[Qemu-devel] [PULL 00/12] target-arm queue

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

ARM queue: nothing particularly exciting here, but no
reason to sit on them for another week.

thanks
-- PMM

The following changes since commit 61eedf7aec0e2395aabd628cc055096909a3ea15:

  tests/prom-env: Ease time-out problems on slow hosts (2017-02-10 15:44:53 +0000)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170210

for you to fetch changes up to b4cc583f0285a2e1e78621dfba142f00ca47414a:

  aspeed/smc: use a modulo to check segment limits (2017-02-10 17:40:30 +0000)

----------------------------------------------------------------
target-arm queue:
 * aspeed: minor fixes
 * virt: declare fwcfg and virtio-mmio as DMA coherent in DT & ACPI
 * arm: enable basic TCG emulation of PMU for AArch64

----------------------------------------------------------------
Alexander Graf (4):
      target-arm: Declare virtio-mmio as dma-coherent in dt
      hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPI
      hw/arm/virt: Declare fwcfg as dma cache coherent in ACPI
      hw/arm/virt: Declare fwcfg as dma cache coherent in dt

Cédric Le Goater (4):
      aspeed: check for negative values returned by blk_getlength()
      aspeed: remove useless comment on controller segment size
      aspeed/smc: handle dummies only in fast read mode
      aspeed/smc: use a modulo to check segment limits

Wei Huang (4):
      target-arm: Add support for PMU register PMSELR_EL0
      target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0
      target-arm: Add support for PMU register PMINTENSET_EL1
      target-arm: Enable vPMU support under TCG mode

 target/arm/cpu.h         |  4 +--
 hw/arm/aspeed.c          | 22 +++++++++-----
 hw/arm/vexpress.c        |  1 +
 hw/arm/virt-acpi-build.c |  2 ++
 hw/arm/virt.c            |  4 ++-
 hw/ssi/aspeed_smc.c      | 13 +++++----
 target/arm/cpu.c         |  2 +-
 target/arm/helper.c      | 74 ++++++++++++++++++++++++++++++++++++------------
 8 files changed, 88 insertions(+), 34 deletions(-)

[Qemu-devel] [PULL 01/12] target-arm: Add support for PMU register PMSELR_EL0

[Peter Maydell]

From: Wei Huang <wei@redhat.com>

This patch adds support for AArch64 register PMSELR_EL0. The existing
PMSELR definition is revised accordingly.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: Moved #ifndef CONFIG_USER_ONLY to cover new regdefs]
Message-id: 1486504171-26807-2-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 27 +++++++++++++++++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c0b3832..7e609f7 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -309,6 +309,7 @@ typedef struct CPUARMState {
         uint32_t c9_pmovsr; /* perf monitor overflow status */
         uint32_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
+        uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c23df1b..42803d4 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -975,6 +975,17 @@ static uint64_t pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return total_ticks - env->cp15.c15_ccnt;
 }
 
+static void pmselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    /* The value of PMSELR.SEL affects the behavior of PMXEVTYPER and
+     * PMXEVCNTR. We allow [0..31] to be written to PMSELR here; in the
+     * meanwhile, we check PMSELR.SEL when PMXEVTYPER and PMXEVCNTR are
+     * accessed.
+     */
+    env->cp15.c9_pmselr = value & 0x1f;
+}
+
 static void pmccntr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
@@ -1194,13 +1205,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     /* Unimplemented so WI. */
     { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4,
       .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP },
-    /* Since we don't implement any events, writing to PMSELR is UNPREDICTABLE.
-     * We choose to RAZ/WI.
-     */
-    { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
-      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-      .accessfn = pmreg_access },
 #ifndef CONFIG_USER_ONLY
+    { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
+      .access = PL0_RW, .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmselr),
+      .accessfn = pmreg_access, .writefn = pmselr_write,
+      .raw_writefn = raw_write},
+    { .name = "PMSELR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 5,
+      .access = PL0_RW, .accessfn = pmreg_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
+      .writefn = pmselr_write, .raw_writefn = raw_write, },
     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
       .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
       .readfn = pmccntr_read, .writefn = pmccntr_write32,
-- 
2.7.4

[Qemu-devel] [PULL 02/12] target-arm: Add support for AArch64 PMU register PMXEVTYPER_EL0

[Peter Maydell]

From: Wei Huang <wei@redhat.com>

In order to support Linux perf, which uses PMXEVTYPER register,
this patch adds read/write access support for PMXEVTYPER. The access
is CONSTRAINED UNPREDICTABLE when PMSELR is not 0x1f. Additionally
this patch adds support for PMXEVTYPER_EL0.

Signed-off-by: Wei Huang <wei@redhat.com>
Message-id: 1486504171-26807-3-git-send-email-wei@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 -
 target/arm/helper.c | 30 +++++++++++++++++++++++++-----
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 7e609f7..edc1f76 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -307,7 +307,6 @@ typedef struct CPUARMState {
         uint64_t c9_pmcr; /* performance monitor control register */
         uint64_t c9_pmcnten; /* perf monitor counter enables */
         uint32_t c9_pmovsr; /* perf monitor overflow status */
-        uint32_t c9_pmxevtyper; /* perf monitor event type */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint32_t c9_pminten; /* perf monitor interrupt enables */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 42803d4..b837d36 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1054,7 +1054,25 @@ static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void pmxevtyper_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
-    env->cp15.c9_pmxevtyper = value & 0xff;
+    /* Attempts to access PMXEVTYPER are CONSTRAINED UNPREDICTABLE when
+     * PMSELR value is equal to or greater than the number of implemented
+     * counters, but not equal to 0x1f. We opt to behave as a RAZ/WI.
+     */
+    if (env->cp15.c9_pmselr == 0x1f) {
+        pmccfiltr_write(env, ri, value);
+    }
+}
+
+static uint64_t pmxevtyper_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* We opt to behave as a RAZ/WI when attempts to access PMXEVTYPER
+     * are CONSTRAINED UNPREDICTABLE. See comments in pmxevtyper_write().
+     */
+    if (env->cp15.c9_pmselr == 0x1f) {
+        return env->cp15.pmccfiltr_el0;
+    } else {
+        return 0;
+    }
 }
 
 static void pmuserenr_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -1234,10 +1252,12 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.pmccfiltr_el0),
       .resetvalue = 0, },
     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
-      .access = PL0_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
-      .accessfn = pmreg_access, .writefn = pmxevtyper_write,
-      .raw_writefn = raw_write },
+      .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
+    { .name = "PMXEVTYPER_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 13, .opc2 = 1,
+      .access = PL0_RW, .type = ARM_CP_NO_RAW, .accessfn = pmreg_access,
+      .writefn = pmxevtyper_write, .readfn = pmxevtyper_read },
     /* Unimplemented, RAZ/WI. */
     { .name = "PMXEVCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 2,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0,
-- 
2.7.4

[Qemu-devel] [PULL 03/12] target-arm: Add support for PMU register PMINTENSET_EL1

[Peter Maydell]

From: Wei Huang <wei@redhat.com>

This patch adds access support for PMINTENSET_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1486504171-26807-4-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  2 +-
 target/arm/helper.c | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index edc1f76..0956a54 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -309,7 +309,7 @@ typedef struct CPUARMState {
         uint32_t c9_pmovsr; /* perf monitor overflow status */
         uint32_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
-        uint32_t c9_pminten; /* perf monitor interrupt enables */
+        uint64_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
             struct {
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b837d36..5358ac6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1275,9 +1275,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .writefn = pmuserenr_write, .raw_writefn = raw_write },
     { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_tpm,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .type = ARM_CP_ALIAS,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
       .resetvalue = 0,
       .writefn = pmintenset_write, .raw_writefn = raw_write },
+    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .type = ARM_CP_IO,
+      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
+      .writefn = pmintenset_write, .raw_writefn = raw_write,
+      .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
-- 
2.7.4

[Qemu-devel] [PULL 04/12] target-arm: Enable vPMU support under TCG mode

[Peter Maydell]

From: Wei Huang <wei@redhat.com>

This patch contains several fixes to enable vPMU under TCG mode. It
first removes the checking of kvm_enabled() while unsetting
ARM_FEATURE_PMU. With it, the .pmu option can be used to turn on/off vPMU
under TCG mode. Secondly the PMU node of DT table is now created under TCG.
The last fix is to disable the masking of PMUver field of ID_AA64DFR0_EL1.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1486504171-26807-5-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c       | 2 +-
 target/arm/cpu.c    | 2 +-
 target/arm/helper.c | 7 +------
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 1f216cf..8eef143 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -471,7 +471,7 @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
     CPU_FOREACH(cpu) {
         armcpu = ARM_CPU(cpu);
         if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU) ||
-            !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ))) {
+            (kvm_enabled() && !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ)))) {
             return;
         }
     }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 4ee250c..4a069f6 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -781,7 +781,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         unset_feature(env, ARM_FEATURE_EL2);
     }
 
-    if (!cpu->has_pmu || !kvm_enabled()) {
+    if (!cpu->has_pmu) {
         cpu->has_pmu = false;
         unset_feature(env, ARM_FEATURE_PMU);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 5358ac6..47250bc 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4633,12 +4633,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              /* We mask out the PMUVer field, because we don't currently
-               * implement the PMU. Not advertising it prevents the guest
-               * from trying to use it and getting UNDEFs on registers we
-               * don't implement.
-               */
-              .resetvalue = cpu->id_aa64dfr0 & ~0xf00 },
+              .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-- 
2.7.4

[Qemu-devel] [PULL 05/12] target-arm: Declare virtio-mmio as dma-coherent in dt

[Peter Maydell]

From: Alexander Graf <agraf@suse.de>

QEMU emulated hardware is always dma coherent with its guest. We do
annotate that correctly on the PCI host controller, but left out
virtio-mmio.

Recent kernels have started to interpret that flag rather than take
dma coherency as granted with virtio-mmio. While that is considered
a kernel bug, as it breaks previously working systems, it showed that
our dt description is incomplete.

This patch adds the respective marker that allows guest OSs to evaluate
that our virtio-mmio devices are indeed cache coherent.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 1486644810-33181-2-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/vexpress.c | 1 +
 hw/arm/virt.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 58760f4..e057568 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -452,6 +452,7 @@ static int add_virtio_mmio_node(void *fdt, uint32_t acells, uint32_t scells,
                                        acells, addr, scells, size);
     qemu_fdt_setprop_cells(fdt, nodename, "interrupt-parent", intc);
     qemu_fdt_setprop_cells(fdt, nodename, "interrupts", 0, irq, 1);
+    qemu_fdt_setprop(fdt, nodename, "dma-coherent", NULL, 0);
     g_free(nodename);
     if (rc) {
         return -1;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 8eef143..d20e627 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -797,6 +797,7 @@ static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
         qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupts",
                                GIC_FDT_IRQ_TYPE_SPI, irq,
                                GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+        qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
         g_free(nodename);
     }
 }
-- 
2.7.4

[Qemu-devel] [PULL 06/12] hw/arm/virt: Declare virtio-mmio as dma cache coherent in ACPI

[Peter Maydell]

From: Alexander Graf <agraf@suse.de>

Virtio-mmio devices can directly access guest memory and do so in cache
coherent fashion. Tell the guest about that fact when it's using ACPI.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 1486644810-33181-3-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 07a10ac..8955a9d 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -135,6 +135,7 @@ static void acpi_dsdt_add_virtio(Aml *scope,
         Aml *dev = aml_device("VR%02u", i);
         aml_append(dev, aml_name_decl("_HID", aml_string("LNRO0005")));
         aml_append(dev, aml_name_decl("_UID", aml_int(i)));
+        aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 
         Aml *crs = aml_resource_template();
         aml_append(crs, aml_memory32_fixed(base, size, AML_READ_WRITE));
-- 
2.7.4

[Qemu-devel] [PULL 07/12] hw/arm/virt: Declare fwcfg as dma cache coherent in ACPI

[Peter Maydell]

From: Alexander Graf <agraf@suse.de>

Fw-cfg recently learned how to directly access guest memory and does so in
cache coherent fashion. Tell the guest about that fact when it's using ACPI.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 1486644810-33181-4-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 8955a9d..0835e59 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -90,6 +90,7 @@ static void acpi_dsdt_add_fw_cfg(Aml *scope, const MemMapEntry *fw_cfg_memmap)
     aml_append(dev, aml_name_decl("_HID", aml_string("QEMU0002")));
     /* device present, functioning, decoding, not shown in UI */
     aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+    aml_append(dev, aml_name_decl("_CCA", aml_int(1)));
 
     Aml *crs = aml_resource_template();
     aml_append(crs, aml_memory32_fixed(fw_cfg_memmap->base,
-- 
2.7.4

[Qemu-devel] [PULL 08/12] hw/arm/virt: Declare fwcfg as dma cache coherent in dt

[Peter Maydell]

From: Alexander Graf <agraf@suse.de>

Fw-cfg recently learned how to directly access guest memory and does so in
cache coherent fashion. Tell the guest about that fact when it's using DT.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 1486644810-33181-5-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index d20e627..f3440f2 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -929,6 +929,7 @@ static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
                             "compatible", "qemu,fw-cfg-mmio");
     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
                                  2, base, 2, size);
+    qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
     g_free(nodename);
     return fw_cfg;
 }
-- 
2.7.4

[Qemu-devel] [PULL 09/12] aspeed: check for negative values returned by blk_getlength()

[Peter Maydell]

From: Cédric Le Goater <clg@kaod.org>

write_boot_rom() does not check for negative values. This is more a
problem for coverity than the actual code as the size of the flash
device is checked when the m25p80 object is created. If there is
anything wrong with the backing file, we should not even reach that
path.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1486648058-520-2-git-send-email-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index a92c2f1..ac9cbd6 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -113,9 +113,19 @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
 {
     BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
     uint8_t *storage;
+    int64_t size;
 
-    if (rom_size > blk_getlength(blk)) {
-        rom_size = blk_getlength(blk);
+    /* The block backend size should have already been 'validated' by
+     * the creation of the m25p80 object.
+     */
+    size = blk_getlength(blk);
+    if (size <= 0) {
+        error_setg(errp, "failed to get flash size");
+        return;
+    }
+
+    if (rom_size > size) {
+        rom_size = size;
     }
 
     storage = g_new0(uint8_t, rom_size);
-- 
2.7.4

[Qemu-devel] [PULL 10/12] aspeed: remove useless comment on controller segment size

[Peter Maydell]

From: Cédric Le Goater <clg@kaod.org>

The flash devices used for the FMC controller (BMC firmware) are well
defined for each Aspeed machine and are all smaller than the default
mapping window size, at least for CE0 which is the chip the SoC boots
from.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1486648058-520-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ac9cbd6..283c038 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -148,10 +148,6 @@ static void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
         DriveInfo *dinfo = drive_get_next(IF_MTD);
         qemu_irq cs_line;
 
-        /*
-         * FIXME: check that we are not using a flash module exceeding
-         * the controller segment size
-         */
         fl->flash = ssi_create_slave_no_init(s->spi, flashtype);
         if (dinfo) {
             qdev_prop_set_drive(fl->flash, "drive", blk_by_legacy_dinfo(dinfo),
@@ -210,7 +206,9 @@ static void aspeed_board_init(MachineState *machine,
 
         /*
          * create a ROM region using the default mapping window size of
-         * the flash module.
+         * the flash module. The window size is 64MB for the AST2400
+         * SoC and 128MB for the AST2500 SoC, which is twice as big as
+         * needed by the flash modules of the Aspeed machines.
          */
         memory_region_init_rom(boot_rom, OBJECT(bmc), "aspeed.boot_rom",
                                fl->size, &error_abort);
-- 
2.7.4

[Qemu-devel] [PULL 11/12] aspeed/smc: handle dummies only in fast read mode

[Peter Maydell]

From: Cédric Le Goater <clg@kaod.org>

HW works fine in normal read mode with dummy bytes being set. So let's
check this case to not transfer bytes.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1486648058-520-4-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 087b29e..7017707 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -536,10 +536,13 @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
         /*
          * Use fake transfers to model dummy bytes. The value should
          * be configured to some non-zero value in fast read mode and
-         * zero in read mode.
+         * zero in read mode. But, as the HW allows inconsistent
+         * settings, let's check for fast read mode.
          */
-        for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
-            ssi_transfer(fl->controller->spi, 0xFF);
+        if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
+            for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
+                ssi_transfer(fl->controller->spi, 0xFF);
+            }
         }
 
         for (i = 0; i < size; i++) {
-- 
2.7.4

[Qemu-devel] [PULL 12/12] aspeed/smc: use a modulo to check segment limits

[Peter Maydell]

From: Cédric Le Goater <clg@kaod.org>

The size of a segment is not necessarily a power of 2.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1486648058-520-5-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 7017707..cb51573 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -475,15 +475,15 @@ static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
     AspeedSegments seg;
 
     aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
-    if ((addr & (seg.size - 1)) != addr) {
+    if ((addr % seg.size) != addr) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid address 0x%08x for CS%d segment : "
                       "[ 0x%"HWADDR_PRIx" - 0x%"HWADDR_PRIx" ]\n",
                       s->ctrl->name, addr, fl->id, seg.addr,
                       seg.addr + seg.size);
+        addr %= seg.size;
     }
 
-    addr &= seg.size - 1;
     return addr;
 }
 
-- 
2.7.4

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 10 February 2017 at 18:07, Peter Maydell <peter.maydell@linaro.org> wrote:
> ARM queue: nothing particularly exciting here, but no
> reason to sit on them for another week.
>
> thanks
> -- PMM
>
> The following changes since commit 61eedf7aec0e2395aabd628cc055096909a3ea15:
>
>   tests/prom-env: Ease time-out problems on slow hosts (2017-02-10 15:44:53 +0000)
>
> are available in the git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170210
>
> for you to fetch changes up to b4cc583f0285a2e1e78621dfba142f00ca47414a:
>
>   aspeed/smc: use a modulo to check segment limits (2017-02-10 17:40:30 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * aspeed: minor fixes
>  * virt: declare fwcfg and virtio-mmio as DMA coherent in DT & ACPI
>  * arm: enable basic TCG emulation of PMU for AArch64
>

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 03/12] target-arm: Add support for PMU register PMINTENSET_EL1

[Aaron Lindsay]

Wei, Peter,

On Feb 10 18:07, Peter Maydell wrote:
> From: Wei Huang <wei@redhat.com>
> 
> This patch adds access support for PMINTENSET_EL1.
> 
> Signed-off-by: Wei Huang <wei@redhat.com>
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> Message-id: 1486504171-26807-4-git-send-email-wei@redhat.com
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  target/arm/cpu.h    |  2 +-
>  target/arm/helper.c | 10 +++++++++-
>  2 files changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index edc1f76..0956a54 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -309,7 +309,7 @@ typedef struct CPUARMState {
>          uint32_t c9_pmovsr; /* perf monitor overflow status */
>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>          uint64_t c9_pmselr; /* perf monitor counter selection register */
> -        uint32_t c9_pminten; /* perf monitor interrupt enables */
> +        uint64_t c9_pminten; /* perf monitor interrupt enables */

PMINTENSET_EL1 and PMINTENCLR_EL1 are both 32-bit registers, just like
their AArch32 counterparts. Is there a reason I'm missing for why this
has been changed to a uint64_t? There are a number of other 32-bit PMU
registers also currently being represented by uint64_t.

-Aaron

>          union { /* Memory attribute redirection */
>              struct {
>  #ifdef HOST_WORDS_BIGENDIAN
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index b837d36..5358ac6 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -1275,9 +1275,17 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
>        .writefn = pmuserenr_write, .raw_writefn = raw_write },
>      { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1,
>        .access = PL1_RW, .accessfn = access_tpm,
> -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> +      .type = ARM_CP_ALIAS,
> +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pminten),
>        .resetvalue = 0,
>        .writefn = pmintenset_write, .raw_writefn = raw_write },
> +    { .name = "PMINTENSET_EL1", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 1,
> +      .access = PL1_RW, .accessfn = access_tpm,
> +      .type = ARM_CP_IO,
> +      .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> +      .writefn = pmintenset_write, .raw_writefn = raw_write,
> +      .resetvalue = 0x0 },
>      { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
>        .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
>        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
> -- 
> 2.7.4
> 
> 

-- 
Qualcomm Datacenter Technologies as an affiliate of Qualcomm Technologies, Inc.
Qualcomm Technologies, Inc. is a member of the
Code Aurora Forum, a Linux Foundation Collaborative Project.

Re: [Qemu-devel] [PULL 03/12] target-arm: Add support for PMU register PMINTENSET_EL1

[Peter Maydell]

On 23 February 2017 at 13:58, Aaron Lindsay <alindsay@codeaurora.org> wrote:
> Wei, Peter,
>
> On Feb 10 18:07, Peter Maydell wrote:
>> From: Wei Huang <wei@redhat.com>
>>
>> This patch adds access support for PMINTENSET_EL1.
>>
>> Signed-off-by: Wei Huang <wei@redhat.com>
>> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
>> Message-id: 1486504171-26807-4-git-send-email-wei@redhat.com
>> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
>> ---
>>  target/arm/cpu.h    |  2 +-
>>  target/arm/helper.c | 10 +++++++++-
>>  2 files changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
>> index edc1f76..0956a54 100644
>> --- a/target/arm/cpu.h
>> +++ b/target/arm/cpu.h
>> @@ -309,7 +309,7 @@ typedef struct CPUARMState {
>>          uint32_t c9_pmovsr; /* perf monitor overflow status */
>>          uint32_t c9_pmuserenr; /* perf monitor user enable */
>>          uint64_t c9_pmselr; /* perf monitor counter selection register */
>> -        uint32_t c9_pminten; /* perf monitor interrupt enables */
>> +        uint64_t c9_pminten; /* perf monitor interrupt enables */
>
> PMINTENSET_EL1 and PMINTENCLR_EL1 are both 32-bit registers, just like
> their AArch32 counterparts. Is there a reason I'm missing for why this
> has been changed to a uint64_t? There are a number of other 32-bit PMU
> registers also currently being represented by uint64_t.

Two reasons:

 (1) The conceptual reason. In AArch64 "32-bit system register" is just
a convenient shorthand for "64-bit system register where the upper 32
bits are RAZ/WI". The register itself is still 64 bits and in a future
architecture revision it might end up with defined bits in the upper
half (this has happened already for a few registers).

 (2) The QEMU implementation reason. The way we implement system register
access instructions typically ends up in generating a simple "load/store
64 bit value from address" instruction. Rather than having the generic
"handle a system register access" code  have two codepaths to cope with
"64-bit sysreg that's stored in a 32-bit field" and "64-bit sysreg that's
stored in a 64-bit field", we choose to require that the fields are always
64-bits wide, so that the code that accesses them doesn't have to care.

(The implementation reason derives from the conceptual reason:
architecturally there is no real different "32-bit system register"
concept, so we don't need to implement handling differently. For
AArch32 we do distinguish between 32-bit and 64-bit coprocessor
registers, because they're really different things and need
different handling.)

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On Fri, 13 Sep 2019 at 16:49, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> target-arm queue: mostly aspeed changes from Cédric.
>
> thanks
> -- PMM
>
> The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:
>
>   Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913
>
> for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:
>
>   qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * aspeed: add a GPIO controller to the SoC
>  * aspeed: Various refactorings
>  * aspeed: Improve DMA controller modelling
>  * atomic_template: fix indentation in GEN_ATOMIC_HELPER
>  * qemu-ga: Convert invocation documentation to rST
>
> ----------------------------------------------------------------


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.2
for any user-visible changes.

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

target-arm queue: mostly aspeed changes from Cédric.

thanks
-- PMM

The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:

  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913

for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:

  qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * aspeed: add a GPIO controller to the SoC
 * aspeed: Various refactorings
 * aspeed: Improve DMA controller modelling
 * atomic_template: fix indentation in GEN_ATOMIC_HELPER
 * qemu-ga: Convert invocation documentation to rST

----------------------------------------------------------------
Christian Svensson (1):
      aspeed/smc: Calculate checksum on normal DMA

Cédric Le Goater (7):
      aspeed: Remove unused SoC definitions
      aspeed: Use consistent typenames
      aspeed/smc: Add support for DMAs
      aspeed/smc: Add DMA calibration settings
      aspeed/smc: Inject errors in DMA checksum
      aspeed/scu: Introduce per-SoC SCU types
      aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine

Emilio G. Cota (1):
      atomic_template: fix indentation in GEN_ATOMIC_HELPER

Peter Maydell (1):
      qemu-ga: Convert invocation documentation to rST

Rashmica Gupta (2):
      hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
      aspeed: add a GPIO controller to the SoC

 Makefile                      |  24 +-
 hw/gpio/Makefile.objs         |   1 +
 accel/tcg/atomic_template.h   |   2 +-
 include/hw/arm/aspeed_soc.h   |   4 +-
 include/hw/gpio/aspeed_gpio.h | 100 +++++
 include/hw/misc/aspeed_scu.h  |  21 +-
 include/hw/ssi/aspeed_smc.h   |   7 +
 hw/arm/aspeed.c               |   2 +
 hw/arm/aspeed_soc.c           |  63 ++-
 hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++++++++++
 hw/misc/aspeed_scu.c          | 102 ++---
 hw/ssi/aspeed_smc.c           | 335 +++++++++++++++-
 hw/timer/aspeed_timer.c       |   3 +-
 MAINTAINERS                   |   2 +-
 docs/conf.py                  |  18 +-
 docs/interop/conf.py          |   7 +
 docs/interop/index.rst        |   1 +
 docs/interop/qemu-ga.rst      | 133 +++++++
 qemu-doc.texi                 |   5 -
 qemu-ga.texi                  | 137 -------
 20 files changed, 1585 insertions(+), 266 deletions(-)
 create mode 100644 include/hw/gpio/aspeed_gpio.h
 create mode 100644 hw/gpio/aspeed_gpio.c
 create mode 100644 docs/interop/qemu-ga.rst
 delete mode 100644 qemu-ga.texi

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On Thu, 23 May 2019 at 15:23, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> Not very much here, but several people have fallen over
> the vector operation segfault bug, so let's get the fix
> into master.
>
> thanks
> -- PMM
>
> The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
>
>   Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
>
> for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
>
>   hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * exynos4210: QOM'ify the Exynos4210 SoC
>  * exynos4210: Add DMA support for the Exynos4210
>  * arm_gicv3: Fix writes to ICC_CTLR_EL3
>  * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
>  * target/arm: Fix vector operation segfault
>  * target/arm: Minor improvements to BFXIL, EXTR
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.1
for any user-visible changes.

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

 include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 10 April 2018 at 13:17, Peter Maydell <peter.maydell@linaro.org> wrote:
> Arm patch queue for 2.12 -- a miscellaneous collection
> of bug fixes.
>
> thanks
> -- PMM
>
>
> The following changes since commit fb4fe32d5b6290deabe752b51cc1cc2a9e8573db:
>
>   Merge remote-tracking branch 'remotes/xtensa/tags/20180409-xtensa' into staging (2018-04-10 10:22:45 +0100)
>
> are available in the Git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180410
>
> for you to fetch changes up to bd49e6027cbc207c87633c7add3ebd7d3474cd35:
>
>   fpu: Fix rounding mode for floatN_to_uintM_round_to_zero (2018-04-10 13:02:26 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
>  * tcg: Fix guest state corruption when running 64-bit Arm
>    guests on a 32-bit host (especially when using icount)
>  * linux-user/signal.c: Ensure AArch64 signal frame isn't too small
>  * cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
>  * target/arm: Report unsupported MPU region sizes more clearly
>  * hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
>  * hw/arm/allwinner-a10: Do not use nd_table in instance_init function
>  * hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
>  * hw/sd/bcm2835_sdhost: Add tracepoints
>  * target-arm: Check undefined opcodes for SWP in A32 decoder
>  * hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
>  * hw/arm: Allow manually specified /psci node
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

Arm patch queue for 2.12 -- a miscellaneous collection
of bug fixes.

thanks
-- PMM


The following changes since commit fb4fe32d5b6290deabe752b51cc1cc2a9e8573db:

  Merge remote-tracking branch 'remotes/xtensa/tags/20180409-xtensa' into staging (2018-04-10 10:22:45 +0100)

are available in the Git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180410

for you to fetch changes up to bd49e6027cbc207c87633c7add3ebd7d3474cd35:

  fpu: Fix rounding mode for floatN_to_uintM_round_to_zero (2018-04-10 13:02:26 +0100)

----------------------------------------------------------------
target-arm queue:
 * fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
 * tcg: Fix guest state corruption when running 64-bit Arm
   guests on a 32-bit host (especially when using icount)
 * linux-user/signal.c: Ensure AArch64 signal frame isn't too small
 * cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
 * target/arm: Report unsupported MPU region sizes more clearly
 * hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
 * hw/arm/allwinner-a10: Do not use nd_table in instance_init function
 * hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
 * hw/sd/bcm2835_sdhost: Add tracepoints
 * target-arm: Check undefined opcodes for SWP in A32 decoder
 * hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
 * hw/arm: Allow manually specified /psci node

----------------------------------------------------------------
Andrey Smirnov (1):
      hw/arm: Allow manually specified /psci node

Onur Sahin (1):
      target-arm: Check undefined opcodes for SWP in A32 decoder

Peter Maydell (5):
      hw/sd/bcm2835_sdhost: Add tracepoints
      hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
      target/arm: Report unsupported MPU region sizes more clearly
      cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
      linux-user/signal.c: Ensure AArch64 signal frame isn't too small

Richard Henderson (2):
      tcg: Introduce tcg_set_insn_start_param
      fpu: Fix rounding mode for floatN_to_uintM_round_to_zero

Thomas Huth (3):
      hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
      hw/arm/allwinner-a10: Do not use nd_table in instance_init function
      hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7

 target/arm/translate.h |  2 +-
 tcg/tcg.h              | 10 ++++++++++
 cpus.c                 | 10 +++++++++-
 fpu/softfloat.c        |  4 ++--
 hw/arm/allwinner-a10.c | 12 +++++------
 hw/arm/boot.c          | 10 ++++++++++
 hw/arm/fsl-imx6.c      | 14 ++++++-------
 hw/arm/fsl-imx7.c      | 13 ++++++------
 hw/arm/integratorcp.c  | 23 +++++++++++++--------
 hw/sd/bcm2835_sdhost.c | 54 ++++++++++++++++++++++++++++++++------------------
 linux-user/signal.c    |  6 ++++++
 target/arm/helper.c    |  6 +++---
 target/arm/translate.c |  9 +++++++--
 hw/sd/trace-events     |  6 ++++++
 14 files changed, 124 insertions(+), 55 deletions(-)

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 19 June 2015 at 14:47, Peter Maydell <peter.maydell@linaro.org> wrote:
> target-arm queue, mostly a collection of the last few stray features
> that have been on the list in plenty of time for softfreeze but didn't
> quite make the previous pullreq.
>
> I expect the "support GICv2m with virt board ACPI tables" patch also
> to go in for 2.4, but it needs a little more review time. Other than that
> I think we should be down to bugfix patches.
>
> -- PMM
>
> The following changes since commit ffdb1409a79c9cc91afd9f58df625fdca16bf8b9:
>
>   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150619-1' into staging (2015-06-19 12:54:08 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150619
>
> for you to fetch changes up to a59d31a1ebdce796a469242800db89bf09c94580:
>
>   semihosting: add --semihosting-config arg sub-argument (2015-06-19 14:17:45 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * support --semihosting-config,arg=value
>  * Cortex-R5 support (including implementing them on the Zynq board)
>  * Cortex-M4 support (without FPU)
>  * enable vfio-calxeda-xgmac
>  * don't reset ALIAS sysregs

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

target-arm queue, mostly a collection of the last few stray features
that have been on the list in plenty of time for softfreeze but didn't
quite make the previous pullreq.

I expect the "support GICv2m with virt board ACPI tables" patch also
to go in for 2.4, but it needs a little more review time. Other than that
I think we should be down to bugfix patches.

-- PMM

The following changes since commit ffdb1409a79c9cc91afd9f58df625fdca16bf8b9:

  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20150619-1' into staging (2015-06-19 12:54:08 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150619

for you to fetch changes up to a59d31a1ebdce796a469242800db89bf09c94580:

  semihosting: add --semihosting-config arg sub-argument (2015-06-19 14:17:45 +0100)

----------------------------------------------------------------
target-arm queue:
 * support --semihosting-config,arg=value
 * Cortex-R5 support (including implementing them on the Zynq board)
 * Cortex-M4 support (without FPU)
 * enable vfio-calxeda-xgmac
 * don't reset ALIAS sysregs

----------------------------------------------------------------
Aurelio C. Remonda (1):
      target-arm: Add the Cortex-M4 CPU

Eric Auger (1):
      hw/arm/sysbus-fdt: enable vfio-calxeda-xgmac dynamic instantiation

Leon Alrae (2):
      semihosting: create SemihostingConfig structure and semihost.h
      semihosting: add --semihosting-config arg sub-argument

Peter Crosthwaite (7):
      target-arm/helper.c: define MPUIR register
      target-arm: Add registers for PMSAv7
      target-arm: Implement PMSAv7 MPU
      target-arm: Add support for Cortex-R5
      arm: xlnx-zynqmp: Preface CPU variables with "apu"
      arm: xlnx-zynqmp: Add boot-cpu property
      arm: xlnx-zynqmp: Add 2xCortexR5 CPUs

Sergey Fedorov (1):
      target-arm: Do not reset sysregs marked as ALIAS

 gdbstub.c                    |   8 +-
 hw/arm/sysbus-fdt.c          |  73 ++++++++++
 hw/arm/virt.c                |  12 +-
 hw/arm/xlnx-ep108.c          |   2 +-
 hw/arm/xlnx-zynqmp.c         |  79 +++++++++--
 include/exec/gdbstub.h       |   6 -
 include/exec/semihost.h      |  62 +++++++++
 include/hw/arm/fdt.h         |  34 +++++
 include/hw/arm/xlnx-zynqmp.h |   9 +-
 include/sysemu/sysemu.h      |   1 -
 qemu-options.hx              |  21 ++-
 target-arm/arm-semi.c        |  10 +-
 target-arm/cpu-qom.h         |   2 +
 target-arm/cpu.c             |  75 ++++++++++-
 target-arm/cpu.h             |  15 ++-
 target-arm/helper.c          | 309 ++++++++++++++++++++++++++++++++++++++-----
 target-arm/machine.c         |  34 +++++
 target-lm32/helper.c         |   3 +-
 target-m68k/op_helper.c      |   5 +-
 target-xtensa/translate.c    |   3 +-
 vl.c                         | 104 +++++++++++++--
 21 files changed, 770 insertions(+), 97 deletions(-)
 create mode 100644 include/exec/semihost.h
 create mode 100644 include/hw/arm/fdt.h

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 13 February 2015 at 05:54, Peter Maydell <peter.maydell@linaro.org> wrote:
> The following changes since commit 449008f86418583a1f0fb946cf91ee7b4797317d:
>
>   Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging (2015-02-11 05:14:41 +0000)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150213
>
> for you to fetch changes up to c2ebd862a54b7e12175d65c03ba259926cb2237a:
>
>   target-arm: A64: Avoid signed shifts in disas_ldst_pair() (2015-02-13 05:46:09 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * PCIe support in virt board
>  * Support 32-bit guests on 64-bit KVM hosts in virt board
>  * Fixes to avoid C undefined behaviour
>

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 13 February 2015 at 05:54, Peter Maydell <peter.maydell@linaro.org> wrote:
> The following changes since commit 449008f86418583a1f0fb946cf91ee7b4797317d:
>
>   Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging (2015-02-11 05:14:41 +0000)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150213
>
> for you to fetch changes up to c2ebd862a54b7e12175d65c03ba259926cb2237a:
>
>   target-arm: A64: Avoid signed shifts in disas_ldst_pair() (2015-02-13 05:46:09 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * PCIe support in virt board
>  * Support 32-bit guests on 64-bit KVM hosts in virt board
>  * Fixes to avoid C undefined behaviour
>
> ----------------------------------------------------------------

NB: if following this merge you find 'make check' fails, this is
likely because your build tree is old and is missing the correct
dependency files (the .d files which would tell it to rebuild the
config-devices.mak files don't exist, and the .d files only get
built when the config-devices.mak files are rebuilt.) This can
be fixed by:
 rm <builddir>/*/config-devices.mak*

(or by blowing away the whole builddir, of course).

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

The following changes since commit 449008f86418583a1f0fb946cf91ee7b4797317d:

  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20150210.0' into staging (2015-02-11 05:14:41 +0000)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150213

for you to fetch changes up to c2ebd862a54b7e12175d65c03ba259926cb2237a:

  target-arm: A64: Avoid signed shifts in disas_ldst_pair() (2015-02-13 05:46:09 +0000)

----------------------------------------------------------------
target-arm queue:
 * PCIe support in virt board
 * Support 32-bit guests on 64-bit KVM hosts in virt board
 * Fixes to avoid C undefined behaviour

----------------------------------------------------------------
Alexander Graf (4):
      pci: Allocate PCIe host bridge PCI ID
      pci: Add generic PCIe host bridge
      arm: Add PCIe host bridge in virt machine
      pci: Move PCI VGA to pci.mak

Greg Bellows (4):
      target-arm: Add CPU property to disable AArch64
      target-arm: Add feature parsing to virt
      target-arm: Add 32/64-bit register sync
      target-arm: Add AArch32 guest support to KVM64

Peter Maydell (4):
      target-arm: A64: Fix shifts into sign bit
      target-arm: A64: Fix handling of rotate in logic_imm_decode_wmask
      target-arm: A64: Avoid left shifting negative integers in disas_pc_rel_addr
      target-arm: A64: Avoid signed shifts in disas_ldst_pair()

 default-configs/alpha-softmmu.mak    |   2 -
 default-configs/arm-softmmu.mak      |   2 +
 default-configs/i386-softmmu.mak     |   2 -
 default-configs/mips-softmmu.mak     |   2 -
 default-configs/mips64-softmmu.mak   |   2 -
 default-configs/mips64el-softmmu.mak |   2 -
 default-configs/mipsel-softmmu.mak   |   2 -
 default-configs/pci.mak              |   2 +
 default-configs/ppc-softmmu.mak      |   2 -
 default-configs/ppc64-softmmu.mak    |   2 -
 default-configs/ppcemb-softmmu.mak   |   2 -
 default-configs/sparc64-softmmu.mak  |   2 -
 default-configs/x86_64-softmmu.mak   |   2 -
 hw/arm/virt.c                        | 158 ++++++++++++++++++++++++--
 hw/pci-host/Makefile.objs            |   1 +
 hw/pci-host/gpex.c                   | 154 +++++++++++++++++++++++++
 include/hw/pci-host/gpex.h           |  56 ++++++++++
 include/hw/pci/pci.h                 |   1 +
 include/sysemu/device_tree.h         |   9 ++
 target-arm/cpu.c                     |   5 +-
 target-arm/cpu.h                     |   2 +
 target-arm/cpu64.c                   |  39 +++++++
 target-arm/helper-a64.c              |   5 +-
 target-arm/helper.c                  | 211 +++++++++++++++++++++++++++++++++++
 target-arm/kvm64.c                   |  36 +++++-
 target-arm/op_helper.c               |   6 +-
 target-arm/translate-a64.c           |  18 +--
 27 files changed, 678 insertions(+), 49 deletions(-)
 create mode 100644 hw/pci-host/gpex.c
 create mode 100644 include/hw/pci-host/gpex.h

Re: [Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

On 4 August 2014 14:53, Peter Maydell <peter.maydell@linaro.org> wrote:
> First pullreq for 2.2; not very many patches but I didn't want
> to hang onto them any more, especially since there are several
> bits of work in-flight that will need to rebase after these.
>
>
> The following changes since commit 924c09db51b147881d51d8102deb4f285305c1b7:
>
>   Merge remote-tracking branch 'remotes/amit-virtio-rng/for-2.2' into staging (2014-08-04 13:07:02 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140804
>
> for you to fetch changes up to dbb1fb277ca12acd577403575aa6a2f119ab79ea:
>
>   target-arm: A64: fix TLB flush instructions (2014-08-04 14:41:56 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * Set PC correctly when loading AArch64 ELF files
>  * sdhci: Fix ADMA dma_memory_read access
>  * some more foundational work for EL2/EL3 support
>  * fix bugs which reveal themselves if the TARGET_PAGE_SIZE
>    is not set to 1K

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/12] target-arm queue

[Peter Maydell]

First pullreq for 2.2; not very many patches but I didn't want
to hang onto them any more, especially since there are several
bits of work in-flight that will need to rebase after these.


The following changes since commit 924c09db51b147881d51d8102deb4f285305c1b7:

  Merge remote-tracking branch 'remotes/amit-virtio-rng/for-2.2' into staging (2014-08-04 13:07:02 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140804

for you to fetch changes up to dbb1fb277ca12acd577403575aa6a2f119ab79ea:

  target-arm: A64: fix TLB flush instructions (2014-08-04 14:41:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * Set PC correctly when loading AArch64 ELF files
 * sdhci: Fix ADMA dma_memory_read access
 * some more foundational work for EL2/EL3 support
 * fix bugs which reveal themselves if the TARGET_PAGE_SIZE
   is not set to 1K

----------------------------------------------------------------
Alex Bennée (2):
      target-arm: don't hardcode mask values in arm_cpu_handle_mmu_fault
      target-arm: A64: fix TLB flush instructions

Andrew Jones (1):
      hw/arm/virt: formatting: memory map

Edgar E. Iglesias (6):
      target-arm: A64: Break out aarch64_save/restore_sp
      target-arm: A64: Respect SPSEL in ERET SP restore
      target-arm: A64: Respect SPSEL when taking exceptions
      target-arm: Make far_el1 an array
      target-arm: Add ESR_EL2 and 3
      target-arm: Add FAR_EL2 and 3

Peter Crosthwaite (1):
      sd: sdhci: Fix ADMA dma_memory_read access

Peter Maydell (1):
      hw/arm/boot: Set PC correctly when loading AArch64 ELF files

Stefan Weil (1):
      target-arm: Fix bit test in sp_el0_access

 hw/arm/boot.c           |  8 ++++++--
 hw/arm/virt.c           | 16 ++++++++--------
 hw/sd/sdhci.c           |  3 ++-
 target-arm/cpu.c        |  2 +-
 target-arm/cpu.h        |  4 ++--
 target-arm/helper-a64.c |  8 ++++----
 target-arm/helper.c     | 42 +++++++++++++++++++++++++++++++-----------
 target-arm/internals.h  | 29 ++++++++++++++++++++---------
 target-arm/kvm64.c      | 13 +++----------
 target-arm/op_helper.c  |  8 ++------
 10 files changed, 79 insertions(+), 54 deletions(-)