        (5)
 -#define TOSA_GPIO_nSD_DETECT    (9)
 -#define TOSA_GPIO_ON_RESET        (19)
 -#define TOSA_GPIO_CF_IRQ        (21)    /* CF slot0 Ready */
 -#define TOSA_GPIO_CF_CD            (13)
 -#define TOSA_GPIO_TC6393XB_INT  (15)
 -#define TOSA_GPIO_JC_CF_IRQ        (36)    /* CF slot1 Ready */
 +#define TOSA_GPIO_USB_IN                (5)
 +#define TOSA_GPIO_nSD_DETECT            (9)
 +#define TOSA_GPIO_ON_RESET              (19)
 +#define TOSA_GPIO_CF_IRQ                (21)    /* CF slot0 Ready */
 +#define TOSA_GPIO_CF_CD                 (13)
 +#define TOSA_GPIO_TC6393XB_INT          (15)
 +#define TOSA_GPIO_JC_CF_IRQ             (36)    /* CF slot1 Ready */
 -#define TOSA_SCOOP_GPIO_BASE    1
 -#define TOSA_GPIO_IR_POWERDWN    (TOSA_SCOOP_GPIO_BASE + 2)
 -#define TOSA_GPIO_SD_WP            (TOSA_SCOOP_GPIO_BASE + 3)
 -#define TOSA_GPIO_PWR_ON        (TOSA_SCOOP_GPIO_BASE + 4)
 +#define TOSA_SCOOP_GPIO_BASE            1
 +#define TOSA_GPIO_IR_POWERDWN           (TOSA_SCOOP_GPIO_BASE + 2)
 +#define TOSA_GPIO_SD_WP                 (TOSA_SCOOP_GPIO_BASE + 3)
 +#define TOSA_GPIO_PWR_ON                (TOSA_SCOOP_GPIO_BASE + 4)
 -#define TOSA_SCOOP_JC_GPIO_BASE        1
 -#define TOSA_GPIO_BT_LED        (TOSA_SCOOP_JC_GPIO_BASE + 0)
 -#define TOSA_GPIO_NOTE_LED        (TOSA_SCOOP_JC_GPIO_BASE + 1)
 -#define TOSA_GPIO_CHRG_ERR_LED        (TOSA_SCOOP_JC_GPIO_BASE + 2)
 -#define TOSA_GPIO_TC6393XB_L3V_ON    (TOSA_SCOOP_JC_GPIO_BASE + 5)
 -#define TOSA_GPIO_WLAN_LED        (TOSA_SCOOP_JC_GPIO_BASE + 7)
 +#define TOSA_SCOOP_JC_GPIO_BASE         1
 +#define TOSA_GPIO_BT_LED                (TOSA_SCOOP_JC_GPIO_BASE + 0)
 +#define TOSA_GPIO_NOTE_LED              (TOSA_SCOOP_JC_GPIO_BASE + 1)
 +#define TOSA_GPIO_CHRG_ERR_LED          (TOSA_SCOOP_JC_GPIO_BASE + 2)
 +#define TOSA_GPIO_TC6393XB_L3V_ON       (TOSA_SCOOP_JC_GPIO_BASE + 5)
 +#define TOSA_GPIO_WLAN_LED              (TOSA_SCOOP_JC_GPIO_BASE + 7)
 -#define    DAC_BASE    0x4e
 -#define DAC_CH1        0
 -#define DAC_CH2        1
 +#define DAC_BASE 0x4e
 +#define DAC_CH1 0
 +#define DAC_CH2 1
  static void tosa_microdrive_attach(PXA2xxState *cpu)
  {
 --
 .20.1

-[PULL 24/25] hw/arm/palm.c: Encapsulate misc GPIO handling in a device
+[PULL 9/9] tmp105: Correct handling of temperature limit checks
-Replace the free-floating set of IRQs and palmte_onoff_gpios()
+The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
-function with a simple QOM device that encapsulates this
+signals an alert when the temperature equals or exceeds the T_high value and
-behaviour.
+then remains high until a device register is read or the device responds to
 the SMBUS Alert Response address, or the device is put into Shutdown Mode.
 Thereafter the Alert pin will only be re-signalled when temperature falls
 below T_low; alert can then be cleared in the same set of ways, and the
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
-This fixes Coverity issue CID 1421944, which points out that
+We were misimplementing this as a simple "always alert if temperature is
-the memory returned by qemu_allocate_irqs() is leaked.
+above T_high or below T_low" condition, which gives a spurious alert on
 startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
 limit values.
 Implement the correct (hysteresis) behaviour by tracking whether we
 are currently looking for the temperature to rise over T_high or
 for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
 Message-id: 20200628214230.2592-3-peter.maydell@linaro.org
 ---
- hw/arm/palm.c | 61 +++++++++++++++++++++++++++++++++++++++++++--------
+ hw/misc/tmp105.h |  7 +++++
-file changed, 52 insertions(+), 9 deletions(-)
+ hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 files changed, 68 insertions(+), 9 deletions(-)
-diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/palm.c
+--- a/hw/misc/tmp105.h
-+++ b/hw/arm/palm.c
++++ b/hw/misc/tmp105.h
-@@ -XXX,XX +XXX,XX @@ static void palmte_button_event(void *opaque, int keycode)
+@@ -XXX,XX +XXX,XX @@ struct TMP105State {
-                         !(keycode & 0x80));
+     int16_t limit[2];
      int faults;
      uint8_t alarm;
 +    /*
 +     * The TMP105 initially looks for a temperature rising above T_high;
 +     * once this is detected, the condition it looks for next is the
 +     * temperature falling below T_low. This flag is false when initially
 +     * looking for T_high, true when looking for T_low.
 +     */
 +    bool detect_falling;
  };
  #endif
 diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/tmp105.c
 +++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
              return;
      }
 -    if ((s->config >> 1) & 1) {                    /* TM */
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 1;
 +    if (s->config >> 1 & 1) {
 +        /*
 +         * TM == 1 : Interrupt mode. We signal Alert when the
 +         * temperature rises above T_high, and expect the guest to clear
 +         * it (eg by reading a device register).
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 1;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      } else {
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 0;
 +        /*
 +         * TM == 0 : Comparator mode. We signal Alert when the temperature
 +         * rises above T_high, and stop signalling it when the temperature
 +         * falls below T_low.
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
      tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
      return 0;
  }
-+/*
++static bool detect_falling_needed(void *opaque)
-+ * Encapsulation of some GPIO line behaviour for the Palm board
++{
-+ *
++    TMP105State *s = opaque;
 + * QEMU interface:
 + *  + unnamed GPIO inputs 0..6: for the various miscellaneous input lines
 + */
 +
-+#define TYPE_PALM_MISC_GPIO "palm-misc-gpio"
++    /*
-+#define PALM_MISC_GPIO(obj) \
++     * We only need to migrate the detect_falling bool if it's set;
-+    OBJECT_CHECK(PalmMiscGPIOState, (obj), TYPE_PALM_MISC_GPIO)
++     * for migration from older machines we assume that it is false
-+
++     * (ie temperature is not out of range).
-+typedef struct PalmMiscGPIOState {
++     */
-+    SysBusDevice parent_obj;
++    return s->detect_falling;
 +} PalmMiscGPIOState;
 +
  static void palmte_onoff_gpios(void *opaque, int line, int level)
  {
      switch (line) {
@@ -XXX,XX +XXX,XX @@ static void palmte_onoff_gpios(void *opaque, int line, int level)
      }
  }
 +static void palm_misc_gpio_init(Object *obj)
 +{
 +    DeviceState *dev = DEVICE(obj);
 +
 +    qdev_init_gpio_in(dev, palmte_onoff_gpios, 7);
 +}
 +
-+static const TypeInfo palm_misc_gpio_info = {
++static const VMStateDescription vmstate_tmp105_detect_falling = {
-+    .name = TYPE_PALM_MISC_GPIO,
++    .name = "TMP105/detect-falling",
-+    .parent = TYPE_SYS_BUS_DEVICE,
++    .version_id = 1,
-+    .instance_size = sizeof(PalmMiscGPIOState),
++    .minimum_version_id = 1,
-+    .instance_init = palm_misc_gpio_init,
++    .needed = detect_falling_needed,
-+    /*
++    .fields = (VMStateField[]) {
-+     * No class init required: device has no internal state so does not
++        VMSTATE_BOOL(detect_falling, TMP105State),
-+     * need to set up reset or vmstate, and has no realize method.
++        VMSTATE_END_OF_LIST()
-+     */
++    }
 +};
 +
- static void palmte_gpio_setup(struct omap_mpu_state_s *cpu)
+ static const VMStateDescription vmstate_tmp105 = {
- {
+     .name = "TMP105",
--    qemu_irq *misc_gpio;
+     .version_id = 0,
-+    DeviceState *misc_gpio;
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
-+
+         VMSTATE_UINT8(alarm, TMP105State),
-+    misc_gpio = sysbus_create_simple(TYPE_PALM_MISC_GPIO, -1, NULL);
+         VMSTATE_I2C_SLAVE(i2c, TMP105State),
+         VMSTATE_END_OF_LIST()
-     omap_mmc_handlers(cpu->mmc,
++    },
-                     qdev_get_gpio_in(cpu->gpio, PALMTE_MMC_WP_GPIO),
++    .subsections = (const VMStateDescription*[]) {
-                     qemu_irq_invert(omap_mpuio_in_get(cpu->mpuio)
++        &vmstate_tmp105_detect_falling,
-                             [PALMTE_MMC_SWITCH_GPIO]));
++        NULL
+     }
--    misc_gpio = qemu_allocate_irqs(palmte_onoff_gpios, cpu, 7);
+ };
--    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,     misc_gpio[0]);
--    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,       misc_gpio[1]);
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
--    qdev_connect_gpio_out(cpu->gpio, 11,                        misc_gpio[2]);
+     s->config = 0;
--    qdev_connect_gpio_out(cpu->gpio, 12,                        misc_gpio[3]);
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
--    qdev_connect_gpio_out(cpu->gpio, 13,                        misc_gpio[4]);
+     s->alarm = 0;
--    omap_mpuio_out_set(cpu->mpuio, 1,                           misc_gpio[5]);
++    s->detect_falling = false;
--    omap_mpuio_out_set(cpu->mpuio, 3,                           misc_gpio[6]);
-+    qdev_connect_gpio_out(cpu->gpio, PALMTE_MMC_POWER_GPIO,
+     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-+                          qdev_get_gpio_in(misc_gpio, 0));
+     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 +    qdev_connect_gpio_out(cpu->gpio, PALMTE_SPEAKER_GPIO,
 +                          qdev_get_gpio_in(misc_gpio, 1));
 +    qdev_connect_gpio_out(cpu->gpio, 11, qdev_get_gpio_in(misc_gpio, 2));
 +    qdev_connect_gpio_out(cpu->gpio, 12, qdev_get_gpio_in(misc_gpio, 3));
 +    qdev_connect_gpio_out(cpu->gpio, 13, qdev_get_gpio_in(misc_gpio, 4));
 +    omap_mpuio_out_set(cpu->mpuio, 1, qdev_get_gpio_in(misc_gpio, 5));
 +    omap_mpuio_out_set(cpu->mpuio, 3, qdev_get_gpio_in(misc_gpio, 6));
      /* Reset some inputs to initial state.  */
      qemu_irq_lower(qdev_get_gpio_in(cpu->gpio, PALMTE_USBDETECT_GPIO));
@@ -XXX,XX +XXX,XX @@ static void palmte_machine_init(MachineClass *mc)
  }
  DEFINE_MACHINE("cheetah", palmte_machine_init)
 +
 +static void palm_register_types(void)
 +{
 +    type_register_static(&palm_misc_gpio_info);
 +}
 +
 +type_init(palm_register_types)
 --
 .20.1

Last lot of target-arm changes to squeeze in before rc1:
 * various minor Arm bug fixes
 * David Carlier's Haiku build portability fixes
 * Wentong Wu's fixes for icount handling in the nios2 target

The following changes since commit 00ce6c36b35e0eb8cc5d68a28f288a6335848813:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-07-13' into staging (2020-07-13 13:01:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200713

for you to fetch changes up to 756f739b1682bf131994ec96dad7fbdf8b54493a:

hw/arm/aspeed: Do not create and attach empty SD cards by default (2020-07-13 14:36:12 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/bcm2836: Remove unused 'cpu_type' field
 * target/arm: Fix mtedesc for do_mem_zpz
 * Add the ability to change the FEC PHY MDIO device number on i.MX25/i.MX6/i.MX7
 * target/arm: Don't do raw writes for PMINTENCLR
 * virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()
 * build: Fix various issues with building on Haiku
 * target/nios2: fix wrctl behaviour when using icount
 * hw/arm/tosa: Encapsulate misc GPIO handling in a device
 * hw/arm/palm.c: Encapsulate misc GPIO handling in a device
 * hw/arm/aspeed: Do not create and attach empty SD cards by default

----------------------------------------------------------------
Aaron Lindsay (1):
      target/arm: Don't do raw writes for PMINTENCLR

David CARLIER (8):
      build: Enable BSD symbols for Haiku
      util/qemu-openpty.c: Don't assume pty.h is glibc-only
      build: Check that mlockall() exists
      osdep.h: Always include <sys/signal.h> if it exists
      osdep.h: For Haiku, define SIGIO as equivalent to SIGPOLL
      bswap.h: Include <endian.h> on Haiku for bswap operations
      util/compatfd.c: Only include <sys/syscall.h> if CONFIG_SIGNALFD
      util/oslib-posix.c: Implement qemu_init_exec_dir() for Haiku

Eric Auger (1):
      virtio-iommu: Fix coverity issue in virtio_iommu_handle_command()

Gerd Hoffmann (1):
      util/drm: make portable by avoiding struct dirent d_type

Jean-Christophe Dubois (3):
      Add the ability to change the FEC PHY MDIO device number on i.MX25 processor
      Add the ability to change the FEC PHY MDIO device number on i.MX6 processor
      Add the ability to change the FEC PHY MDIO devices numbers on i.MX7 processor

Peter Maydell (4):
      hw/arm/tosa.c: Detabify
      hw/arm/tosa: Encapsulate misc GPIO handling in a device
      hw/arm/palm.c: Detabify
      hw/arm/palm.c: Encapsulate misc GPIO handling in a device

Philippe Mathieu-Daudé (2):
      hw/arm/bcm2836: Remove unused 'cpu_type' field
      hw/arm/aspeed: Do not create and attach empty SD cards by default

Richard Henderson (1):
      target/arm: Fix mtedesc for do_mem_zpz

Wentong Wu (4):
      target/nios2: add DISAS_NORETURN case for nothing more to generate
      target/nios2: in line the semantics of DISAS_UPDATE with other targets
      target/nios2: Use gen_io_start around wrctl instruction
      hw/nios2: exit to main CPU loop only when unmasking interrupts

From: Richard Henderson <richard.henderson@linaro.org>

The mtedesc that was constructed was not actually passed in.
Found by Coverity (CID 1429996).

Fixes: d28d12f008e
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200706202345.193676-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_mem_zpz(DisasContext *s, int zt, int pg, int zm,
         desc = FIELD_DP32(desc, MTEDESC, ESIZE, 1 << msz);
         desc <<= SVE_MTEDESC_SHIFT;
     }
-    desc = simd_desc(vsz, vsz, scale);
+    desc = simd_desc(vsz, vsz, desc | scale);
     t_desc = tcg_const_i32(desc);
 
     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, pg));
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 9f8923ecd974160ae8f634c275b1100c2cbe66d7.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 1 +
 hw/arm/fsl-imx25.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     MemoryRegion   rom[2];
     MemoryRegion   iram;
     MemoryRegion   iram_alias;
+    uint32_t       phy_num;
 } FslIMX25State;
 
 /**
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                             epit_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->fec), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->fec), &nd_table[0]);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fec), errp)) {
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                 &s->iram_alias);
 }
 
+static Property fsl_imx25_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX25State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx25_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx25_properties);
     dc->realize = fsl_imx25_realize;
     dc->desc = "i.MX25 SOC";
     /*
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 05a64e83eb1c0c865ac077b22c599425c024c02c.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 1 +
 hw/arm/fsl-imx6.c         | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     MemoryRegion   caam;
     MemoryRegion   ocram;
     MemoryRegion   ocram_alias;
+    uint32_t       phy_num;
 } FslIMX6State;
 
 
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             spi_table[i].irq));
     }
 
+    object_property_set_uint(OBJECT(&s->eth), "phy-num", s->phy_num, &err);
     qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->eth), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                 &s->ocram_alias);
 }
 
+static Property fsl_imx6_properties[] = {
+    DEFINE_PROP_UINT32("fec-phy-num", FslIMX6State, phy_num, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx6_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx6_properties);
     dc->realize = fsl_imx6_realize;
     dc->desc = "i.MX6 SOC";
     /* Reason: Uses serial_hd() in the realize() function */
-- 
2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: c850187322be9930e47c8b234c385a7d0da245cb.1593806826.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: updated for object_property_set_uint() argument reordering]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx7.h | 1 +
 hw/arm/fsl-imx7.c         | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
 } FslIMX7State;
 
 enum FslIMX7MemoryMap {
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
             FSL_IMX7_ENET2_ADDR,
         };
 
+        object_property_set_uint(OBJECT(&s->eth[i]), "phy-num",
+                                 s->phy_num[i], &error_abort);
         object_property_set_uint(OBJECT(&s->eth[i]), "tx-ring-num",
                                  FSL_IMX7_ETH_NUM_TX_RINGS, &error_abort);
         qdev_set_nic_properties(DEVICE(&s->eth[i]), &nd_table[i]);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                 FSL_IMX7_PCIE_PHY_SIZE);
 }
 
+static Property fsl_imx7_properties[] = {
+    DEFINE_PROP_UINT32("fec1-phy-num", FslIMX7State, phy_num[0], 0),
+    DEFINE_PROP_UINT32("fec2-phy-num", FslIMX7State, phy_num[1], 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void fsl_imx7_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, fsl_imx7_properties);
     dc->realize = fsl_imx7_realize;
 
     /* Reason: Uses serial_hds and nd_table in realize() directly */
-- 
2.20.1

From: Aaron Lindsay <aaron@os.amperecomputing.com>

Raw writes to this register when in KVM mode can cause interrupts to be
raised (even when the PMU is disabled). Because the underlying state is
already aliased to PMINTENSET (which already provides raw write
functions), we can safely disable raw accesses to PMINTENCLR entirely.

Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
Message-id: 20200707152616.1917154-1-aaron@os.amperecomputing.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write, },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS | ARM_CP_IO | ARM_CP_NO_RAW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Coverity points out (CID 1430180) that the new case is missing
break or a /* fallthrough */ comment. Break is the right thing to
do as in that case, tail is not used.

Fixes 1733eebb9e ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200708160147.18426-1-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/virtio/virtio-iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
             ptail = (struct virtio_iommu_req_tail *)
                         (buf + s->config.probe_size);
             ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);
+            break;
         }
         default:
             tail.status = VIRTIO_IOMMU_S_UNSUPP;
-- 
2.20.1