Series comparison

-[PULL 00/12] target-arm queue
+[PULL 00/16] target-arm queue
-The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
+Patches for rc1: nothing major, just some minor bugfixes and
 code cleanups.
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
+-- PMM
 The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
   Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201008
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to ba118c26e16a97e6ff6de8184057d3420ce16a23:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  target/arm: Make '-cpu max' have a 48-bit PA (2020-10-08 15:24:32 +0100)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * hw/arm/fsl-imx25: Fix a typo
+ * Minor coding style fixes
- * hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
+ * docs: add some notes on the sbsa-ref machine
- * hw/arm/sbsa-ref : allocate IRQs for SMMUv3
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * hw/char/bcm2835_aux: Allow less than 32-bit accesses
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * hw/arm/virt: Implement kvm-steal-time
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * target/arm: Make '-cpu max' have a 48-bit PA
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Andrew Jones (6):
+Alex Bennée (1):
-      linux headers: sync to 5.9-rc7
+      docs: add some notes on the sbsa-ref machine
       target/arm/kvm: Make uncalled stubs explicitly unreachable
       hw/arm/virt: Move post cpu realize check into its own function
       hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
       tests/qtest: Restore aarch64 arm-cpu-features test
       hw/arm/virt: Implement kvm-steal-time
-Graeme Gregory (2):
+AlexChen (1):
-      hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
+      ssi: Fix bad printf format specifiers
       hw/arm/sbsa-ref : allocate IRQs for SMMUv3
-Peter Maydell (1):
+Andrew Jones (1):
-      target/arm: Make '-cpu max' have a 48-bit PA
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
-Philippe Mathieu-Daudé (3):
+Havard Skinnemoen (1):
-      hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
+      tests/qtest/npcm7xx_rng-test: count runs properly
       hw/arm/fsl-imx25: Fix a typo
       hw/char/bcm2835_aux: Allow less than 32-bit accesses
- docs/system/arm/cpu-features.rst |  11 ++++
+Peter Maydell (2):
- include/hw/arm/fsl-imx25.h       |   2 +-
+      hw/arm/nseries: Check return value from load_image_targphys()
- include/hw/arm/virt.h            |   5 ++
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
  linux-headers/linux/kvm.h        |   6 ++-
  target/arm/cpu.h                 |   4 ++
  target/arm/kvm_arm.h             |  94 ++++++++++++++++++++++++++-------
  hw/arm/sbsa-ref.c                |   3 +-
  hw/arm/virt.c                    | 110 ++++++++++++++++++++++++++++-----------
  hw/char/bcm2835_aux.c            |   4 +-
  hw/ssi/npcm7xx_fiu.c             |  12 ++---
  target/arm/cpu.c                 |   8 +++
  target/arm/cpu64.c               |   4 ++
  target/arm/kvm.c                 |  16 ++++++
  target/arm/kvm64.c               |  64 +++++++++++++++++++++--
  target/arm/monitor.c             |   2 +-
  tests/qtest/arm-cpu-features.c   |  25 +++++++--
  hw/ssi/trace-events              |   2 +-
  tests/qtest/meson.build          |   3 +-
 files changed, 303 insertions(+), 72 deletions(-)
+Philippe Mathieu-Daudé (6):
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      hw/arm/armsse: Correct expansion MPC interrupt lines
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+Richard Henderson (1):
+      target/arm: Fix neon VTBL/VTBX for len > 1
+Xinhao Zhang (3):
+      target/arm: add spaces around operator
+      target/arm: Don't use '#' flag of printf format
+      target/arm: add space before the open parenthesis '('
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-[PULL 06/12] linux headers: sync to 5.9-rc7
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
 From: Andrew Jones <drjones@redhat.com>
-Update against Linux 5.9-rc7.
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
 changed armv7m_systick to build on ptimers. Make sure we have ptimers
 in the build when building armv7m_systick.
-Cc: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Andrew Jones <drjones@redhat.com>
-Message-id: 20201001061718.101915-2-drjones@redhat.com
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201104103343.30392-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- linux-headers/linux/kvm.h | 6 ++++--
+ hw/arm/Kconfig | 1 +
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/linux-headers/linux/kvm.h
+--- a/hw/arm/Kconfig
-+++ b/linux-headers/linux/kvm.h
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
- #define KVM_VM_PPC_HV 1
- #define KVM_VM_PPC_PR 2
+ config ARM_V7M
+     bool
--/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */
++    select PTIMER
--#define KVM_VM_MIPS_TE        0
-+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */
+ config ALLWINNER_A10
-+#define KVM_VM_MIPS_AUTO    0
+     bool
  #define KVM_VM_MIPS_VZ        1
 +#define KVM_VM_MIPS_TE        2
  #define KVM_S390_SIE_PAGE_OFFSET 1
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
  #define KVM_CAP_LAST_CPU 184
  #define KVM_CAP_SMALLER_MAXPHYADDR 185
  #define KVM_CAP_S390_DIAG318 186
 +#define KVM_CAP_STEAL_TIME 187
  #ifdef KVM_CAP_IRQ_ROUTING
 --
 .20.1

-[PULL 08/12] hw/arm/virt: Move post cpu realize check into its own function
+[PULL 02/16] ssi: Fix bad printf format specifiers
-From: Andrew Jones <drjones@redhat.com>
+From: AlexChen <alex.chen@huawei.com>
-We'll add more to this new function in coming patches so we also
+We should use printf format specifier "%u" instead of "%d" for
-state the gic must be created and call it below create_gic().
+argument of type "unsigned int".
-No functional change intended.
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20201001061718.101915-4-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 43 +++++++++++++++++++++++++++----------------
+ hw/ssi/imx_spi.c    | 2 +-
-file changed, 27 insertions(+), 16 deletions(-)
+ hw/ssi/xilinx_spi.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/hw/ssi/imx_spi.c
-+++ b/hw/arm/virt.c
++++ b/hw/ssi/imx_spi.c
-@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
      case ECSPI_MSGDATA:
          return  "ECSPI_MSGDATA";
      default:
 -        sprintf(unknown, "%d ?", reg);
 +        sprintf(unknown, "%u ?", reg);
          return unknown;
      }
  }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
-+/*
+index XXXXXXX..XXXXXXX 100644
-+ * virt_cpu_post_init() must be called after the CPUs have
+--- a/hw/ssi/xilinx_spi.c
-+ * been realized and the GIC has been created.
++++ b/hw/ssi/xilinx_spi.c
-+ */
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
-+static void virt_cpu_post_init(VirtMachineState *vms)
+        irq chain unless things really changed.  */
-+{
+     if (pending != s->irqline) {
-+    bool aarch64;
+         s->irqline = pending;
-+
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
-+    aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
-+
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
-+    if (!kvm_enabled()) {
+         qemu_set_irq(s->irq, pending);
-+        if (aarch64 && vms->highmem) {
+     }
 +            int requested_pa_size = 64 - clz64(vms->highest_gpa);
 +            int pamax = arm_pamax(ARM_CPU(first_cpu));
 +
 +            if (pamax < requested_pa_size) {
 +                error_report("VCPU supports less PA bits (%d) than "
 +                             "requested by the memory map (%d)",
 +                             pamax, requested_pa_size);
 +                exit(1);
 +            }
 +        }
 +    }
 +}
 +
  static void machvirt_init(MachineState *machine)
  {
      VirtMachineState *vms = VIRT_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      fdt_add_timer_nodes(vms);
      fdt_add_cpu_nodes(vms);
 -   if (!kvm_enabled()) {
 -        ARMCPU *cpu = ARM_CPU(first_cpu);
 -        bool aarch64 = object_property_get_bool(OBJECT(cpu), "aarch64", NULL);
 -
 -        if (aarch64 && vms->highmem) {
 -            int requested_pa_size, pamax = arm_pamax(cpu);
 -
 -            requested_pa_size = 64 - clz64(vms->highest_gpa);
 -            if (pamax < requested_pa_size) {
 -                error_report("VCPU supports less PA bits (%d) than requested "
 -                            "by the memory map (%d)", pamax, requested_pa_size);
 -                exit(1);
 -            }
 -        }
 -    }
 -
      memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                  machine->ram);
      if (machine->device_memory) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      create_gic(vms);
 +    virt_cpu_post_init(vms);
 +
      fdt_add_pmu_nodes(vms);
      create_uart(vms, VIRT_UART, sysmem, serial_hd(0));
 --
 .20.1

-[PULL 09/12] hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
+[PULL 03/16] target/arm: add spaces around operator
-From: Andrew Jones <drjones@redhat.com>
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Move the KVM PMU setup part of fdt_add_pmu_nodes() to
+Fix code style. Operator needs spaces both sides.
 virt_cpu_post_init(), which is a more appropriate location. Now
 fdt_add_pmu_nodes() is also named more appropriately, because it
 no longer does anything but fdt node creation.
-No functional change intended.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
 Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
-Message-id: 20201001061718.101915-5-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 34 ++++++++++++++++++----------------
+ target/arm/arch_dump.c | 8 ++++----
-file changed, 18 insertions(+), 16 deletions(-)
+ target/arm/arm-semi.c  | 8 ++++----
  target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/arm/arch_dump.c
-+++ b/hw/arm/virt.c
++++ b/target/arm/arch_dump.c
-@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
- static void fdt_add_pmu_nodes(const VirtMachineState *vms)
+     for (i = 0; i < 32; ++i) {
- {
+         uint64_t *q = aa64_vfp_qreg(env, i);
--    CPUState *cpu;
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
--    ARMCPU *armcpu;
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
-+    ARMCPU *armcpu = ARM_CPU(first_cpu);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
-     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
 -    CPU_FOREACH(cpu) {
 -        armcpu = ARM_CPU(cpu);
 -        if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
 -            return;
 -        }
 -        if (kvm_enabled()) {
 -            if (kvm_irqchip_in_kernel()) {
 -                kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
 -            }
 -            kvm_arm_pmu_init(cpu);
 -        }
 +    if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
 +        assert(!object_property_get_bool(OBJECT(armcpu), "pmu", NULL));
 +        return;
      }
-     if (vms->gic_version == VIRT_GIC_VERSION_2) {
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
-@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
-                              (1 << vms->smp_cpus) - 1);
+          */
          for (i = 0; i < 32; ++i) {
              uint64_t tmp = note.vfp.vregs[2*i];
 -            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
 -            note.vfp.vregs[2*i+1] = tmp;
 +            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
 +            note.vfp.vregs[2 * i + 1] = tmp;
          }
      }
--    armcpu = ARM_CPU(qemu_get_cpu(0));
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-     qemu_fdt_add_subnode(vms->fdt, "/pmu");
+index XXXXXXX..XXXXXXX 100644
-     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
+--- a/target/arm/arm-semi.c
-         const char compat[] = "arm,armv8-pmuv3";
++++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-  */
+         if (use_gdb_syscalls()) {
- static void virt_cpu_post_init(VirtMachineState *vms)
+             arm_semi_open_guestfd = guestfd;
- {
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
--    bool aarch64;
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
-+    bool aarch64, pmu;
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
-+    CPUState *cpu;
+         } else {
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
-     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
+             if (ret == (uint32_t)-1) {
-+    pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
--    if (!kvm_enabled()) {
+         if (use_gdb_syscalls()) {
-+    if (kvm_enabled()) {
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-+        CPU_FOREACH(cpu) {
+-                                  arg0, (int)arg1+1);
-+            if (pmu) {
++                                  arg0, (int)arg1 + 1);
-+                assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
+         } else {
-+                if (kvm_irqchip_in_kernel()) {
+             s = lock_user_string(arg0);
-+                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
+             if (!s) {
-+                }
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-+                kvm_arm_pmu_init(cpu);
+         GET_ARG(3);
-+            }
+         if (use_gdb_syscalls()) {
-+        }
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-+    } else {
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
-         if (aarch64 && vms->highmem) {
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
-             int requested_pa_size = 64 - clz64(vms->highest_gpa);
+         } else {
-             int pamax = arm_pamax(ARM_CPU(first_cpu));
+             char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
      uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
 --
 .20.1

-New patch
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Don't use '#' flag of printf format ('%#') in
+format strings, use '0x' prefix instead
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
+                 break;
+             default:
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
+                         __func__, insn, fpopcode, s->pc_curr);
+                 g_assert_not_reached();
+             }
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
+     case 0x7f: /* FSQRT (vector) */
+         break;
+     default:
+-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
++        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
+         g_assert_not_reached();
+     }
+--
+.20.1

-New patch
+[PULL 05/16] target/arm: add space before the open parenthesis '('
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Space required before the open parenthesis '('.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+             - Hardware watchpoints.
+            Hardware breakpoints have already been handled and skip this code.
+          */
+-        switch(dc->base.is_jmp) {
++        switch (dc->base.is_jmp) {
+         case DISAS_NEXT:
+         case DISAS_TOO_MANY:
+             gen_goto_tb(dc, 1, dc->base.pc_next);
+--
+.20.1

-[PULL 04/12] hw/arm/sbsa-ref : allocate IRQs for SMMUv3
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-From: Graeme Gregory <graeme@nuviainc.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Original commit did not allocate IRQs for the SMMUv3 in the irqmap
+We should at least document what this machine is about.
 effectively using irq 0->3 (shared with other devices). Assuming
 original intent was to allocate unique IRQs then add an allocation
 to the irqmap.
-Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")
+Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
+Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Cc: Leif Lindholm <leif@nuviainc.com>
-Message-id: 20201007100732.4103790-3-graeme@nuviainc.com
+Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/sbsa-ref.c | 1 +
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+)
+ docs/system/target-arm.rst |  1 +
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
 +Arm Server Base System Architecture Reference board (``sbsa-ref``)
 +==================================================================
 +
 +While the `virt` board is a generic board platform that doesn't match
 +any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
+--- a/docs/system/target-arm.rst
-+++ b/hw/arm/sbsa-ref.c
++++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-     [SBSA_SECURE_UART_MM] = 9,
+    arm/mps2
-     [SBSA_AHCI] = 10,
+    arm/musca
-     [SBSA_EHCI] = 11,
+    arm/realview
-+    [SBSA_SMMU] = 12, /* ... to 15 */
++   arm/sbsa
- };
+    arm/versatile
+    arm/vexpress
- static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
+    arm/aspeed
 --
 .20.1

-New patch
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+When using a Cortex-A15, the Virt machine does not use any
+MPCore peripherals. Remove the dependency.
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201107114852.271922-1-philmd@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+     imply VFIO_PLATFORM
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
+-    select A15MPCORE
+     select ACPI
+     select ARM_SMMUV3
+     select GPIO_KEY
+--
+.20.1

-[PULL 11/12] hw/arm/virt: Implement kvm-steal-time
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
-From: Andrew Jones <drjones@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We add the kvm-steal-time CPU property and implement it for machvirt.
+The helper function did not get updated when we reorganized
-A tiny bit of refactoring was also done to allow pmu and pvtime to
+the vector register file for SVE.  Since then, the neon dregs
-use the same vcpu device helper functions.
+are non-sequential and cannot be simply indexed.
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+At the same time, make the helper function operate on 64-bit
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+quantities so that we do not have to call it twice.
-Message-id: 20201001061718.101915-7-drjones@redhat.com
 Fixes: c39c2b9043e
 Reported-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 [PMM: use aa32_vfp_dreg() rather than opencoding]
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/cpu-features.rst | 11 ++++++
+ target/arm/helper.h             |  2 +-
- include/hw/arm/virt.h            |  5 +++
+ target/arm/op_helper.c          | 23 +++++++++--------
- target/arm/cpu.h                 |  4 ++
+ target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
- target/arm/kvm_arm.h             | 43 +++++++++++++++++++++
+files changed, 29 insertions(+), 40 deletions(-)
  hw/arm/virt.c                    | 43 +++++++++++++++++++--
  target/arm/cpu.c                 |  8 ++++
  target/arm/kvm.c                 | 16 ++++++++
  target/arm/kvm64.c               | 64 +++++++++++++++++++++++++++++---
  target/arm/monitor.c             |  2 +-
  tests/qtest/arm-cpu-features.c   | 25 +++++++++++--
 files changed, 208 insertions(+), 13 deletions(-)
-diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/cpu-features.rst
+--- a/target/arm/helper.h
-+++ b/docs/system/arm/cpu-features.rst
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
-                            adjustment, also restoring the legacy (pre-5.0)
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
-                            behavior.
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-+  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
+-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
-+                           default when KVM is enabled, the feature is
++DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
-+                           supported, and the guest is 64-bit.
-+
+ DEF_HELPER_3(shl_cc, i32, env, i32, i32)
-+                           When kvm-steal-time is enabled a 64-bit guest
+ DEF_HELPER_3(shr_cc, i32, env, i32, i32)
-+                           can account for time its CPUs were not running
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 +                           due to the host not scheduling the corresponding
 +                           VCPU threads.  The accounting statistics may
 +                           influence the guest scheduler behavior and/or be
 +                           exposed to the guest userspace.
 +
  SVE CPU Properties
  ==================
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/target/arm/op_helper.c
-+++ b/include/hw/arm/virt.h
++++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+     cpu_loop_exit_restore(cs, ra);
- #define PPI(irq) ((irq) + 16)
+ }
-+/* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-+#define PVTIME_SIZE_PER_CPU 64
+-                          uint32_t maxindex)
-+
++uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
- enum {
++                          uint64_t ireg, uint64_t def)
-     VIRT_FLASH,
+ {
-     VIRT_MEM,
+-    uint32_t val, shift;
-@@ -XXX,XX +XXX,XX @@ enum {
+-    uint64_t *table = vn;
-     VIRT_PCDIMM_ACPI,
++    uint64_t tmp, val = 0;
-     VIRT_ACPI_GED,
++    uint32_t maxindex = ((desc & 3) + 1) * 8;
-     VIRT_NVDIMM_ACPI,
++    uint32_t base_reg = desc >> 2;
-+    VIRT_PVTIME,
++    uint32_t shift, index, reg;
-     VIRT_LOWMEMMAP_LAST,
- };
+-    val = 0;
+-    for (shift = 0; shift < 32; shift += 8) {
-@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+-        uint32_t index = (ireg >> shift) & 0xff;
-     bool no_highmem_ecam;
++    for (shift = 0; shift < 64; shift += 8) {
-     bool no_ged;   /* Machines < 4.2 has no support for ACPI GED device */
++        index = (ireg >> shift) & 0xff;
-     bool kvm_no_adjvtime;
+         if (index < maxindex) {
-+    bool no_kvm_steal_time;
+-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-     bool acpi_expose_flash;
+-            val |= tmp << shift;
- };
++            reg = base_reg + (index >> 3);
++            tmp = *aa32_vfp_dreg(env, reg);
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
++            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
      return val;
  }
 diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/translate-neon.c.inc
-+++ b/target/arm/cpu.h
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
- #include "hw/registerfields.h"
- #include "cpu-qom.h"
+ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  #include "exec/cpu-defs.h"
 +#include "qapi/qapi-types-common.h"
  /* ARM processors have a weak memory model */
  #define TCG_GUEST_DEFAULT_MO      (0)
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      bool kvm_vtime_dirty;
      uint64_t kvm_vtime;
 +    /* KVM steal time */
 +    OnOffAuto kvm_steal_time;
 +
      /* Uniprocessor system with MP extensions */
      bool mp_is_up;
 diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
   */
  void kvm_arm_add_vcpu_properties(Object *obj);
 +/**
 + * kvm_arm_steal_time_finalize:
 + * @cpu: ARMCPU for which to finalize kvm-steal-time
 + * @errp: Pointer to Error* for error propagation
 + *
 + * Validate the kvm-steal-time property selection and set its default
 + * based on KVM support and guest configuration.
 + */
 +void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp);
 +
 +/**
 + * kvm_arm_steal_time_supported:
 + *
 + * Returns: true if KVM can enable steal time reporting
 + * and false otherwise.
 + */
 +bool kvm_arm_steal_time_supported(void);
 +
  /**
   * kvm_arm_aarch32_supported:
   *
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
  void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
  void kvm_arm_pmu_init(CPUState *cs);
 +
 +/**
 + * kvm_arm_pvtime_init:
 + * @cs: CPUState
 + * @ipa: Per-vcpu guest physical base address of the pvtime structures
 + *
 + * Initializes PVTIME for the VCPU, setting the PVTIME IPA to @ipa.
 + */
 +void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa);
 +
  int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
  #else
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
      return false;
  }
 +static inline bool kvm_arm_steal_time_supported(void)
 +{
 +    return false;
 +}
 +
  /*
   * These functions should never actually be called without KVM support.
   */
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_pmu_init(CPUState *cs)
      g_assert_not_reached();
  }
 +static inline void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
 +{
 +    g_assert_not_reached();
 +}
 +
 +static inline void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
 +{
 +    g_assert_not_reached();
 +}
 +
  static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
  {
-     g_assert_not_reached();
+-    int n;
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-index XXXXXXX..XXXXXXX 100644
+-    TCGv_ptr ptr1;
---- a/hw/arm/virt.c
++    TCGv_i64 val, def;
-+++ b/hw/arm/virt.c
++    TCGv_i32 desc;
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
-     [VIRT_PCDIMM_ACPI] =        { 0x09070000, MEMORY_HOTPLUG_IO_LEN },
+     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
+         return false;
-     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-+    [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
+         return true;
      [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
      /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
      [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
   * virt_cpu_post_init() must be called after the CPUs have
   * been realized and the GIC has been created.
   */
 -static void virt_cpu_post_init(VirtMachineState *vms)
 +static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
 +                               MemoryRegion *sysmem)
  {
 -    bool aarch64, pmu;
 +    bool aarch64, pmu, steal_time;
      CPUState *cpu;
      aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
      pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
 +    steal_time = object_property_get_bool(OBJECT(first_cpu),
 +                                          "kvm-steal-time", NULL);
      if (kvm_enabled()) {
 +        hwaddr pvtime_reg_base = vms->memmap[VIRT_PVTIME].base;
 +        hwaddr pvtime_reg_size = vms->memmap[VIRT_PVTIME].size;
 +
 +        if (steal_time) {
 +            MemoryRegion *pvtime = g_new(MemoryRegion, 1);
 +            hwaddr pvtime_size = max_cpus * PVTIME_SIZE_PER_CPU;
 +
 +            /* The memory region size must be a multiple of host page size. */
 +            pvtime_size = REAL_HOST_PAGE_ALIGN(pvtime_size);
 +
 +            if (pvtime_size > pvtime_reg_size) {
 +                error_report("pvtime requires a %ld byte memory region for "
 +                             "%d CPUs, but only %ld has been reserved",
 +                             pvtime_size, max_cpus, pvtime_reg_size);
 +                exit(1);
 +            }
 +
 +            memory_region_init_ram(pvtime, NULL, "pvtime", pvtime_size, NULL);
 +            memory_region_add_subregion(sysmem, pvtime_reg_base, pvtime);
 +        }
 +
          CPU_FOREACH(cpu) {
              if (pmu) {
                  assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms)
                  }
                  kvm_arm_pmu_init(cpu);
              }
 +            if (steal_time) {
 +                kvm_arm_pvtime_init(cpu, pvtime_reg_base +
 +                                         cpu->cpu_index * PVTIME_SIZE_PER_CPU);
 +            }
          }
      } else {
          if (aarch64 && vms->highmem) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
              object_property_set_bool(cpuobj, "kvm-no-adjvtime", true, NULL);
          }
 +        if (vmc->no_kvm_steal_time &&
 +            object_property_find(cpuobj, "kvm-steal-time")) {
 +            object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
 +        }
 +
          if (vmc->no_pmu && object_property_find(cpuobj, "pmu")) {
              object_property_set_bool(cpuobj, "pmu", false, NULL);
          }
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      create_gic(vms);
 -    virt_cpu_post_init(vms);
 +    virt_cpu_post_init(vms, possible_cpus->len, sysmem);
      fdt_add_pmu_nodes(vms);
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(5, 2)
  static void virt_machine_5_1_options(MachineClass *mc)
  {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
      virt_machine_5_2_options(mc);
      compat_props_add(mc->compat_props, hw_compat_5_1, hw_compat_5_1_len);
 +    vmc->no_kvm_steal_time = true;
  }
  DEFINE_VIRT_MACHINE(5, 1)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
              return;
          }
      }
-+
-+    if (kvm_enabled()) {
+-    n = a->len + 1;
-+        kvm_arm_steal_time_finalize(cpu, &local_err);
+-    if ((a->vn + n) > 32) {
-+        if (local_err != NULL) {
++    if ((a->vn + a->len + 1) > 32) {
-+            error_propagate(errp, local_err);
+         /*
-+            return;
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
-+        }
+          * helper function running off the end of the register file.
-+    }
+          */
  }
  static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
      ARM_CPU(obj)->kvm_adjvtime = !value;
  }
 +static bool kvm_steal_time_get(Object *obj, Error **errp)
 +{
 +    return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
 +}
 +
 +static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
 +{
 +    ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 +}
 +
  /* KVM VCPU properties should be prefixed with "kvm-". */
  void kvm_arm_add_vcpu_properties(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ void kvm_arm_add_vcpu_properties(Object *obj)
                                          "the virtual counter. VM stopped time "
                                          "will be counted.");
      }
 +
 +    cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
 +    object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
 +                             kvm_steal_time_set);
 +    object_property_set_description(obj, "kvm-steal-time",
 +                                    "Set off to disable KVM steal time.");
  }
  bool kvm_arm_pmu_supported(void)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include <linux/kvm.h>
  #include "qemu-common.h"
 +#include "qapi/error.h"
  #include "cpu.h"
  #include "qemu/timer.h"
  #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr)
      return NULL;
  }
 -static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr)
 +static bool kvm_arm_set_device_attr(CPUState *cs, struct kvm_device_attr *attr,
 +                                    const char *name)
  {
      int err;
      err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
      if (err != 0) {
 -        error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err));
 +        error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
          return false;
      }
+-    n <<= 3;
-     err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
+-    tmp = tcg_temp_new_i32();
-     if (err != 0) {
+-    if (a->op) {
--        error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err));
+-        read_neon_element32(tmp, a->vd, 0, MO_32);
-+        error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
+-    } else {
-         return false;
+-        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
+-    tmp3 = tcg_temp_new_i32();
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)
+-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-     if (!ARM_CPU(cs)->has_pmu) {
+-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-         return;
+-    tcg_temp_free_i32(tmp);
-     }
+-    tcg_temp_free_i32(tmp4);
--    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
+-    tcg_temp_free_ptr(ptr1);
-+    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
++    val = tcg_temp_new_i64();
-         error_report("failed to init PMU");
++    read_neon_element64(val, a->vm, 0, MO_64);
-         abort();
-     }
+-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
+-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-     if (!ARM_CPU(cs)->has_pmu) {
+-    tcg_temp_free_i32(tmp2);
-         return;
+-    tcg_temp_free_i32(tmp3);
-     }
++    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
--    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
++    write_neon_element64(val, a->vd, 0, MO_64);
 +    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
          error_report("failed to set irq for PMU");
          abort();
      }
  }
 +void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
 +{
 +    struct kvm_device_attr attr = {
 +        .group = KVM_ARM_VCPU_PVTIME_CTRL,
 +        .attr = KVM_ARM_VCPU_PVTIME_IPA,
 +        .addr = (uint64_t)&ipa,
 +    };
 +
-+    if (ARM_CPU(cs)->kvm_steal_time == ON_OFF_AUTO_OFF) {
++    tcg_temp_free_i64(def);
-+        return;
++    tcg_temp_free_i64(val);
-+    }
++    tcg_temp_free_i32(desc);
 +    if (!kvm_arm_set_device_attr(cs, &attr, "PVTIME IPA")) {
 +        error_report("failed to init PVTIME IPA");
 +        abort();
 +    }
 +}
 +
  static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
  {
      uint64_t ret;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      return true;
  }
-+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
-+{
-+    bool has_steal_time = kvm_arm_steal_time_supported();
-+
-+    if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
-+        if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-+            cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
-+        } else {
-+            cpu->kvm_steal_time = ON_OFF_AUTO_ON;
-+        }
-+    } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
-+        if (!has_steal_time) {
-+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
-+                             "on this host");
-+            return;
-+        } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-+            /*
-+             * DEN0057A chapter 2 says "This specification only covers
-+             * systems in which the Execution state of the hypervisor
-+             * as well as EL1 of virtual machines is AArch64.". And,
-+             * to ensure that, the smc/hvc calls are only specified as
-+             * smc64/hvc64.
-+             */
-+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
-+                             "for AArch32 guests");
-+            return;
-+        }
-+    }
-+}
-+
- bool kvm_arm_aarch32_supported(void)
- {
-     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void)
-     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
- }
-+bool kvm_arm_steal_time_supported(void)
-+{
-+    return kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
-+}
-+
- QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
- void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
-diff --git a/target/arm/monitor.c b/target/arm/monitor.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/monitor.c
-+++ b/target/arm/monitor.c
-@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
-     "sve128", "sve256", "sve384", "sve512",
-     "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
-     "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
--    "kvm-no-adjvtime",
-+    "kvm-no-adjvtime", "kvm-steal-time",
-     NULL
- };
-diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/arm-cpu-features.c
-+++ b/tests/qtest/arm-cpu-features.c
-@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
-     assert_set_feature(qts, "max", "pmu", true);
-     assert_has_not_feature(qts, "max", "kvm-no-adjvtime");
-+    assert_has_not_feature(qts, "max", "kvm-steal-time");
-     if (g_str_equal(qtest_get_arch(), "aarch64")) {
-         assert_has_feature_enabled(qts, "max", "aarch64");
-@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-     assert_set_feature(qts, "host", "kvm-no-adjvtime", false);
-     if (g_str_equal(qtest_get_arch(), "aarch64")) {
-+        bool kvm_supports_steal_time;
-         bool kvm_supports_sve;
-         char max_name[8], name[8];
-         uint32_t max_vq, vq;
-@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         QDict *resp;
-         char *error;
-+        assert_error(qts, "cortex-a15",
-+            "We cannot guarantee the CPU type 'cortex-a15' works "
-+            "with KVM on this host", NULL);
-+
-         assert_has_feature_enabled(qts, "host", "aarch64");
-         /* Enabling and disabling pmu should always work. */
-@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         assert_set_feature(qts, "host", "pmu", false);
-         assert_set_feature(qts, "host", "pmu", true);
--        assert_error(qts, "cortex-a15",
--            "We cannot guarantee the CPU type 'cortex-a15' works "
--            "with KVM on this host", NULL);
--
-+        /*
-+         * Some features would be enabled by default, but they're disabled
-+         * because this instance of KVM doesn't support them. Test that the
-+         * features are present, and, when enabled, issue further tests.
-+         */
-+        assert_has_feature(qts, "host", "kvm-steal-time");
-         assert_has_feature(qts, "host", "sve");
-+
-         resp = do_query_no_props(qts, "host");
-+        kvm_supports_steal_time = resp_get_feature(resp, "kvm-steal-time");
-         kvm_supports_sve = resp_get_feature(resp, "sve");
-         vls = resp_get_sve_vls(resp);
-         qobject_unref(resp);
-+        if (kvm_supports_steal_time) {
-+            /* If we have steal-time then we should be able to toggle it. */
-+            assert_set_feature(qts, "host", "kvm-steal-time", false);
-+            assert_set_feature(qts, "host", "kvm-steal-time", true);
-+        }
-+
-         if (kvm_supports_sve) {
-             g_assert(vls != 0);
-             max_vq = 64 - __builtin_clzll(vls);
-@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         assert_has_not_feature(qts, "host", "aarch64");
-         assert_has_not_feature(qts, "host", "pmu");
-         assert_has_not_feature(qts, "host", "sve");
-+        assert_has_not_feature(qts, "host", "kvm-steal-time");
-     }
-     qtest_quit(qts);
 --
 .20.1

-[PULL 10/12] tests/qtest: Restore aarch64 arm-cpu-features test
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
-From: Andrew Jones <drjones@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-arm-cpu-features got dropped from the AArch64 tests during the meson
+We can use one MPC per SRAM bank, but we currently only wire the
-conversion shuffle.
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
-Message-id: 20201001061718.101915-6-drjones@redhat.com
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-2-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/meson.build | 3 ++-
+ hw/arm/armsse.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/meson.build
+--- a/hw/arm/armsse.c
-+++ b/tests/qtest/meson.build
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-   (cpu != 'arm' ? ['bios-tables-test'] : []) +                                                  \
+                                         qdev_get_gpio_in(dev_splitter, 0));
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
+             qdev_connect_gpio_out(dev_splitter, 0,
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
+                                   qdev_get_gpio_in_named(dev_secctl,
--  ['numa-test',
+-                                                         "mpc_status", 0));
-+  ['arm-cpu-features',
++                                                         "mpc_status",
-+   'numa-test',
++                                                         i - IOTS_NUM_EXP_MPC));
-    'boot-serial-test',
+         }
-    'migration-test']
+         qdev_connect_gpio_out(dev_splitter, 1,
 --
 .20.1

-[PULL 05/12] hw/char/bcm2835_aux: Allow less than 32-bit accesses
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The "BCM2835 ARM Peripherals" datasheet [*] chapter 2
+The system configuration controller (SYSCFG) doesn't have
-("Auxiliaries: UART1 & SPI1, SPI2"), list the register
+any output IRQ (and the INTC input #71 belongs to the UART6).
-sizes as 3/8/16/32 bits. We assume this means this
+Remove the invalid code.
 peripheral allows 8-bit accesses.
-This was not an issue until commit 5d971f9e67 which reverted
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
 ("memory: accept mismatching sizes in memory_region_access_valid").
 The model is implemented as 32-bit accesses (see commit 97398d900c,
 all registers are 32-bit) so replace MemoryRegionOps.valid as
 MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid
 with a 8/32-bit range.
 [*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
 Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201002181032.1899463-1-f4bug@amsat.org
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/bcm2835_aux.c | 4 +++-
+ include/hw/misc/stm32f2xx_syscfg.h | 2 --
-file changed, 3 insertions(+), 1 deletion(-)
+ hw/arm/stm32f205_soc.c             | 1 -
  hw/misc/stm32f2xx_syscfg.c         | 2 --
 files changed, 5 deletions(-)
-diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/bcm2835_aux.c
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/hw/char/bcm2835_aux.c
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
-     .read = bcm2835_aux_read,
+     uint32_t syscfg_exticr3;
-     .write = bcm2835_aux_write,
+     uint32_t syscfg_exticr4;
-     .endianness = DEVICE_NATIVE_ENDIAN,
+     uint32_t syscfg_cmpcr;
--    .valid.min_access_size = 4,
+-
-+    .impl.min_access_size = 4,
+-    qemu_irq irq;
 +    .impl.max_access_size = 4,
 +    .valid.min_access_size = 1,
      .valid.max_access_size = 4,
  };
+ #endif /* HW_STM32F2XX_SYSCFG_H */
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
+     }
+     busdev = SYS_BUS_DEVICE(dev);
+     sysbus_mmio_map(busdev, 0, 0x40013800);
+-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
+     /* Attach UART (uses USART registers) and USART controllers */
+     for (i = 0; i < STM_NUM_USARTS; i++) {
+diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/stm32f2xx_syscfg.c
++++ b/hw/misc/stm32f2xx_syscfg.c
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
+ {
+     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
+-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+-
+     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
+                           TYPE_STM32F2XX_SYSCFG, 0x400);
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 --
 .20.1

-[PULL 07/12] target/arm/kvm: Make uncalled stubs explicitly unreachable
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-From: Andrew Jones <drjones@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-When we compile without KVM support !defined(CONFIG_KVM) we generate
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
-stubs for functions that the linker will still encounter. Sometimes
+OMAP2 chip support") takes care of creating the 3 UARTs.
 these stubs can be executed safely and are placed in paths where they
 get executed with or without KVM. Other functions should never be
 called without KVM. Those functions should be guarded by kvm_enabled(),
 but should also be robust to refactoring mistakes. Putting a
 g_assert_not_reached() in the function should help. Additionally,
 the g_assert_not_reached() calls may actually help the linker remove
 some code.
-We remove the stubs for kvm_arm_get/put_virtual_time(), as they aren't
+Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
-necessary at all - the only caller is in kvm.c
+extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Fortunately we don't need to fix this, because commit 6da68df7f9b
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+("hw/arm/nseries: Replace the bluetooth chardev with a "null"
-Message-id: 20201001061718.101915-3-drjones@redhat.com
+chardev") removed the use of this peripheral. We can simply
 remove the code.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm_arm.h | 51 +++++++++++++++++++++++++++-----------------
+ hw/arm/nseries.c | 11 -----------
-file changed, 32 insertions(+), 19 deletions(-)
+file changed, 11 deletions(-)
-diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm_arm.h
+--- a/hw/arm/nseries.c
-+++ b/target/arm/kvm_arm.h
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
- #else
+ }
--static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
+-static void n8x0_uart_setup(struct n800_s *s)
 -{
+-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
 -    /*
--     * This should never actually be called in the "not KVM" case,
+-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
--     * but set up the fields to indicate an error anyway.
+-     * here, but this code has been removed with the bluetooth backend.
 -     */
--    cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
+-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
 -    cpu->host_cpu_probe_failed = true;
 -}
 -
--static inline void kvm_arm_add_vcpu_properties(Object *obj) {}
+ static void n8x0_usb_setup(struct n800_s *s)
 -
 +/*
 + * It's safe to call these functions without KVM support.
 + * They should either do nothing or return "not supported".
 + */
  static inline bool kvm_arm_aarch32_supported(void)
  {
-     return false;
+     SysBusDevice *dev;
-@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-     return false;
+     n8x0_spi_setup(s);
- }
+     n8x0_dss_setup(s);
+     n8x0_cbus_setup(s);
-+/*
+-    n8x0_uart_setup(s);
-+ * These functions should never actually be called without KVM support.
+     if (machine_usb(machine)) {
-+ */
+         n8x0_usb_setup(s);
-+static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
+     }
 +{
 +    g_assert_not_reached();
 +}
 +
 +static inline void kvm_arm_add_vcpu_properties(Object *obj)
 +{
 +    g_assert_not_reached();
 +}
 +
  static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
  {
 -    return -ENOENT;
 +    g_assert_not_reached();
  }
  static inline int kvm_arm_vgic_probe(void)
  {
 -    return 0;
 +    g_assert_not_reached();
  }
 -static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
 -static inline void kvm_arm_pmu_init(CPUState *cs) {}
 +static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
 +{
 +    g_assert_not_reached();
 +}
 -static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
 +static inline void kvm_arm_pmu_init(CPUState *cs)
 +{
 +    g_assert_not_reached();
 +}
 +
 +static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 +{
 +    g_assert_not_reached();
 +}
 -static inline void kvm_arm_get_virtual_time(CPUState *cs) {}
 -static inline void kvm_arm_put_virtual_time(CPUState *cs) {}
  #endif
  static inline const char *gic_class_name(void)
 --
 .20.1

-[PULL 02/12] hw/arm/fsl-imx25: Fix a typo
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The MusicPal board code connects both of the IRQ outputs of the UART
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
+to the same input is not valid as it produces subtly wrong behaviour
+(for instance if both the IRQ lines are high, and then one goes
+low, the INTC input will see this as a high-to-low transition
+even though the second IRQ line should still be holding it high).
+This kind of wiring needs an explicitly created OR gate; add one.
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201002080935.1660005-1-f4bug@amsat.org
+Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx25.h | 2 +-
+ hw/arm/musicpal.c | 17 +++++++++++++----
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
+--- a/hw/arm/musicpal.c
-+++ b/include/hw/arm/fsl-imx25.h
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {
+@@ -XXX,XX +XXX,XX @@
-  * 0xBB00_0000 0xBB00_0FFF 4 Kbytes     NAND flash main area buffer
+ #include "ui/console.h"
-  * 0xBB00_1000 0xBB00_11FF 512 B        NAND flash spare area buffer
+ #include "hw/i2c/i2c.h"
-  * 0xBB00_1200 0xBB00_1DFF 3 Kbytes     Reserved
+ #include "hw/irq.h"
-- * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control regisers
++#include "hw/or-irq.h"
-+ * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control registers
+ #include "hw/audio/wm8750.h"
-  * 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved
+ #include "sysemu/block-backend.h"
-  * 0xC000_0000 0xFFFF_FFFF 1024 Mbytes  Reserved
+ #include "sysemu/runstate.h"
-  */
+@@ -XXX,XX +XXX,XX @@
  #define MP_TIMER4_IRQ           7
  #define MP_EHCI_IRQ             8
  #define MP_ETH_IRQ              9
 -#define MP_UART1_IRQ            11
 -#define MP_UART2_IRQ            11
 +#define MP_UART_SHARED_IRQ      11
  #define MP_GPIO_IRQ             12
  #define MP_RTC_IRQ              28
  #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
      ARMCPU *cpu;
      qemu_irq pic[32];
      DeviceState *dev;
 +    DeviceState *uart_orgate;
      DeviceState *i2c_dev;
      DeviceState *lcd_dev;
      DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                            pic[MP_TIMER4_IRQ], NULL);
 -    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
 +    /* Logically OR both UART IRQs together */
 +    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
 +    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
 +    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
 +
 +    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 0),
                     1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 -    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
 +    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
 +                   qdev_get_gpio_in(uart_orgate, 1),
                     1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
      /* Register flash */
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
  config MUSICPAL
      bool
 +    select OR_IRQ
      select BITBANG_I2C
      select MARVELL_88W8618
      select PTIMER
 --
 .20.1

-[PULL 01/12] hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Fix integer handling issues handling issue reported by Coverity:
+We don't need to fill the full pic[] array if we only use
 few of the interrupt lines. Directly call qdev_get_gpio_in()
 when necessary.
-  hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()
-  >>>     CID 1432730:  Integer handling issues  (NEGATIVE_RETURNS)
-  >>>     "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.
-npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));
-  hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()
-cs_id = npcm7xx_fiu_cs_index(fiu, f);
-trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,
-size, v);
-  >>>     CID 1432729:  Integer handling issues  (NEGATIVE_RETURNS)
-  >>>     "cs_id" is passed to a parameter that cannot be negative.
-npcm7xx_fiu_select(fiu, cs_id);
-Since the index of the flash can not be negative, return an
-unsigned type.
-Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Message-id: 20200919132435.310527-1-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/npcm7xx_fiu.c | 12 ++++++------
+ hw/arm/musicpal.c | 25 +++++++++++++------------
- hw/ssi/trace-events  |  2 +-
+file changed, 13 insertions(+), 12 deletions(-)
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/npcm7xx_fiu.c
+--- a/hw/arm/musicpal.c
-+++ b/hw/ssi/npcm7xx_fiu.c
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
-  * Returns the index of flash in the fiu->flash array. This corresponds to the
+ static void musicpal_init(MachineState *machine)
   * chip select ID of the flash.
   */
 -static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
 +static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,
 +                                     NPCM7xxFIUFlash *flash)
  {
-     int index = flash - fiu->flash;
+     ARMCPU *cpu;
+-    qemu_irq pic[32];
-@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
+     DeviceState *dev;
- }
++    DeviceState *pic;
+     DeviceState *uart_orgate;
- /* Assert the chip select specified in the UMA Control/Status Register. */
+     DeviceState *i2c_dev;
--static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)
+     DeviceState *lcd_dev;
-+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
- {
+                            &error_fatal);
-     trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
-     if (cs_id < s->cs_count) {
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-         qemu_irq_lower(s->cs_lines[cs_id]);
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-+        s->active_cs = cs_id;
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-     } else {
+-    for (i = 0; i < 32; i++) {
-         qemu_log_mask(LOG_GUEST_ERROR,
+-        pic[i] = qdev_get_gpio_in(dev, i);
-                       "%s: UMA to CS%d; this module has only %d chip selects",
+-    }
-                       DEVICE(s)->canonical_path, cs_id, s->cs_count);
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
--        cs_id = -1;
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+        s->active_cs = -1;
+-                          pic[MP_TIMER4_IRQ], NULL);
-     }
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
--
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
--    s->active_cs = cs_id;
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
- }
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
- /* Deassert the currently active chip select. */
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,
+     /* Logically OR both UART IRQs together */
-     NPCM7xxFIUFlash *f = opaque;
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-     NPCM7xxFIUState *fiu = f->fiu;
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-     uint32_t dwr_cfg;
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
--    int cs_id;
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+    unsigned cs_id;
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-     int i;
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-     if (fiu->active_cs != -1) {
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
+                    qdev_get_gpio_in(uart_orgate, 0),
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
---- a/hw/ssi/trace-events
+                              OBJECT(get_system_memory()), &error_fatal);
-+++ b/hw/ssi/trace-events
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
- npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
+-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
- npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
- npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
++                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
--npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
+     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
 .20.1

-New patch
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+The nseries machines have a codepath that allows them to load a
+secondary bootloader.  This code wasn't checking that the
+load_image_targphys() succeeded.  Check the return value and report
+the error to the user.
+While we're in the vicinity, fix the comment style of the
+comment documenting what this image load is doing.
+Fixes: Coverity CID 1192904
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+---
+ hw/arm/nseries.c | 15 +++++++++++----
+file changed, 11 insertions(+), 4 deletions(-)
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+         /* No, wait, better start at the ROM.  */
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+-        /* This is intended for loading the `secondary.bin' program from
++        /*
++         * This is intended for loading the `secondary.bin' program from
+          * Nokia images (the NOLO bootloader).  The entry point seems
+          * to be at OMAP2_Q2_BASE + 0x400000.
+          *
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
+          *
+          * The code above is for loading the `zImage' file from Nokia
+-         * images.  */
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
+-                            machine->ram_size - 0x400000);
++         * images.
++         */
++        if (load_image_targphys(option_rom[0].name,
++                                OMAP2_Q2_BASE + 0x400000,
++                                machine->ram_size - 0x400000) < 0) {
++            error_report("Failed to load secondary bootloader %s",
++                         option_rom[0].name);
++            exit(EXIT_FAILURE);
++        }
+         n800_setup_nolo_tags(nolo_tags);
+         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
+--
+.20.1

-[PULL 03/12] hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-From: Graeme Gregory <graeme@nuviainc.com>
+From: Havard Skinnemoen <hskinnemoen@google.com>
-SMMUv3 has an error in a previous patch where an i was transposed to a 1
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
-meaning interrupts would not have been correctly assigned to the SMMUv3
+plus one. Currently, it's counting the number of times these transitions
-instance.
+do _not_ happen, plus one.
-Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")
+Source:
-Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+section 2.3.4 point (3).
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20201007100732.4103790-2-graeme@nuviainc.com
+Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/sbsa-ref.c | 2 +-
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/hw/arm/sbsa-ref.c
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
-     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+     pi = (double)nr_ones / nr_bits;
-     for (i = 0; i < NUM_SMMU_IRQS; i++) {
-         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
+     for (k = 0; k < nr_bits - 1; k++) {
--                           qdev_get_gpio_in(sms->gic, irq + 1));
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+                           qdev_get_gpio_in(sms->gic, irq + i));
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
      }
- }
+     vn_obs += 1;
 --
 .20.1

-[PULL 12/12] target/arm: Make '-cpu max' have a 48-bit PA
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-QEMU supports a 48-bit physical address range, but we don't currently
+Checks for UNDEF cases should go before the "is VFP enabled?" access
-expose it in the '-cpu max' ID registers (you get the same range as
+check, except in special cases. Move a stray UNDEF check in the VTBL
-Cortex-A57, which is 44 bits).
+trans function up above the access check.
 Set the ID_AA64MMFR0.PARange field to indicate 48 bits.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201001160116.18095-1-peter.maydell@linaro.org
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 ---
- target/arm/cpu64.c | 4 ++++
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 4 insertions(+)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/target/arm/translate-neon.c.inc
-+++ b/target/arm/cpu64.c
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-         t = FIELD_DP64(t, ID_AA64PFR1, MTE, 2);
+         return false;
-         cpu->isar.id_aa64pfr1 = t;
+     }
-+        t = cpu->isar.id_aa64mmfr0;
+-    if (!vfp_access_check(s)) {
-+        t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 5); /* PARange: 48 bits */
+-        return true;
-+        cpu->isar.id_aa64mmfr0 = t;
+-    }
 -
      if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return false;
      }
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
-         t = cpu->isar.id_aa64mmfr1;
+     desc = tcg_const_i32((a->vn << 2) | a->len);
-         t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
+     def = tcg_temp_new_i64();
-         t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
+     if (a->op) {
 --
 .20.1

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201008

for you to fetch changes up to ba118c26e16a97e6ff6de8184057d3420ce16a23:

target/arm: Make '-cpu max' have a 48-bit PA (2020-10-08 15:24:32 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
 * hw/arm/fsl-imx25: Fix a typo
 * hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
 * hw/arm/sbsa-ref : allocate IRQs for SMMUv3
 * hw/char/bcm2835_aux: Allow less than 32-bit accesses
 * hw/arm/virt: Implement kvm-steal-time
 * target/arm: Make '-cpu max' have a 48-bit PA

----------------------------------------------------------------
Andrew Jones (6):
      linux headers: sync to 5.9-rc7
      target/arm/kvm: Make uncalled stubs explicitly unreachable
      hw/arm/virt: Move post cpu realize check into its own function
      hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
      tests/qtest: Restore aarch64 arm-cpu-features test
      hw/arm/virt: Implement kvm-steal-time

Graeme Gregory (2):
      hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
      hw/arm/sbsa-ref : allocate IRQs for SMMUv3

Peter Maydell (1):
      target/arm: Make '-cpu max' have a 48-bit PA

Philippe Mathieu-Daudé (3):
      hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
      hw/arm/fsl-imx25: Fix a typo
      hw/char/bcm2835_aux: Allow less than 32-bit accesses

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()
  >>>     CID 1432730:  Integer handling issues  (NEGATIVE_RETURNS)
  >>>     "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.
  162         npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()
  218         cs_id = npcm7xx_fiu_cs_index(fiu, f);
  219         trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,
  220                                       size, v);
  >>>     CID 1432729:  Integer handling issues  (NEGATIVE_RETURNS)
  >>>     "cs_id" is passed to a parameter that cannot be negative.
  221         npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an
unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20200919132435.310527-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/npcm7xx_fiu.c | 12 ++++++------
 hw/ssi/trace-events  |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/npcm7xx_fiu.c
+++ b/hw/ssi/npcm7xx_fiu.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {
  * Returns the index of flash in the fiu->flash array. This corresponds to the
  * chip select ID of the flash.
  */
-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,
+                                     NPCM7xxFIUFlash *flash)
 {
     int index = flash - fiu->flash;
 
@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
 }
 
 /* Assert the chip select specified in the UMA Control/Status Register. */
-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)
+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)
 {
     trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);
 
     if (cs_id < s->cs_count) {
         qemu_irq_lower(s->cs_lines[cs_id]);
+        s->active_cs = cs_id;
     } else {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: UMA to CS%d; this module has only %d chip selects",
                       DEVICE(s)->canonical_path, cs_id, s->cs_count);
-        cs_id = -1;
+        s->active_cs = -1;
     }
-
-    s->active_cs = cs_id;
 }
 
 /* Deassert the currently active chip select. */
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,
     NPCM7xxFIUFlash *f = opaque;
     NPCM7xxFIUState *fiu = f->fiu;
     uint32_t dwr_cfg;
-    int cs_id;
+    unsigned cs_id;
     int i;
 
     if (fiu->active_cs != -1) {
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/trace-events
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"
 npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201002080935.1660005-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {
  * 0xBB00_0000 0xBB00_0FFF 4 Kbytes     NAND flash main area buffer
  * 0xBB00_1000 0xBB00_11FF 512 B        NAND flash spare area buffer
  * 0xBB00_1200 0xBB00_1DFF 3 Kbytes     Reserved
- * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control regisers
+ * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control registers
  * 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved
  * 0xC000_0000 0xFFFF_FFFF 1024 Mbytes  Reserved
  */
-- 
2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

SMMUv3 has an error in a previous patch where an i was transposed to a 1
meaning interrupts would not have been correctly assigned to the SMMUv3
instance.

Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")
Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20201007100732.4103790-2-graeme@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
     for (i = 0; i < NUM_SMMU_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
-                           qdev_get_gpio_in(sms->gic, irq + 1));
+                           qdev_get_gpio_in(sms->gic, irq + i));
     }
 }
 
-- 
2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

Original commit did not allocate IRQs for the SMMUv3 in the irqmap
effectively using irq 0->3 (shared with other devices). Assuming
original intent was to allocate unique IRQs then add an allocation
to the irqmap.

Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20201007100732.4103790-3-graeme@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
     [SBSA_SECURE_UART_MM] = 9,
     [SBSA_AHCI] = 10,
     [SBSA_EHCI] = 11,
+    [SBSA_SMMU] = 12, /* ... to 15 */
 };
 
 static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The "BCM2835 ARM Peripherals" datasheet [*] chapter 2
("Auxiliaries: UART1 & SPI1, SPI2"), list the register
sizes as 3/8/16/32 bits. We assume this means this
peripheral allows 8-bit accesses.

This was not an issue until commit 5d971f9e67 which reverted
("memory: accept mismatching sizes in memory_region_access_valid").

The model is implemented as 32-bit accesses (see commit 97398d900c,
all registers are 32-bit) so replace MemoryRegionOps.valid as
MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid
with a 8/32-bit range.

[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201002181032.1899463-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/bcm2835_aux.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {
     .read = bcm2835_aux_read,
     .write = bcm2835_aux_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid.min_access_size = 4,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 4,
+    .valid.min_access_size = 1,
     .valid.max_access_size = 4,
 };
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Update against Linux 5.9-rc7.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-headers/linux/kvm.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_VM_PPC_HV 1
 #define KVM_VM_PPC_PR 2
 
-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */
-#define KVM_VM_MIPS_TE		0
+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */
+#define KVM_VM_MIPS_AUTO	0
 #define KVM_VM_MIPS_VZ		1
+#define KVM_VM_MIPS_TE		2
 
 #define KVM_S390_SIE_PAGE_OFFSET 1
 
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_LAST_CPU 184
 #define KVM_CAP_SMALLER_MAXPHYADDR 185
 #define KVM_CAP_S390_DIAG318 186
+#define KVM_CAP_STEAL_TIME 187
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

When we compile without KVM support !defined(CONFIG_KVM) we generate
stubs for functions that the linker will still encounter. Sometimes
these stubs can be executed safely and are placed in paths where they
get executed with or without KVM. Other functions should never be
called without KVM. Those functions should be guarded by kvm_enabled(),
but should also be robust to refactoring mistakes. Putting a
g_assert_not_reached() in the function should help. Additionally,
the g_assert_not_reached() calls may actually help the linker remove
some code.

We remove the stubs for kvm_arm_get/put_virtual_time(), as they aren't
necessary at all - the only caller is in kvm.c

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 51 +++++++++++++++++++++++++++-----------------
 1 file changed, 32 insertions(+), 19 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 #else
 
-static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
-{
-    /*
-     * This should never actually be called in the "not KVM" case,
-     * but set up the fields to indicate an error anyway.
-     */
-    cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
-    cpu->host_cpu_probe_failed = true;
-}
-
-static inline void kvm_arm_add_vcpu_properties(Object *obj) {}
-
+/*
+ * It's safe to call these functions without KVM support.
+ * They should either do nothing or return "not supported".
+ */
 static inline bool kvm_arm_aarch32_supported(void)
 {
     return false;
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
     return false;
 }
 
+/*
+ * These functions should never actually be called without KVM support.
+ */
+static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_add_vcpu_properties(Object *obj)
+{
+    g_assert_not_reached();
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
-    return -ENOENT;
+    g_assert_not_reached();
 }
 
 static inline int kvm_arm_vgic_probe(void)
 {
-    return 0;
+    g_assert_not_reached();
 }
 
-static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
-static inline void kvm_arm_pmu_init(CPUState *cs) {}
+static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
+{
+    g_assert_not_reached();
+}
 
-static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
+static inline void kvm_arm_pmu_init(CPUState *cs)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
+{
+    g_assert_not_reached();
+}
 
-static inline void kvm_arm_get_virtual_time(CPUState *cs) {}
-static inline void kvm_arm_put_virtual_time(CPUState *cs) {}
 #endif
 
 static inline const char *gic_class_name(void)
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

We'll add more to this new function in coming patches so we also
state the gic must be created and call it below create_gic().

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-4-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
     }
 }
 
+/*
+ * virt_cpu_post_init() must be called after the CPUs have
+ * been realized and the GIC has been created.
+ */
+static void virt_cpu_post_init(VirtMachineState *vms)
+{
+    bool aarch64;
+
+    aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
+
+    if (!kvm_enabled()) {
+        if (aarch64 && vms->highmem) {
+            int requested_pa_size = 64 - clz64(vms->highest_gpa);
+            int pamax = arm_pamax(ARM_CPU(first_cpu));
+
+            if (pamax < requested_pa_size) {
+                error_report("VCPU supports less PA bits (%d) than "
+                             "requested by the memory map (%d)",
+                             pamax, requested_pa_size);
+                exit(1);
+            }
+        }
+    }
+}
+
 static void machvirt_init(MachineState *machine)
 {
     VirtMachineState *vms = VIRT_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     fdt_add_timer_nodes(vms);
     fdt_add_cpu_nodes(vms);
 
-   if (!kvm_enabled()) {
-        ARMCPU *cpu = ARM_CPU(first_cpu);
-        bool aarch64 = object_property_get_bool(OBJECT(cpu), "aarch64", NULL);
-
-        if (aarch64 && vms->highmem) {
-            int requested_pa_size, pamax = arm_pamax(cpu);
-
-            requested_pa_size = 64 - clz64(vms->highest_gpa);
-            if (pamax < requested_pa_size) {
-                error_report("VCPU supports less PA bits (%d) than requested "
-                            "by the memory map (%d)", pamax, requested_pa_size);
-                exit(1);
-            }
-        }
-    }
-
     memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                 machine->ram);
     if (machine->device_memory) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     create_gic(vms);
 
+    virt_cpu_post_init(vms);
+
     fdt_add_pmu_nodes(vms);
 
     create_uart(vms, VIRT_UART, sysmem, serial_hd(0));
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Move the KVM PMU setup part of fdt_add_pmu_nodes() to
virt_cpu_post_init(), which is a more appropriate location. Now
fdt_add_pmu_nodes() is also named more appropriately, because it
no longer does anything but fdt node creation.

No functional change intended.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-5-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
 
 static void fdt_add_pmu_nodes(const VirtMachineState *vms)
 {
-    CPUState *cpu;
-    ARMCPU *armcpu;
+    ARMCPU *armcpu = ARM_CPU(first_cpu);
     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
 
-    CPU_FOREACH(cpu) {
-        armcpu = ARM_CPU(cpu);
-        if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
-            return;
-        }
-        if (kvm_enabled()) {
-            if (kvm_irqchip_in_kernel()) {
-                kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
-            }
-            kvm_arm_pmu_init(cpu);
-        }
+    if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
+        assert(!object_property_get_bool(OBJECT(armcpu), "pmu", NULL));
+        return;
     }
 
     if (vms->gic_version == VIRT_GIC_VERSION_2) {
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
                              (1 << vms->smp_cpus) - 1);
     }
 
-    armcpu = ARM_CPU(qemu_get_cpu(0));
     qemu_fdt_add_subnode(vms->fdt, "/pmu");
     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
         const char compat[] = "arm,armv8-pmuv3";
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
  */
 static void virt_cpu_post_init(VirtMachineState *vms)
 {
-    bool aarch64;
+    bool aarch64, pmu;
+    CPUState *cpu;
 
     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
+    pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
 
-    if (!kvm_enabled()) {
+    if (kvm_enabled()) {
+        CPU_FOREACH(cpu) {
+            if (pmu) {
+                assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
+                if (kvm_irqchip_in_kernel()) {
+                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
+                }
+                kvm_arm_pmu_init(cpu);
+            }
+        }
+    } else {
         if (aarch64 && vms->highmem) {
             int requested_pa_size = 64 - clz64(vms->highest_gpa);
             int pamax = arm_pamax(ARM_CPU(first_cpu));
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

arm-cpu-features got dropped from the AArch64 tests during the meson
conversion shuffle.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-6-drjones@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
   (cpu != 'arm' ? ['bios-tables-test'] : []) +                                                  \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
-  ['numa-test',
+  ['arm-cpu-features',
+   'numa-test',
    'boot-serial-test',
    'migration-test']
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

We add the kvm-steal-time CPU property and implement it for machvirt.
A tiny bit of refactoring was also done to allow pmu and pvtime to
use the same vcpu device helper functions.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-7-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 11 ++++++
 include/hw/arm/virt.h            |  5 +++
 target/arm/cpu.h                 |  4 ++
 target/arm/kvm_arm.h             | 43 +++++++++++++++++++++
 hw/arm/virt.c                    | 43 +++++++++++++++++++--
 target/arm/cpu.c                 |  8 ++++
 target/arm/kvm.c                 | 16 ++++++++
 target/arm/kvm64.c               | 64 +++++++++++++++++++++++++++++---
 target/arm/monitor.c             |  2 +-
 tests/qtest/arm-cpu-features.c   | 25 +++++++++++--
 10 files changed, 208 insertions(+), 13 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
                            adjustment, also restoring the legacy (pre-5.0)
                            behavior.
 
+  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
+                           default when KVM is enabled, the feature is
+                           supported, and the guest is 64-bit.
+
+                           When kvm-steal-time is enabled a 64-bit guest
+                           can account for time its CPUs were not running
+                           due to the host not scheduling the corresponding
+                           VCPU threads.  The accounting statistics may
+                           influence the guest scheduler behavior and/or be
+                           exposed to the guest userspace.
+
 SVE CPU Properties
 ==================
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 
 #define PPI(irq) ((irq) + 16)
 
+/* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
+#define PVTIME_SIZE_PER_CPU 64
+
 enum {
     VIRT_FLASH,
     VIRT_MEM,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PCDIMM_ACPI,
     VIRT_ACPI_GED,
     VIRT_NVDIMM_ACPI,
+    VIRT_PVTIME,
     VIRT_LOWMEMMAP_LAST,
 };
 
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     bool no_highmem_ecam;
     bool no_ged;   /* Machines < 4.2 has no support for ACPI GED device */
     bool kvm_no_adjvtime;
+    bool no_kvm_steal_time;
     bool acpi_expose_flash;
 };
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/registerfields.h"
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "qapi/qapi-types-common.h"
 
 /* ARM processors have a weak memory model */
 #define TCG_GUEST_DEFAULT_MO      (0)
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool kvm_vtime_dirty;
     uint64_t kvm_vtime;
 
+    /* KVM steal time */
+    OnOffAuto kvm_steal_time;
+
     /* Uniprocessor system with MP extensions */
     bool mp_is_up;
 
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
  */
 void kvm_arm_add_vcpu_properties(Object *obj);
 
+/**
+ * kvm_arm_steal_time_finalize:
+ * @cpu: ARMCPU for which to finalize kvm-steal-time
+ * @errp: Pointer to Error* for error propagation
+ *
+ * Validate the kvm-steal-time property selection and set its default
+ * based on KVM support and guest configuration.
+ */
+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp);
+
+/**
+ * kvm_arm_steal_time_supported:
+ *
+ * Returns: true if KVM can enable steal time reporting
+ * and false otherwise.
+ */
+bool kvm_arm_steal_time_supported(void);
+
 /**
  * kvm_arm_aarch32_supported:
  *
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
 
 void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
 void kvm_arm_pmu_init(CPUState *cs);
+
+/**
+ * kvm_arm_pvtime_init:
+ * @cs: CPUState
+ * @ipa: Per-vcpu guest physical base address of the pvtime structures
+ *
+ * Initializes PVTIME for the VCPU, setting the PVTIME IPA to @ipa.
+ */
+void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa);
+
 int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 #else
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
     return false;
 }
 
+static inline bool kvm_arm_steal_time_supported(void)
+{
+    return false;
+}
+
 /*
  * These functions should never actually be called without KVM support.
  */
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_pmu_init(CPUState *cs)
     g_assert_not_reached();
 }
 
+static inline void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
 static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 {
     g_assert_not_reached();
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
     [VIRT_PCDIMM_ACPI] =        { 0x09070000, MEMORY_HOTPLUG_IO_LEN },
     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
+    [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
  * virt_cpu_post_init() must be called after the CPUs have
  * been realized and the GIC has been created.
  */
-static void virt_cpu_post_init(VirtMachineState *vms)
+static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
+                               MemoryRegion *sysmem)
 {
-    bool aarch64, pmu;
+    bool aarch64, pmu, steal_time;
     CPUState *cpu;
 
     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
     pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
+    steal_time = object_property_get_bool(OBJECT(first_cpu),
+                                          "kvm-steal-time", NULL);
 
     if (kvm_enabled()) {
+        hwaddr pvtime_reg_base = vms->memmap[VIRT_PVTIME].base;
+        hwaddr pvtime_reg_size = vms->memmap[VIRT_PVTIME].size;
+
+        if (steal_time) {
+            MemoryRegion *pvtime = g_new(MemoryRegion, 1);
+            hwaddr pvtime_size = max_cpus * PVTIME_SIZE_PER_CPU;
+
+            /* The memory region size must be a multiple of host page size. */
+            pvtime_size = REAL_HOST_PAGE_ALIGN(pvtime_size);
+
+            if (pvtime_size > pvtime_reg_size) {
+                error_report("pvtime requires a %ld byte memory region for "
+                             "%d CPUs, but only %ld has been reserved",
+                             pvtime_size, max_cpus, pvtime_reg_size);
+                exit(1);
+            }
+
+            memory_region_init_ram(pvtime, NULL, "pvtime", pvtime_size, NULL);
+            memory_region_add_subregion(sysmem, pvtime_reg_base, pvtime);
+        }
+
         CPU_FOREACH(cpu) {
             if (pmu) {
                 assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms)
                 }
                 kvm_arm_pmu_init(cpu);
             }
+            if (steal_time) {
+                kvm_arm_pvtime_init(cpu, pvtime_reg_base +
+                                         cpu->cpu_index * PVTIME_SIZE_PER_CPU);
+            }
         }
     } else {
         if (aarch64 && vms->highmem) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
             object_property_set_bool(cpuobj, "kvm-no-adjvtime", true, NULL);
         }
 
+        if (vmc->no_kvm_steal_time &&
+            object_property_find(cpuobj, "kvm-steal-time")) {
+            object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
+        }
+
         if (vmc->no_pmu && object_property_find(cpuobj, "pmu")) {
             object_property_set_bool(cpuobj, "pmu", false, NULL);
         }
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     create_gic(vms);
 
-    virt_cpu_post_init(vms);
+    virt_cpu_post_init(vms, possible_cpus->len, sysmem);
 
     fdt_add_pmu_nodes(vms);
 
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(5, 2)
 
 static void virt_machine_5_1_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_5_2_options(mc);
     compat_props_add(mc->compat_props, hw_compat_5_1, hw_compat_5_1_len);
+    vmc->no_kvm_steal_time = true;
 }
 DEFINE_VIRT_MACHINE(5, 1)
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
     }
+
+    if (kvm_enabled()) {
+        kvm_arm_steal_time_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 }
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
     ARM_CPU(obj)->kvm_adjvtime = !value;
 }
 
+static bool kvm_steal_time_get(Object *obj, Error **errp)
+{
+    return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
+}
+
+static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
+{
+    ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+}
+
 /* KVM VCPU properties should be prefixed with "kvm-". */
 void kvm_arm_add_vcpu_properties(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ void kvm_arm_add_vcpu_properties(Object *obj)
                                         "the virtual counter. VM stopped time "
                                         "will be counted.");
     }
+
+    cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
+    object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
+                             kvm_steal_time_set);
+    object_property_set_description(obj, "kvm-steal-time",
+                                    "Set off to disable KVM steal time.");
 }
 
 bool kvm_arm_pmu_supported(void)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 
 #include "qemu-common.h"
+#include "qapi/error.h"
 #include "cpu.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr)
     return NULL;
 }
 
-static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr)
+static bool kvm_arm_set_device_attr(CPUState *cs, struct kvm_device_attr *attr,
+                                    const char *name)
 {
     int err;
 
     err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
     if (err != 0) {
-        error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err));
+        error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
         return false;
     }
 
     err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
     if (err != 0) {
-        error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err));
+        error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)
     if (!ARM_CPU(cs)->has_pmu) {
         return;
     }
-    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
+    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
         error_report("failed to init PMU");
         abort();
     }
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
     if (!ARM_CPU(cs)->has_pmu) {
         return;
     }
-    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
+    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
         error_report("failed to set irq for PMU");
         abort();
     }
 }
 
+void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
+{
+    struct kvm_device_attr attr = {
+        .group = KVM_ARM_VCPU_PVTIME_CTRL,
+        .attr = KVM_ARM_VCPU_PVTIME_IPA,
+        .addr = (uint64_t)&ipa,
+    };
+
+    if (ARM_CPU(cs)->kvm_steal_time == ON_OFF_AUTO_OFF) {
+        return;
+    }
+    if (!kvm_arm_set_device_attr(cs, &attr, "PVTIME IPA")) {
+        error_report("failed to init PVTIME IPA");
+        abort();
+    }
+}
+
 static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
 {
     uint64_t ret;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     return true;
 }
 
+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
+{
+    bool has_steal_time = kvm_arm_steal_time_supported();
+
+    if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
+        if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+            cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
+        } else {
+            cpu->kvm_steal_time = ON_OFF_AUTO_ON;
+        }
+    } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
+        if (!has_steal_time) {
+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
+                             "on this host");
+            return;
+        } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+            /*
+             * DEN0057A chapter 2 says "This specification only covers
+             * systems in which the Execution state of the hypervisor
+             * as well as EL1 of virtual machines is AArch64.". And,
+             * to ensure that, the smc/hvc calls are only specified as
+             * smc64/hvc64.
+             */
+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
+                             "for AArch32 guests");
+            return;
+        }
+    }
+}
+
 bool kvm_arm_aarch32_supported(void)
 {
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void)
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
 }
 
+bool kvm_arm_steal_time_supported(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
+}
+
 QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
 
 void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
     "sve128", "sve256", "sve384", "sve512",
     "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
     "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
-    "kvm-no-adjvtime",
+    "kvm-no-adjvtime", "kvm-steal-time",
     NULL
 };
 
diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
     assert_set_feature(qts, "max", "pmu", true);
 
     assert_has_not_feature(qts, "max", "kvm-no-adjvtime");
+    assert_has_not_feature(qts, "max", "kvm-steal-time");
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature_enabled(qts, "max", "aarch64");
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     assert_set_feature(qts, "host", "kvm-no-adjvtime", false);
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        bool kvm_supports_steal_time;
         bool kvm_supports_sve;
         char max_name[8], name[8];
         uint32_t max_vq, vq;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         QDict *resp;
         char *error;
 
+        assert_error(qts, "cortex-a15",
+            "We cannot guarantee the CPU type 'cortex-a15' works "
+            "with KVM on this host", NULL);
+
         assert_has_feature_enabled(qts, "host", "aarch64");
 
         /* Enabling and disabling pmu should always work. */
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_set_feature(qts, "host", "pmu", false);
         assert_set_feature(qts, "host", "pmu", true);
 
-        assert_error(qts, "cortex-a15",
-            "We cannot guarantee the CPU type 'cortex-a15' works "
-            "with KVM on this host", NULL);
-
+        /*
+         * Some features would be enabled by default, but they're disabled
+         * because this instance of KVM doesn't support them. Test that the
+         * features are present, and, when enabled, issue further tests.
+         */
+        assert_has_feature(qts, "host", "kvm-steal-time");
         assert_has_feature(qts, "host", "sve");
+
         resp = do_query_no_props(qts, "host");
+        kvm_supports_steal_time = resp_get_feature(resp, "kvm-steal-time");
         kvm_supports_sve = resp_get_feature(resp, "sve");
         vls = resp_get_sve_vls(resp);
         qobject_unref(resp);
 
+        if (kvm_supports_steal_time) {
+            /* If we have steal-time then we should be able to toggle it. */
+            assert_set_feature(qts, "host", "kvm-steal-time", false);
+            assert_set_feature(qts, "host", "kvm-steal-time", true);
+        }
+
         if (kvm_supports_sve) {
             g_assert(vls != 0);
             max_vq = 64 - __builtin_clzll(vls);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
         assert_has_not_feature(qts, "host", "sve");
+        assert_has_not_feature(qts, "host", "kvm-steal-time");
     }
 
     qtest_quit(qts);
-- 
2.20.1

QEMU supports a 48-bit physical address range, but we don't currently
expose it in the '-cpu max' ID registers (you get the same range as
Cortex-A57, which is 44 bits).

Set the ID_AA64MMFR0.PARange field to indicate 48 bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201001160116.18095-1-peter.maydell@linaro.org
---
 target/arm/cpu64.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         t = FIELD_DP64(t, ID_AA64PFR1, MTE, 2);
         cpu->isar.id_aa64pfr1 = t;
 
+        t = cpu->isar.id_aa64mmfr0;
+        t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 5); /* PARange: 48 bits */
+        cpu->isar.id_aa64mmfr0 = t;
+
         t = cpu->isar.id_aa64mmfr1;
         t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
         t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
-- 
2.20.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1