[Qemu-devel] [PULL 0/2] target-arm queue

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

A short queue, but I don't want to sit on these fixes any longer.

-- PMM


The following changes since commit e68cba36360a2ab5bf0576b66df4d0eb0d822f8d:

  Merge remote-tracking branch 'remotes/amit-migration/tags/mig-2.3-1' into staging (2015-01-16 10:16:14 +0000)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150116

for you to fetch changes up to 36b62ae6a58f9a588fd33be9386e18a2b90103f5:

  fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write() (2015-01-16 11:54:30 +0000)

----------------------------------------------------------------
target-arm queue:
 * fix endianness handling in fwcfg wide registers
 * fix broken crypto insn emulation on big endian hosts

----------------------------------------------------------------
Ard Biesheuvel (1):
      target-arm: crypto: fix BE host support

Laszlo Ersek (1):
      fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()

 hw/nvram/fw_cfg.c          |  41 +++-------------
 target-arm/crypto_helper.c | 114 +++++++++++++++++++++++++--------------------
 2 files changed, 70 insertions(+), 85 deletions(-)

[Qemu-devel] [PULL 1/2] target-arm: crypto: fix BE host support

[Peter Maydell]

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

The crypto emulation code in target-arm/crypto_helper.c never worked
correctly on big endian hosts, due to the fact that it uses a union
of array types to convert between the native VFP register size (64
bits) and the types used in the algorithms (bytes and 32 bit words)

We cannot just swab between LE and BE when reading and writing the
registers, as the SHA code performs word additions, so instead, add
array accessors for the CRYPTO_STATE type whose LE and BE specific
implementations ensure that the correct array elements are referenced.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1420208303-24111-1-git-send-email-ard.biesheuvel@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target-arm/crypto_helper.c | 114 +++++++++++++++++++++++++--------------------
 1 file changed, 63 insertions(+), 51 deletions(-)

diff --git a/target-arm/crypto_helper.c b/target-arm/crypto_helper.c
index dd60d0b..1fe975d 100644
--- a/target-arm/crypto_helper.c
+++ b/target-arm/crypto_helper.c
@@ -22,6 +22,14 @@ union CRYPTO_STATE {
     uint64_t   l[2];
 };
 
+#ifdef HOST_WORDS_BIGENDIAN
+#define CR_ST_BYTE(state, i)   (state.bytes[(15 - (i)) ^ 8])
+#define CR_ST_WORD(state, i)   (state.words[(3 - (i)) ^ 2])
+#else
+#define CR_ST_BYTE(state, i)   (state.bytes[i])
+#define CR_ST_WORD(state, i)   (state.words[i])
+#endif
+
 void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
                          uint32_t decrypt)
 {
@@ -46,7 +54,7 @@ void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
 
     /* combine ShiftRows operation and sbox substitution */
     for (i = 0; i < 16; i++) {
-        st.bytes[i] = sbox[decrypt][rk.bytes[shift[decrypt][i]]];
+        CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
     }
 
     env->vfp.regs[rd] = make_float64(st.l[0]);
@@ -198,11 +206,11 @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
     assert(decrypt < 2);
 
     for (i = 0; i < 16; i += 4) {
-        st.words[i >> 2] = cpu_to_le32(
-            mc[decrypt][st.bytes[i]] ^
-            rol32(mc[decrypt][st.bytes[i + 1]], 8) ^
-            rol32(mc[decrypt][st.bytes[i + 2]], 16) ^
-            rol32(mc[decrypt][st.bytes[i + 3]], 24));
+        CR_ST_WORD(st, i >> 2) =
+            mc[decrypt][CR_ST_BYTE(st, i)] ^
+            rol32(mc[decrypt][CR_ST_BYTE(st, i + 1)], 8) ^
+            rol32(mc[decrypt][CR_ST_BYTE(st, i + 2)], 16) ^
+            rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
     }
 
     env->vfp.regs[rd] = make_float64(st.l[0]);
@@ -255,24 +263,25 @@ void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
 
             switch (op) {
             case 0: /* sha1c */
-                t = cho(d.words[1], d.words[2], d.words[3]);
+                t = cho(CR_ST_WORD(d, 1), CR_ST_WORD(d, 2), CR_ST_WORD(d, 3));
                 break;
             case 1: /* sha1p */
-                t = par(d.words[1], d.words[2], d.words[3]);
+                t = par(CR_ST_WORD(d, 1), CR_ST_WORD(d, 2), CR_ST_WORD(d, 3));
                 break;
             case 2: /* sha1m */
-                t = maj(d.words[1], d.words[2], d.words[3]);
+                t = maj(CR_ST_WORD(d, 1), CR_ST_WORD(d, 2), CR_ST_WORD(d, 3));
                 break;
             default:
                 g_assert_not_reached();
             }
-            t += rol32(d.words[0], 5) + n.words[0] + m.words[i];
-
-            n.words[0] = d.words[3];
-            d.words[3] = d.words[2];
-            d.words[2] = ror32(d.words[1], 2);
-            d.words[1] = d.words[0];
-            d.words[0] = t;
+            t += rol32(CR_ST_WORD(d, 0), 5) + CR_ST_WORD(n, 0)
+                 + CR_ST_WORD(m, i);
+
+            CR_ST_WORD(n, 0) = CR_ST_WORD(d, 3);
+            CR_ST_WORD(d, 3) = CR_ST_WORD(d, 2);
+            CR_ST_WORD(d, 2) = ror32(CR_ST_WORD(d, 1), 2);
+            CR_ST_WORD(d, 1) = CR_ST_WORD(d, 0);
+            CR_ST_WORD(d, 0) = t;
         }
     }
     env->vfp.regs[rd] = make_float64(d.l[0]);
@@ -286,8 +295,8 @@ void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
         float64_val(env->vfp.regs[rm + 1])
     } };
 
-    m.words[0] = ror32(m.words[0], 2);
-    m.words[1] = m.words[2] = m.words[3] = 0;
+    CR_ST_WORD(m, 0) = ror32(CR_ST_WORD(m, 0), 2);
+    CR_ST_WORD(m, 1) = CR_ST_WORD(m, 2) = CR_ST_WORD(m, 3) = 0;
 
     env->vfp.regs[rd] = make_float64(m.l[0]);
     env->vfp.regs[rd + 1] = make_float64(m.l[1]);
@@ -304,10 +313,10 @@ void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
         float64_val(env->vfp.regs[rm + 1])
     } };
 
-    d.words[0] = rol32(d.words[0] ^ m.words[1], 1);
-    d.words[1] = rol32(d.words[1] ^ m.words[2], 1);
-    d.words[2] = rol32(d.words[2] ^ m.words[3], 1);
-    d.words[3] = rol32(d.words[3] ^ d.words[0], 1);
+    CR_ST_WORD(d, 0) = rol32(CR_ST_WORD(d, 0) ^ CR_ST_WORD(m, 1), 1);
+    CR_ST_WORD(d, 1) = rol32(CR_ST_WORD(d, 1) ^ CR_ST_WORD(m, 2), 1);
+    CR_ST_WORD(d, 2) = rol32(CR_ST_WORD(d, 2) ^ CR_ST_WORD(m, 3), 1);
+    CR_ST_WORD(d, 3) = rol32(CR_ST_WORD(d, 3) ^ CR_ST_WORD(d, 0), 1);
 
     env->vfp.regs[rd] = make_float64(d.l[0]);
     env->vfp.regs[rd + 1] = make_float64(d.l[1]);
@@ -356,20 +365,22 @@ void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
     int i;
 
     for (i = 0; i < 4; i++) {
-        uint32_t t = cho(n.words[0], n.words[1], n.words[2]) + n.words[3]
-                     + S1(n.words[0]) + m.words[i];
-
-        n.words[3] = n.words[2];
-        n.words[2] = n.words[1];
-        n.words[1] = n.words[0];
-        n.words[0] = d.words[3] + t;
-
-        t += maj(d.words[0], d.words[1], d.words[2]) + S0(d.words[0]);
-
-        d.words[3] = d.words[2];
-        d.words[2] = d.words[1];
-        d.words[1] = d.words[0];
-        d.words[0] = t;
+        uint32_t t = cho(CR_ST_WORD(n, 0), CR_ST_WORD(n, 1), CR_ST_WORD(n, 2))
+                     + CR_ST_WORD(n, 3) + S1(CR_ST_WORD(n, 0))
+                     + CR_ST_WORD(m, i);
+
+        CR_ST_WORD(n, 3) = CR_ST_WORD(n, 2);
+        CR_ST_WORD(n, 2) = CR_ST_WORD(n, 1);
+        CR_ST_WORD(n, 1) = CR_ST_WORD(n, 0);
+        CR_ST_WORD(n, 0) = CR_ST_WORD(d, 3) + t;
+
+        t += maj(CR_ST_WORD(d, 0), CR_ST_WORD(d, 1), CR_ST_WORD(d, 2))
+             + S0(CR_ST_WORD(d, 0));
+
+        CR_ST_WORD(d, 3) = CR_ST_WORD(d, 2);
+        CR_ST_WORD(d, 2) = CR_ST_WORD(d, 1);
+        CR_ST_WORD(d, 1) = CR_ST_WORD(d, 0);
+        CR_ST_WORD(d, 0) = t;
     }
 
     env->vfp.regs[rd] = make_float64(d.l[0]);
@@ -394,13 +405,14 @@ void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
     int i;
 
     for (i = 0; i < 4; i++) {
-        uint32_t t = cho(d.words[0], d.words[1], d.words[2]) + d.words[3]
-                     + S1(d.words[0]) + m.words[i];
-
-        d.words[3] = d.words[2];
-        d.words[2] = d.words[1];
-        d.words[1] = d.words[0];
-        d.words[0] = n.words[3 - i] + t;
+        uint32_t t = cho(CR_ST_WORD(d, 0), CR_ST_WORD(d, 1), CR_ST_WORD(d, 2))
+                     + CR_ST_WORD(d, 3) + S1(CR_ST_WORD(d, 0))
+                     + CR_ST_WORD(m, i);
+
+        CR_ST_WORD(d, 3) = CR_ST_WORD(d, 2);
+        CR_ST_WORD(d, 2) = CR_ST_WORD(d, 1);
+        CR_ST_WORD(d, 1) = CR_ST_WORD(d, 0);
+        CR_ST_WORD(d, 0) = CR_ST_WORD(n, 3 - i) + t;
     }
 
     env->vfp.regs[rd] = make_float64(d.l[0]);
@@ -418,10 +430,10 @@ void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
         float64_val(env->vfp.regs[rm + 1])
     } };
 
-    d.words[0] += s0(d.words[1]);
-    d.words[1] += s0(d.words[2]);
-    d.words[2] += s0(d.words[3]);
-    d.words[3] += s0(m.words[0]);
+    CR_ST_WORD(d, 0) += s0(CR_ST_WORD(d, 1));
+    CR_ST_WORD(d, 1) += s0(CR_ST_WORD(d, 2));
+    CR_ST_WORD(d, 2) += s0(CR_ST_WORD(d, 3));
+    CR_ST_WORD(d, 3) += s0(CR_ST_WORD(m, 0));
 
     env->vfp.regs[rd] = make_float64(d.l[0]);
     env->vfp.regs[rd + 1] = make_float64(d.l[1]);
@@ -443,10 +455,10 @@ void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
         float64_val(env->vfp.regs[rm + 1])
     } };
 
-    d.words[0] += s1(m.words[2]) + n.words[1];
-    d.words[1] += s1(m.words[3]) + n.words[2];
-    d.words[2] += s1(d.words[0]) + n.words[3];
-    d.words[3] += s1(d.words[1]) + m.words[0];
+    CR_ST_WORD(d, 0) += s1(CR_ST_WORD(m, 2)) + CR_ST_WORD(n, 1);
+    CR_ST_WORD(d, 1) += s1(CR_ST_WORD(m, 3)) + CR_ST_WORD(n, 2);
+    CR_ST_WORD(d, 2) += s1(CR_ST_WORD(d, 0)) + CR_ST_WORD(n, 3);
+    CR_ST_WORD(d, 3) += s1(CR_ST_WORD(d, 1)) + CR_ST_WORD(m, 0);
 
     env->vfp.regs[rd] = make_float64(d.l[0]);
     env->vfp.regs[rd + 1] = make_float64(d.l[1]);
-- 
1.9.1

[Qemu-devel] [PULL 2/2] fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write()

[Peter Maydell]

From: Laszlo Ersek <lersek@redhat.com>

(1) Let's contemplate what device endianness means, for a memory mapped
device register (independently of QEMU -- that is, on physical hardware).

It determines the byte order that the device will put on the data bus when
the device is producing a *numerical value* for the CPU. This byte order
may differ from the CPU's own byte order, therefore when software wants to
consume the *numerical value*, it may have to swap the byte order first.

For example, suppose we have a device that exposes in a 2-byte register
the number of sheep we have to count before falling asleep. If the value
is decimal 37 (0x0025), then a big endian register will produce [0x00,
0x25], while a little endian register will produce [0x25, 0x00].

If the device register is big endian, but the CPU is little endian, the
numerical value will read as 0x2500 (decimal 9472), which software has to
byte swap before use.

However... if we ask the device about who stole our herd of sheep, and it
answers "XY", then the byte representation coming out of the register must
be [0x58, 0x59], regardless of the device register's endianness for
numeric values. And, software needs to copy these bytes into a string
field regardless of the CPU's own endianness.

(2) QEMU's device register accessor functions work with *numerical values*
exclusively, not strings:

The emulated register's read accessor function returns the numerical value
(eg. 37 decimal, 0x0025) as a *host-encoded* uint64_t. QEMU translates
this value for the guest to the endianness of the emulated device register
(which is recorded in MemoryRegionOps.endianness). Then guest code must
translate the numerical value from device register to guest CPU
endianness, before including it in any computation (see (1)).

(3) However, the data register of the fw_cfg device shall transfer strings
*only* -- that is, opaque blobs. Interpretation of any given blob is
subject to further agreement -- it can be an integer in an independently
determined byte order, or a genuine string, or an array of structs of
integers (in some byte order) and fixed size strings, and so on.

Because register emulation in QEMU is integer-preserving, not
string-preserving (see (2)), we have to jump through a few hoops.

(3a) We defined the memory mapped fw_cfg data register as
DEVICE_BIG_ENDIAN.

The particular choice is not really relevant -- we picked BE only for
consistency with the control register, which *does* transfer integers --
but our choice affects how we must host-encode values from fw_cfg strings.

(3b) Since we want the fw_cfg string "XY" to appear as the [0x58, 0x59]
array on the data register, *and* we picked DEVICE_BIG_ENDIAN, we must
compose the host (== C language) value 0x5859 in the read accessor
function.

(3c) When the guest performs the read access, the immediate uint16_t value
will be 0x5958 (in LE guests) and 0x5859 (in BE guests). However, the
uint16_t value does not matter. The only thing that matters is the byte
pattern [0x58, 0x59], which the guest code must copy into the target
string *without* any byte-swapping.

(4) Now I get to explain where I screwed up. :(

When we decided for big endian *integer* representation in the MMIO data
register -- see (3a) --, I mindlessly added an indiscriminate
byte-swizzling step to the (little endian) guest firmware.

This was a grave error -- it violates (3c) --, but I didn't realize it. I
only saw that the code I otherwise intended for fw_cfg_data_mem_read():

    value = 0;
    for (i = 0; i < size; ++i) {
        value = (value << 8) | fw_cfg_read(s);
    }

didn't produce the expected result in the guest.

In true facepalm style, instead of blaming my guest code (which violated
(3c)), I blamed my host code (which was correct). Ultimately, I coded
ldX_he_p() into fw_cfg_data_mem_read(), because that happened to work.

Obviously (...in retrospect) that was wrong. Only because my host happened
to be LE, ldX_he_p() composed the (otherwise incorrect) host value 0x5958
from the fw_cfg string "XY". And that happened to compensate for the bogus
indiscriminate byte-swizzling in my guest code.

Clearly the current code leaks the host endianness through to the guest,
which is wrong. Any device should work the same regardless of host
endianness.

The solution is to compose the host-endian representation (2) of the big
endian interpretation (3a, 3b) of the fw_cfg string, and to drop the wrong
byte-swizzling in the guest (3c).

Brown paper bag time for me.

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 1420024880-15416-1-git-send-email-lersek@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/fw_cfg.c | 41 +++++++----------------------------------
 1 file changed, 7 insertions(+), 34 deletions(-)

diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index fcdf821..78a37be 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -287,51 +287,24 @@ static uint64_t fw_cfg_data_mem_read(void *opaque, hwaddr addr,
                                      unsigned size)
 {
     FWCfgState *s = opaque;
-    uint8_t buf[8];
+    uint64_t value = 0;
     unsigned i;
 
     for (i = 0; i < size; ++i) {
-        buf[i] = fw_cfg_read(s);
+        value = (value << 8) | fw_cfg_read(s);
     }
-    switch (size) {
-    case 1:
-        return buf[0];
-    case 2:
-        return lduw_he_p(buf);
-    case 4:
-        return (uint32_t)ldl_he_p(buf);
-    case 8:
-        return ldq_he_p(buf);
-    }
-    abort();
+    return value;
 }
 
 static void fw_cfg_data_mem_write(void *opaque, hwaddr addr,
                                   uint64_t value, unsigned size)
 {
     FWCfgState *s = opaque;
-    uint8_t buf[8];
-    unsigned i;
+    unsigned i = size;
 
-    switch (size) {
-    case 1:
-        buf[0] = value;
-        break;
-    case 2:
-        stw_he_p(buf, value);
-        break;
-    case 4:
-        stl_he_p(buf, value);
-        break;
-    case 8:
-        stq_he_p(buf, value);
-        break;
-    default:
-        abort();
-    }
-    for (i = 0; i < size; ++i) {
-        fw_cfg_write(s, buf[i]);
-    }
+    do {
+        fw_cfg_write(s, value >> (8 * --i));
+    } while (i);
 }
 
 static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
-- 
1.9.1

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 16 January 2015 at 12:05, Peter Maydell <peter.maydell@linaro.org> wrote:
> A short queue, but I don't want to sit on these fixes any longer.
>
> -- PMM
>
>
> The following changes since commit e68cba36360a2ab5bf0576b66df4d0eb0d822f8d:
>
>   Merge remote-tracking branch 'remotes/amit-migration/tags/mig-2.3-1' into staging (2015-01-16 10:16:14 +0000)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150116
>
> for you to fetch changes up to 36b62ae6a58f9a588fd33be9386e18a2b90103f5:
>
>   fw_cfg: fix endianness in fw_cfg_data_mem_read() / _write() (2015-01-16 11:54:30 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * fix endianness handling in fwcfg wide registers
>  * fix broken crypto insn emulation on big endian hosts

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 14 March 2017 at 12:32, Peter Maydell <peter.maydell@linaro.org> wrote:
> Couple of minor patches to sneak in before rc0. The PSCI return
> values fix is the most important one.
>
> -- PMM
>
> The following changes since commit 94b5d57d2f5a3c849cecd65e424bb6f50b998df9:
>
>   Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170314' into staging (2017-03-14 10:13:19 +0000)
>
> are available in the git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170314
>
> for you to fetch changes up to d5affb0d8677e1a8a8fe03fa25005b669e7cdc02:
>
>   target/arm/arm-powerctl: Fix psci info return values (2017-03-14 11:28:54 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * arm-powerctl: Fix psci info return values
>  * implement armv8 PMUSERENR (user-mode enable bits)
>
> ----------------------------------------------------------------
> Andrew Baumann (1):
>       target/arm: implement armv8 PMUSERENR (user-mode enable bits)
>
> Andrew Jones (1):
>       target/arm/arm-powerctl: Fix psci info return values
>
>  target/arm/cpu.h    |  4 +--
>  target/arm/helper.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++------
>  2 files changed, 73 insertions(+), 10 deletions(-)
>


Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Couple of minor patches to sneak in before rc0. The PSCI return
values fix is the most important one.

-- PMM

The following changes since commit 94b5d57d2f5a3c849cecd65e424bb6f50b998df9:

  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.9-20170314' into staging (2017-03-14 10:13:19 +0000)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170314

for you to fetch changes up to d5affb0d8677e1a8a8fe03fa25005b669e7cdc02:

  target/arm/arm-powerctl: Fix psci info return values (2017-03-14 11:28:54 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm-powerctl: Fix psci info return values
 * implement armv8 PMUSERENR (user-mode enable bits)

----------------------------------------------------------------
Andrew Baumann (1):
      target/arm: implement armv8 PMUSERENR (user-mode enable bits)

Andrew Jones (1):
      target/arm/arm-powerctl: Fix psci info return values

 target/arm/cpu.h    |  4 +--
 target/arm/helper.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++------
 2 files changed, 73 insertions(+), 10 deletions(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1364 bytes --]

On Mon, Nov 28, 2016 at 01:51:09PM +0000, Peter Maydell wrote:
> target-arm queue for 2.8 rc2: just two bugfixes.
> 
> thanks
> -- PMM
> 
> The following changes since commit 00227fefd2059464cd2f59aed29944874c630e2f:
> 
>   Update version for v2.8.0-rc1 release (2016-11-22 22:29:08 +0000)
> 
> are available in the git repository at:
> 
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20161128
> 
> for you to fetch changes up to b77257d7bae26a0fca6a90af88d54ee2c45f5b61:
> 
>   arm: Create /chosen and /memory devicetree nodes if necessary (2016-11-28 11:32:34 +0000)
> 
> ----------------------------------------------------------------
> target-arm queue:
>  * hw/arm/boot: fix crash handling device trees with no /chosen
>    or /memory nodes
>  * generic-loader: only set PC if a CPU is specified
> 
> ----------------------------------------------------------------
> Alistair Francis (1):
>       generic-loader: file: Only set a PC if a CPU is specified
> 
> Guenter Roeck (1):
>       arm: Create /chosen and /memory devicetree nodes if necessary
> 
>  hw/arm/boot.c            | 17 +++++++++++++++++
>  hw/core/generic-loader.c |  7 ++++++-
>  2 files changed, 23 insertions(+), 1 deletion(-)

Thanks, applied to my staging tree:
https://github.com/stefanha/qemu/commits/staging

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

target-arm queue for 2.8 rc2: just two bugfixes.

thanks
-- PMM

The following changes since commit 00227fefd2059464cd2f59aed29944874c630e2f:

  Update version for v2.8.0-rc1 release (2016-11-22 22:29:08 +0000)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20161128

for you to fetch changes up to b77257d7bae26a0fca6a90af88d54ee2c45f5b61:

  arm: Create /chosen and /memory devicetree nodes if necessary (2016-11-28 11:32:34 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/boot: fix crash handling device trees with no /chosen
   or /memory nodes
 * generic-loader: only set PC if a CPU is specified

----------------------------------------------------------------
Alistair Francis (1):
      generic-loader: file: Only set a PC if a CPU is specified

Guenter Roeck (1):
      arm: Create /chosen and /memory devicetree nodes if necessary

 hw/arm/boot.c            | 17 +++++++++++++++++
 hw/core/generic-loader.c |  7 ++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 19 July 2016 at 18:03, Peter Maydell <peter.maydell@linaro.org> wrote:
> Couple of stray patches for rc0...
>
> -- PMM
>
> The following changes since commit 5d3217340adcb6c4f0e4af5d2b865331eb2ff63d:
>
>   disas: Fix ATTRIBUTE_UNUSED define clash with ALSA headers (2016-07-19 16:40:39 +0100)
>
> are available in the git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20160719
>
> for you to fetch changes up to acd82796211041c5af43c8c523b85d250c2ccebe:
>
>   arm_gicv3: Add assert()s to tell Coverity that offsets are aligned (2016-07-19 17:56:27 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * fix two minor Coverity complaints

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Couple of stray patches for rc0...

-- PMM

The following changes since commit 5d3217340adcb6c4f0e4af5d2b865331eb2ff63d:

  disas: Fix ATTRIBUTE_UNUSED define clash with ALSA headers (2016-07-19 16:40:39 +0100)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20160719

for you to fetch changes up to acd82796211041c5af43c8c523b85d250c2ccebe:

  arm_gicv3: Add assert()s to tell Coverity that offsets are aligned (2016-07-19 17:56:27 +0100)

----------------------------------------------------------------
target-arm queue:
 * fix two minor Coverity complaints

----------------------------------------------------------------
Peter Maydell (2):
      target-arm: Fix unreachable code in gicv3_class_name()
      arm_gicv3: Add assert()s to tell Coverity that offsets are aligned

 hw/intc/arm_gicv3_redist.c | 4 ++++
 target-arm/machine.c       | 3 +--
 2 files changed, 5 insertions(+), 2 deletions(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 12 November 2015 at 15:23, Peter Maydell <peter.maydell@linaro.org> wrote:
> Last two things to sneak in before rc0.
>
> thanks
> -- PMM
>
> The following changes since commit 17e50a72a3aade0eddfebc012a5d7bdd40a03573:
>
>   Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging (2015-11-12 14:15:32 +0000)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20151112
>
> for you to fetch changes up to a7df81a503ce0dd38fe400c9a37fe95ee07b51f0:
>
>   hw/misc: Add support for ADC controller in Xilinx Zynq 7000 (2015-11-12 15:10:43 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * add ADC controller to zynq board
>  * update PC before calling gen_helper_check_breakpoints()
>
> ----------------------------------------------------------------
> Guenter Roeck (1):
>       hw/misc: Add support for ADC controller in Xilinx Zynq 7000
>
> Sergey Fedorov (1):
>       target-arm: Update PC before calling gen_helper_check_breakpoints()

The ADC patch had compile failures due to not having a 'default' case
in its register-read function which meant it was provoking warnings
about value-maybe-used-uninitialized. So I dropped that one and
just cherry-picked the BP fix patch.

thanks
-- PMM

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Last two things to sneak in before rc0.

thanks
-- PMM

The following changes since commit 17e50a72a3aade0eddfebc012a5d7bdd40a03573:

  Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging (2015-11-12 14:15:32 +0000)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20151112

for you to fetch changes up to a7df81a503ce0dd38fe400c9a37fe95ee07b51f0:

  hw/misc: Add support for ADC controller in Xilinx Zynq 7000 (2015-11-12 15:10:43 +0000)

----------------------------------------------------------------
target-arm queue:
 * add ADC controller to zynq board
 * update PC before calling gen_helper_check_breakpoints()

----------------------------------------------------------------
Guenter Roeck (1):
      hw/misc: Add support for ADC controller in Xilinx Zynq 7000

Sergey Fedorov (1):
      target-arm: Update PC before calling gen_helper_check_breakpoints()

 hw/arm/xilinx_zynq.c        |   6 +
 hw/misc/Makefile.objs       |   1 +
 hw/misc/zynq-xadc.c         | 302 ++++++++++++++++++++++++++++++++++++++++++++
 include/hw/misc/zynq-xadc.h |  46 +++++++
 target-arm/translate-a64.c  |   1 +
 target-arm/translate.c      |   1 +
 6 files changed, 357 insertions(+)
 create mode 100644 hw/misc/zynq-xadc.c
 create mode 100644 include/hw/misc/zynq-xadc.h

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 21 July 2015 at 12:17, Peter Maydell <peter.maydell@linaro.org> wrote:
> Couple of minor bugfixes...
>
> -- PMM
>
>
> The following changes since commit a1bc040dabc12039944e22d9529f20d6132400dd:
>
>   Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2015-07-21 10:04:32 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150721
>
> for you to fetch changes up to 57b73090e041ece40cc619a3c43a6fafcb3dd647:
>
>   disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR (2015-07-21 11:18:45 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * don't sync CNTVCT with kernel all the time (fixes VM time weirdnesses)
>  * fix a warning compiling disas/arm-a64 with -Wextra

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Couple of minor bugfixes...

-- PMM


The following changes since commit a1bc040dabc12039944e22d9529f20d6132400dd:

  Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2015-07-21 10:04:32 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150721

for you to fetch changes up to 57b73090e041ece40cc619a3c43a6fafcb3dd647:

  disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR (2015-07-21 11:18:45 +0100)

----------------------------------------------------------------
target-arm queue:
 * don't sync CNTVCT with kernel all the time (fixes VM time weirdnesses)
 * fix a warning compiling disas/arm-a64 with -Wextra

----------------------------------------------------------------
Christoffer Dall (1):
      target-arm: kvm: Differentiate registers based on write-back levels

Stefan Weil (1):
      disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR

 disas/arm-a64.cc      |  4 ++--
 target-arm/kvm-stub.c |  2 +-
 target-arm/kvm.c      |  6 +++++-
 target-arm/kvm32.c    | 30 +++++++++++++++++++++++++++++-
 target-arm/kvm64.c    | 30 +++++++++++++++++++++++++++++-
 target-arm/kvm_arm.h  | 12 +++++++++++-
 target-arm/machine.c  |  2 +-
 7 files changed, 78 insertions(+), 8 deletions(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

On 15 July 2015 at 17:25, Peter Maydell <peter.maydell@linaro.org> wrote:
> Small target-arm queue for rc1, just a couple of bugfixes.
>
>
> The following changes since commit 711dc6f36b74fe65a6e5a1847f1152717d887f8a:
>
>   Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging (2015-07-15 14:23:58 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150715
>
> for you to fetch changes up to 76e2aef392629f2b2a468f5158d5c397cc5beed2:
>
>   hw/arm/boot: Increase fdt alignment (2015-07-15 17:16:26 +0100)
>
> ----------------------------------------------------------------
> target arm queue:
>  * handle broken AArch64 kernels which assume DTB won't cross a 2MB boundary
>  * correct broken SCTLR_EL3 reset value
>
> ----------------------------------------------------------------
> Alexander Graf (1):
>       hw/arm/boot: Increase fdt alignment
>
> Peter Maydell (1):
>       target-arm: Fix broken SCTLR_EL3 reset

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Small target-arm queue for rc1, just a couple of bugfixes.


The following changes since commit 711dc6f36b74fe65a6e5a1847f1152717d887f8a:

  Merge remote-tracking branch 'remotes/cody/tags/jtc-for-upstream-pull-request' into staging (2015-07-15 14:23:58 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150715

for you to fetch changes up to 76e2aef392629f2b2a468f5158d5c397cc5beed2:

  hw/arm/boot: Increase fdt alignment (2015-07-15 17:16:26 +0100)

----------------------------------------------------------------
target arm queue:
 * handle broken AArch64 kernels which assume DTB won't cross a 2MB boundary
 * correct broken SCTLR_EL3 reset value

----------------------------------------------------------------
Alexander Graf (1):
      hw/arm/boot: Increase fdt alignment

Peter Maydell (1):
      target-arm: Fix broken SCTLR_EL3 reset

 hw/arm/boot.c       | 28 ++++++++++++++++++++++------
 target-arm/helper.c |  1 +
 2 files changed, 23 insertions(+), 6 deletions(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Blue Swirl]

On Fri, Jan 11, 2013 at 3:36 PM, Peter Maydell <peter.maydell@linaro.org> wrote:
> Small patchqueue, just flushing the target-arm queue before softfreeze.
> Please pull.

Thanks, pulled.

>
> -- PMM
>
> The following changes since commit a6308bc2224db238e72c570482717b68246a7ce0:
>
>   Merge remote-tracking branch 'kraxel/build.1' into staging (2013-01-10 13:26:31 -0600)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.next
>
> for you to fetch changes up to 314e2296dc945e286b605563d7b6e6b269d29816:
>
>   target-arm: Fix SWI (SVC) instruction in M profile. (2013-01-11 15:21:22 +0000)
>
> ----------------------------------------------------------------
> Alex_Rozenman@mentor.com (1):
>       target-arm: Fix SWI (SVC) instruction in M profile.
>
> Eduardo Habkost (1):
>       target-arm: use type_register() instead of type_register_static()
>
>  target-arm/cpu.c    |    2 +-
>  target-arm/helper.c |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

Small patchqueue, just flushing the target-arm queue before softfreeze.
Please pull.

-- PMM

The following changes since commit a6308bc2224db238e72c570482717b68246a7ce0:

  Merge remote-tracking branch 'kraxel/build.1' into staging (2013-01-10 13:26:31 -0600)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.next

for you to fetch changes up to 314e2296dc945e286b605563d7b6e6b269d29816:

  target-arm: Fix SWI (SVC) instruction in M profile. (2013-01-11 15:21:22 +0000)

----------------------------------------------------------------
Alex_Rozenman@mentor.com (1):
      target-arm: Fix SWI (SVC) instruction in M profile.

Eduardo Habkost (1):
      target-arm: use type_register() instead of type_register_static()

 target-arm/cpu.c    |    2 +-
 target-arm/helper.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Re: [Qemu-devel] [PULL 0/2] target-arm queue

[Aurelien Jarno]

On Fri, Jan 13, 2012 at 05:50:37PM +0000, Peter Maydell wrote:
> A small target-arm pullreq, but I want to get the SCR change
> committed because the Calxeda patchset depends on it, and then
> the Samsung patchset is going to need to be updated to sit on
> top of that, as are some Cortex-A15 related changes I've been
> working on.
> 
> The M profile patch only went on the list on Monday, so this
> is slightly early, but it's a pretty trivial change and I
> thought I'd rather get the pullreq sent out before the weekend
> rather than after.
> 
> thanks
> -- PMM
> 
> The following changes since commit 6b620ca3b052e622eef4379cfe37c5c3db5364c9:
> 
>   prepare for future GPLv2+ relicensing (2012-01-13 10:55:56 -0600)
> 
> are available in the git repository at:
>   git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.for-upstream
> 
> Peter Maydell (1):
>       target-arm: Fix errors in decode of M profile CPS
> 
> Rob Herring (1):
>       arm: Add dummy support for co-processor 15's secure config register
> 
>  target-arm/cpu.h       |    3 ++-
>  target-arm/helper.c    |    9 +++++++++
>  target-arm/machine.c   |    2 ++
>  target-arm/translate.c |    8 ++++----
>  4 files changed, 17 insertions(+), 5 deletions(-)
> 

Thanks, pulled.


-- 
Aurelien Jarno	                        GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net

[Qemu-devel] [PULL 0/2] target-arm queue

[Peter Maydell]

A small target-arm pullreq, but I want to get the SCR change
committed because the Calxeda patchset depends on it, and then
the Samsung patchset is going to need to be updated to sit on
top of that, as are some Cortex-A15 related changes I've been
working on.

The M profile patch only went on the list on Monday, so this
is slightly early, but it's a pretty trivial change and I
thought I'd rather get the pullreq sent out before the weekend
rather than after.

thanks
-- PMM

The following changes since commit 6b620ca3b052e622eef4379cfe37c5c3db5364c9:

  prepare for future GPLv2+ relicensing (2012-01-13 10:55:56 -0600)

are available in the git repository at:
  git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.for-upstream

Peter Maydell (1):
      target-arm: Fix errors in decode of M profile CPS

Rob Herring (1):
      arm: Add dummy support for co-processor 15's secure config register

 target-arm/cpu.h       |    3 ++-
 target-arm/helper.c    |    9 +++++++++
 target-arm/machine.c   |    2 ++
 target-arm/translate.c |    8 ++++----
 4 files changed, 17 insertions(+), 5 deletions(-)