[Qemu-devel] [PULL 00/10] target-arm queue

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Some Arm bugfixes for rc2...

thanks
-- PMM

The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:

  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119

for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:

  MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)

----------------------------------------------------------------
target-arm queue:
 * various MAINTAINERS file updates
 * hw/block/onenand: use qemu_log_mask() for reporting
 * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
   on the n800 and n810 machine models
 * target/arm: fix smc incorrectly trapping to EL3 when secure is off
 * hw/arm/stm32f205: Fix the UART and Timer region size
 * target/arm: read ID registers for KVM guests so they can be
   used to gate "is feature X present" checks

----------------------------------------------------------------
Luc Michel (1):
      target/arm: fix smc incorrectly trapping to EL3 when secure is off

Peter Maydell (3):
      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
      hw/block/onenand: use qemu_log_mask() for reporting
      MAINTAINERS: list myself as maintainer for various Arm boards

Richard Henderson (4):
      target/arm: Install ARMISARegisters from kvm host
      target/arm: Fill in ARMISARegisters for kvm64
      target/arm: Introduce read_sys_reg32 for kvm32
      target/arm: Fill in ARMISARegisters for kvm32

Seth Kintigh (1):
      hw/arm/stm32f205: Fix the UART and Timer region size

Thomas Huth (1):
      MAINTAINERS: Add entries for missing ARM boards

 target/arm/kvm_arm.h       |   1 +
 hw/block/onenand.c         |  24 +++++-----
 hw/char/stm32f2xx_usart.c  |   2 +-
 hw/timer/stm32f2xx_timer.c |   2 +-
 target/arm/kvm.c           |   1 +
 target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
 target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
 target/arm/op_helper.c     |  54 +++++++++++++++++++----
 MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
 9 files changed, 293 insertions(+), 64 deletions(-)

[Qemu-devel] [PULL 01/10] target/arm: Install ARMISARegisters from kvm host

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

The ID registers are replacing (some of) the feature bits.
We need (some of) these values to determine the set of data
to be handled during migration.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 1 +
 target/arm/kvm.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 21c0129da24..6393455b1d0 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -183,6 +183,7 @@ void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
  * by asking the host kernel)
  */
 typedef struct ARMHostCPUFeatures {
+    ARMISARegisters isar;
     uint64_t features;
     uint32_t target;
     const char *dtb_compatible;
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 09a86e2820b..44dd0ce6ce9 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -158,6 +158,7 @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
 
     cpu->kvm_target = arm_host_cpu_features.target;
     cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
+    cpu->isar = arm_host_cpu_features.isar;
     env->features = arm_host_cpu_features.features;
 }
 
-- 
2.19.1

[Qemu-devel] [PULL 02/10] target/arm: Fill in ARMISARegisters for kvm64

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 90 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 88 insertions(+), 2 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index 46fbe6d8ff6..0a502091e76 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -456,17 +456,40 @@ static inline void unset_feature(uint64_t *features, int feature)
     *features &= ~(1ULL << feature);
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    uint64_t ret;
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
+    int err;
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
+    if (err < 0) {
+        return -1;
+    }
+    *pret = ret;
+    return 0;
+}
+
+static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
      * fill out the ARMHostCPUClass fields accordingly. To do this
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
-     * For AArch64 we currently don't care about ID registers at
-     * all; we just want to know the CPU type.
      */
     int fdarray[3];
     uint64_t features = 0;
+    int err;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type. Fortunately these old kernels
@@ -487,8 +510,71 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     ahcf->target = init.target;
     ahcf->dtb_compatible = "arm,arm-v8";
 
+    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
+                         ARM64_SYS_REG(3, 0, 0, 4, 0));
+    if (unlikely(err < 0)) {
+        /*
+         * Before v4.15, the kernel only exposed a limited number of system
+         * registers, not including any of the interesting AArch64 ID regs.
+         * For the most part we could leave these fields as zero with minimal
+         * effect, since this does not affect the values seen by the guest.
+         *
+         * However, it could cause problems down the line for QEMU,
+         * so provide a minimal v8.0 default.
+         *
+         * ??? Could read MIDR and use knowledge from cpu64.c.
+         * ??? Could map a page of memory into our temp guest and
+         *     run the tiniest of hand-crafted kernels to extract
+         *     the values seen by the guest.
+         * ??? Either of these sounds like too much effort just
+         *     to work around running a modern host kernel.
+         */
+        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
+        err = 0;
+    } else {
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
+                              ARM64_SYS_REG(3, 0, 0, 4, 1));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
+                              ARM64_SYS_REG(3, 0, 0, 6, 0));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
+                              ARM64_SYS_REG(3, 0, 0, 6, 1));
+
+        /*
+         * Note that if AArch32 support is not present in the host,
+         * the AArch32 sysregs are present to be read, but will
+         * return UNKNOWN values.  This is neither better nor worse
+         * than skipping the reads and leaving 0, as we must avoid
+         * considering the values in every case.
+         */
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                              ARM64_SYS_REG(3, 0, 0, 2, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                              ARM64_SYS_REG(3, 0, 0, 2, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                              ARM64_SYS_REG(3, 0, 0, 2, 2));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                              ARM64_SYS_REG(3, 0, 0, 2, 3));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                              ARM64_SYS_REG(3, 0, 0, 2, 4));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                              ARM64_SYS_REG(3, 0, 0, 2, 5));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                              ARM64_SYS_REG(3, 0, 0, 2, 7));
+
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                              ARM64_SYS_REG(3, 0, 0, 3, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
+                              ARM64_SYS_REG(3, 0, 0, 3, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
+                              ARM64_SYS_REG(3, 0, 0, 3, 2));
+    }
+
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
+    if (err < 0) {
+        return false;
+    }
+
    /* We can assume any KVM supporting CPU is at least a v8
      * with VFPv4+Neon; this in turn implies most of the other
      * feature bits.
-- 
2.19.1

[Qemu-devel] [PULL 03/10] target/arm: Introduce read_sys_reg32 for kvm32

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

Assert that the value to be written is the correct size.
No change in functionality here, just mirroring the same
function from kvm64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 41 ++++++++++++++++-------------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index cb3fb73a961..bc0badf53db 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -28,6 +28,14 @@ static inline void set_feature(uint64_t *features, int feature)
     *features |= 1ULL << feature;
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
@@ -35,9 +43,10 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
      */
-    int i, ret, fdarray[3];
+    int err = 0, fdarray[3];
     uint32_t midr, id_pfr0, mvfr1;
     uint64_t features = 0;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type.
@@ -47,23 +56,6 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         QEMU_KVM_ARM_TARGET_NONE
     };
     struct kvm_vcpu_init init;
-    struct kvm_one_reg idregs[] = {
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 0, 0, 0),
-            .addr = (uintptr_t)&midr,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 1, 0, 0),
-            .addr = (uintptr_t)&id_pfr0,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1,
-            .addr = (uintptr_t)&mvfr1,
-        },
-    };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
@@ -77,16 +69,15 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      */
     ahcf->dtb_compatible = "arm,arm-v7";
 
-    for (i = 0; i < ARRAY_SIZE(idregs); i++) {
-        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &idregs[i]);
-        if (ret) {
-            break;
-        }
-    }
+    err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
+    err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
+    err |= read_sys_reg32(fdarray[2], &mvfr1,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
-    if (ret) {
+    if (err < 0) {
         return false;
     }
 
-- 
2.19.1

[Qemu-devel] [PULL 04/10] target/arm: Fill in ARMISARegisters for kvm32

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index bc0badf53db..bd51eb43c86 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -44,7 +44,7 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * and then query that CPU for the relevant ID registers.
      */
     int err = 0, fdarray[3];
-    uint32_t midr, id_pfr0, mvfr1;
+    uint32_t midr, id_pfr0;
     uint64_t features = 0;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -71,9 +71,39 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 
     err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
     err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
-    err |= read_sys_reg32(fdarray[2], &mvfr1,
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                          ARM_CP15_REG32(0, 0, 2, 0));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                          ARM_CP15_REG32(0, 0, 2, 1));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                          ARM_CP15_REG32(0, 0, 2, 2));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                          ARM_CP15_REG32(0, 0, 2, 3));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                          ARM_CP15_REG32(0, 0, 2, 4));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                          ARM_CP15_REG32(0, 0, 2, 5));
+    if (read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                       ARM_CP15_REG32(0, 0, 2, 7))) {
+        /*
+         * Older kernels don't support reading ID_ISAR6. This register was
+         * only introduced in ARMv8, so we can assume that it is zero on a
+         * CPU that a kernel this old is running on.
+         */
+        ahcf->isar.id_isar6 = 0;
+    }
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR0);
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
                           KVM_REG_ARM | KVM_REG_SIZE_U32 |
                           KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
+    /*
+     * FIXME: There is not yet a way to read MVFR2.
+     * Fortunately there is not yet anything in there that affects migration.
+     */
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
@@ -95,13 +125,13 @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(id_pfr0, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_THUMB2EE);
     }
-    if (extract32(mvfr1, 20, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
         set_feature(&features, ARM_FEATURE_VFP_FP16);
     }
-    if (extract32(mvfr1, 12, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
-    if (extract32(mvfr1, 28, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
         /* FMAC support implies VFPv4 */
         set_feature(&features, ARM_FEATURE_VFP4);
     }
-- 
2.19.1

[Qemu-devel] [PULL 05/10] MAINTAINERS: Add entries for missing ARM boards

[Peter Maydell]

From: Thomas Huth <thuth@redhat.com>

Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
"raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
While we're at it, also adjust the "i.MX31" section a little bit,
so that the wildcards there do not match anymore for unrelated files
(e.g. the new hw/misc/imx6ul_ccm.c file).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 65 insertions(+), 5 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index ba52b8c77b0..bb71f5e6500 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -528,14 +528,15 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/gumstix.c
 
-i.MX31
+i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
 L: qemu-arm@nongnu.org
-S: Odd fixes
-F: hw/*/imx*
-F: include/hw/*/imx*
+S: Odd Fixes
 F: hw/arm/kzm.c
-F: include/hw/arm/fsl-imx31.h
+F: hw/*/imx_*
+F: hw/*/*imx31*
+F: include/hw/*/imx_*
+F: include/hw/*/*imx31*
 
 Integrator CP
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -544,6 +545,28 @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 
+MCIMX6UL EVK / i.MX6ul
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx6ul-evk.c
+F: hw/arm/fsl-imx6ul.c
+F: hw/misc/imx6ul_ccm.c
+F: include/hw/arm/fsl-imx6ul.h
+F: include/hw/misc/imx6ul_ccm.h
+
+MCIMX7D SABRE / i.MX7
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrey Smirnov <andrew.smirnov@gmail.com>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx7d-sabre.c
+F: hw/arm/fsl-imx7.c
+F: include/hw/arm/fsl-imx7.h
+F: hw/pci-host/designware.c
+F: include/hw/pci-host/designware.h
+
 MPS2
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -577,6 +600,17 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/palm.c
 
+Raspberry Pi
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrew Baumann <Andrew.Baumann@microsoft.com>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/raspi_platform.h
+F: hw/*/bcm283*
+F: include/hw/arm/raspi*
+F: include/hw/*/bcm283*
+
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -598,6 +632,19 @@ F: hw/*/pxa2xx*
 F: hw/misc/mst_fpga.c
 F: include/hw/arm/pxa.h
 
+SABRELITE / i.MX6
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/sabrelite.c
+F: hw/arm/fsl-imx6.c
+F: hw/misc/imx6_src.c
+F: hw/ssi/imx_spi.c
+F: include/hw/arm/fsl-imx6.h
+F: include/hw/misc/imx6_src.h
+F: include/hw/ssi/imx_spi.h
+
 Sharp SL-5500 (Collie) PDA
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -611,6 +658,12 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/stellaris*
 
+Versatile Express
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/vexpress.c
+
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -618,6 +671,13 @@ S: Maintained
 F: hw/*/versatile*
 F: hw/misc/arm_sysctl.c
 
+Virt
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/virt*
+F: include/hw/arm/virt.h
+
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
-- 
2.19.1

[Qemu-devel] [PULL 06/10] hw/arm/stm32f205: Fix the UART and Timer region size

[Peter Maydell]

From: Seth Kintigh <skintigh@gmail.com>

The UART and timer devices for the stm32f205 were being created
with memory regions that were too large. Use the size specified
in the chip datasheet.

The old sizes were so large that the devices would overlap with
each other in the SoC memory map, so this fixes a bug that
caused odd behavior and/or crashes when trying to set up multiple
UARTs.

Signed-off-by: Seth Kintigh <skintigh@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: rephrased commit message to follow our usual standard]
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/stm32f2xx_usart.c  | 2 +-
 hw/timer/stm32f2xx_timer.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index 032b5fda135..f3363a2952d 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -202,7 +202,7 @@ static void stm32f2xx_usart_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_usart_ops, s,
-                          TYPE_STM32F2XX_USART, 0x2000);
+                          TYPE_STM32F2XX_USART, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
index 58fc7b1188e..ae744d16425 100644
--- a/hw/timer/stm32f2xx_timer.c
+++ b/hw/timer/stm32f2xx_timer.c
@@ -308,7 +308,7 @@ static void stm32f2xx_timer_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->iomem, obj, &stm32f2xx_timer_ops, s,
-                          "stm32f2xx_timer", 0x4000);
+                          "stm32f2xx_timer", 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
 
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
-- 
2.19.1

[Qemu-devel] [PULL 07/10] target/arm: fix smc incorrectly trapping to EL3 when secure is off

[Peter Maydell]

From: Luc Michel <luc.michel@greensocs.com>

This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
    .text
_start:
    ldr x0, =0xdeadbeef  ; invalid PSCI call
    smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                      -o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                    -cpu cortex-a57 -kernel test

Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/op_helper.c | 54 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index eb6fb82fb81..0d6e89e474a 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -939,7 +939,38 @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
     ARMCPU *cpu = arm_env_get_cpu(env);
     int cur_el = arm_current_el(env);
     bool secure = arm_is_secure(env);
-    bool smd = env->cp15.scr_el3 & SCR_SMD;
+    bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
+
+    /*
+     * SMC behaviour is summarized in the following table.
+     * This helper handles the "Trap to EL2" and "Undef insn" cases.
+     * The "Trap to EL3" and "PSCI call" cases are handled in the exception
+     * helper.
+     *
+     *  -> ARM_FEATURE_EL3 and !SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Trap to EL3
+     *  Conduit not SMC          Trap to EL2         Trap to EL3
+     *
+     *
+     *  -> ARM_FEATURE_EL3 and SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Trap to EL2         Undef insn
+     *
+     *
+     *  -> !ARM_FEATURE_EL3
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Undef insn          Undef insn
+     */
+
     /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
      * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
      *  extensions, SMD only applies to NS state.
@@ -947,7 +978,8 @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
      * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
      * so we need not special case this here.
      */
-    bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
+    bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
+                                                     : smd_flag && !secure;
 
     if (!arm_feature(env, ARM_FEATURE_EL3) &&
         cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
@@ -957,21 +989,27 @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
          * to forbid its EL1 from making PSCI calls into QEMU's
          * "firmware" via HCR.TSC, so for these purposes treat
          * PSCI-via-SMC as implying an EL3.
+         * This handles the very last line of the previous table.
          */
-        undef = true;
-    } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
+        raise_exception(env, EXCP_UDEF, syn_uncategorized(),
+                        exception_target_el(env));
+    }
+
+    if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
          * We also want an EL2 guest to be able to forbid its EL1 from
          * making PSCI calls into QEMU's "firmware" via HCR.TSC.
+         * This handles all the "Trap to EL2" cases of the previous table.
          */
         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
     }
 
-    /* If PSCI is enabled and this looks like a valid PSCI call then
-     * suppress the UNDEF -- we'll catch the SMC exception and
-     * implement the PSCI call behaviour there.
+    /* Catch the two remaining "Undef insn" cases of the previous table:
+     *    - PSCI conduit is SMC but we don't have a valid PCSI call,
+     *    - We don't have EL3 or SMD is set.
      */
-    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
+    if (!arm_is_psci_call(cpu, EXCP_SMC) &&
+        (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                         exception_target_el(env));
     }
-- 
2.19.1

[Qemu-devel] [PULL 08/10] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read

[Peter Maydell]

An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.

NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.

Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/onenand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 0cb8d7fa135..49ef68c9b14 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -608,7 +608,7 @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     int offset = addr >> s->shift;
 
     switch (offset) {
-    case 0x0000 ... 0xc000:
+    case 0x0000 ... 0xbffe:
         return lduw_le_p(s->boot[0] + addr);
 
     case 0xf000:	/* Manufacturer ID */
-- 
2.19.1

[Qemu-devel] [PULL 09/10] hw/block/onenand: use qemu_log_mask() for reporting

[Peter Maydell]

Update the onenand device to use qemu_log_mask() for reporting
guest errors and unimplemented features, rather than plain
fprintf() and hw_error().

(We leave the hw_error() in onenand_reset(), as that is
triggered by a failure to read the underlying block device
for the bootRAM, not by guest action.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
---
 hw/block/onenand.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index 49ef68c9b14..2b48609776d 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -28,6 +28,7 @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
 
 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
 #define PAGE_SHIFT	11
@@ -594,8 +595,8 @@ static void onenand_command(OneNANDState *s)
     default:
         s->status |= ONEN_ERR_CMD;
         s->intstatus |= ONEN_INT;
-        fprintf(stderr, "%s: unknown OneNAND command %x\n",
-                        __func__, s->command);
+        qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
+                      s->command);
     }
 
     onenand_intr_update(s);
@@ -657,12 +658,13 @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     case 0xff02:	/* ECC Result of spare area data */
     case 0xff03:	/* ECC Result of main area data */
     case 0xff04:	/* ECC Result of spare area data */
-        hw_error("%s: implement ECC\n", __func__);
+        qemu_log_mask(LOG_UNIMP,
+                      "onenand: ECC result registers unimplemented\n");
         return 0x0000;
     }
 
-    fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                    __func__, offset);
+    qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
+                  offset);
     return 0;
 }
 
@@ -706,8 +708,9 @@ static void onenand_write(void *opaque, hwaddr addr,
             break;
 
         default:
-            fprintf(stderr, "%s: unknown OneNAND boot command %"PRIx64"\n",
-                            __func__, value);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "unknown OneNAND boot command %" PRIx64 "\n",
+                          value);
         }
         break;
 
@@ -757,8 +760,9 @@ static void onenand_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                        __func__, offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "write to unknown OneNAND register 0x%x\n",
+                      offset);
     }
 }
 
-- 
2.19.1

[Qemu-devel] [PULL 10/10] MAINTAINERS: list myself as maintainer for various Arm boards

[Peter Maydell]

In practice for most of the more-or-less orphan Arm board models,
I will review patches and put them in via the target-arm tree.
So list myself as an "Odd Fixes" status maintainer for them.

This commit downgrades these boards to "Odd Fixes":
 * Allwinner-A10
 * Exynos
 * Calxeda Highbank
 * Canon DIGIC
 * Musicpal
 * nSeries
 * Palm
 * PXA2xx

These boards were already "Odd Fixes":
 * Gumstix
 * i.MX31 (kzm)

Philippe Mathieu-Daudé has requested to be moved to R:
status for Gumstix now that I am listed as the M: contact.

Some boards are maintained, but their patches still go
via the target-arm tree, so add myself as a secondary
maintainer contact for those:
 * Xilinx Zynq
 * Xilinx ZynqMP
 * STM32F205
 * Netduino 2
 * SmartFusion2
 * Mecraft M2S-FG484
 * ASPEED BMCs
 * NRF51

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
---
 MAINTAINERS | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index bb71f5e6500..1032406c560 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -442,8 +442,9 @@ ARM Machines
 ------------
 Allwinner-a10
 M: Beniamino Galvani <b.galvani@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
@@ -502,27 +503,31 @@ F: tests/test-arm-mptimer.c
 
 Exynos
 M: Igor Mitsyanko <i.mitsyanko@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/exynos*
 F: include/hw/arm/exynos4210.h
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/highbank.c
 F: hw/net/xgmac.c
 
 Canon DIGIC
 M: Antony Pavlov <antonynpavlov@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
 
 Gumstix
-M: Philippe Mathieu-Daudé <f4bug@amsat.org>
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 L: qemu-arm@nongnu.org
 S: Odd Fixes
@@ -530,6 +535,7 @@ F: hw/arm/gumstix.c
 
 i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/kzm.c
@@ -584,20 +590,23 @@ F: include/hw/misc/iotkit-sysinfo.h
 
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/musicpal.c
 
 nSeries
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/nseries.c
 
 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/palm.c
 
 Raspberry Pi
@@ -622,8 +631,9 @@ F: include/hw/intc/realview_gic.h
 
 PXA2XX
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/mainstone.c
 F: hw/arm/spitz.c
 F: hw/arm/tosa.c
@@ -681,6 +691,7 @@ F: include/hw/arm/virt.h
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xilinx_*
@@ -692,6 +703,7 @@ X: hw/ssi/xilinx_*
 Xilinx ZynqMP
 M: Alistair Francis <alistair@alistair23.me>
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
@@ -705,6 +717,7 @@ F: hw/arm/virt-acpi-build.c
 
 STM32F205
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/stm32f205_soc.c
 F: hw/misc/stm32f2xx_syscfg.c
@@ -716,11 +729,13 @@ F: include/hw/*/stm32*.h
 
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/netduino2.c
 
 SmartFusion2
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-soc.c
 F: hw/misc/msf2-sysreg.c
@@ -733,11 +748,13 @@ F: include/hw/ssi/mss-spi.h
 
 Emcraft M2S-FG484
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-som.c
 
 ASPEED BMCs
 M: Cédric Le Goater <clg@kaod.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 R: Andrew Jeffery <andrew@aj.id.au>
 R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
@@ -749,6 +766,7 @@ F: include/hw/net/ftgmac100.h
 
 NRF51
 M: Joel Stanley <joel@jms.id.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/nrf51_soc.c
-- 
2.19.1

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 19 November 2018 at 15:57, Peter Maydell <peter.maydell@linaro.org> wrote:
> Some Arm bugfixes for rc2...
>
> thanks
> -- PMM
>
> The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:
>
>   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119
>
> for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:
>
>   MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * various MAINTAINERS file updates
>  * hw/block/onenand: use qemu_log_mask() for reporting
>  * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
>    on the n800 and n810 machine models
>  * target/arm: fix smc incorrectly trapping to EL3 when secure is off
>  * hw/arm/stm32f205: Fix the UART and Timer region size
>  * target/arm: read ID registers for KVM guests so they can be
>    used to gate "is feature X present" checks
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Patchew URL: https://patchew.org/QEMU/20190715134211.23063-1-peter.maydell@linaro.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Subject: [Qemu-devel] [PULL 00/10] target-arm queue
Message-id: 20190715134211.23063-1-peter.maydell@linaro.org

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
 * [new tag]         patchew/20190715134211.23063-1-peter.maydell@linaro.org -> patchew/20190715134211.23063-1-peter.maydell@linaro.org
Switched to a new branch 'test'
374fdb9 target/arm: NS BusFault on vector table fetch escalates to NS HardFault
a30b1da target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
6d70517 pl031: Correctly migrate state when using -rtc clock=host
93d5845 hw/arm/virt: Fix non-secure flash mode
08594d9 hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
d4bfee6 hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
521dcfc hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
28dc994 hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
33d10d3 hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
4ad540c target/arm: report ARMv8-A FP support for AArch32 -cpu max

=== OUTPUT BEGIN ===
1/10 Checking commit 4ad540cb003f (target/arm: report ARMv8-A FP support for AArch32 -cpu max)
2/10 Checking commit 33d10d39bd1e (hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs)
3/10 Checking commit 28dc994a8771 (hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory)
4/10 Checking commit 521dcfc62131 (hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[])
5/10 Checking commit d4bfee6403a6 (hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO)
6/10 Checking commit 08594d9831b4 (hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO)
7/10 Checking commit 93d58455baf6 (hw/arm/virt: Fix non-secure flash mode)
8/10 Checking commit 6d7051773f27 (pl031: Correctly migrate state when using -rtc clock=host)
ERROR: spaces required around that '*' (ctx:VxV)
#158: FILE: hw/timer/pl031.c:300:
+    .subsections = (const VMStateDescription*[]) {
                                             ^

total: 1 errors, 0 warnings, 146 lines checked

Patch 8/10 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

9/10 Checking commit a30b1dad815c (target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026)
10/10 Checking commit 374fdb936ee9 (target/arm: NS BusFault on vector table fetch escalates to NS HardFault)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20190715134211.23063-1-peter.maydell@linaro.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Patchew URL: https://patchew.org/QEMU/20190715134211.23063-1-peter.maydell@linaro.org/



Hi,

This series seems to have some coding style problems. See output below for
more information:

Message-id: 20190715134211.23063-1-peter.maydell@linaro.org
Type: series
Subject: [Qemu-devel] [PULL 00/10] target-arm queue

=== TEST SCRIPT BEGIN ===
#!/bin/bash
git rev-parse base > /dev/null || exit 0
git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram
./scripts/checkpatch.pl --mailback base..
=== TEST SCRIPT END ===

From https://github.com/patchew-project/qemu
 * [new tag]               patchew/20190715134211.23063-1-peter.maydell@linaro.org -> patchew/20190715134211.23063-1-peter.maydell@linaro.org
Switched to a new branch 'test'
374fdb936e target/arm: NS BusFault on vector table fetch escalates to NS HardFault
a30b1dad81 target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
6d7051773f pl031: Correctly migrate state when using -rtc clock=host
93d58455ba hw/arm/virt: Fix non-secure flash mode
08594d9831 hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
d4bfee6403 hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
521dcfc621 hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
28dc994a87 hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
33d10d39bd hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
4ad540cb00 target/arm: report ARMv8-A FP support for AArch32 -cpu max

=== OUTPUT BEGIN ===
1/10 Checking commit 4ad540cb003f (target/arm: report ARMv8-A FP support for AArch32 -cpu max)
2/10 Checking commit 33d10d39bd1e (hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs)
3/10 Checking commit 28dc994a8771 (hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory)
4/10 Checking commit 521dcfc62131 (hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[])
5/10 Checking commit d4bfee6403a6 (hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO)
6/10 Checking commit 08594d9831b4 (hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO)
7/10 Checking commit 93d58455baf6 (hw/arm/virt: Fix non-secure flash mode)
8/10 Checking commit 6d7051773f27 (pl031: Correctly migrate state when using -rtc clock=host)
ERROR: spaces required around that '*' (ctx:VxV)
#158: FILE: hw/timer/pl031.c:300:
+    .subsections = (const VMStateDescription*[]) {
                                             ^

total: 1 errors, 0 warnings, 146 lines checked

Patch 8/10 has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

9/10 Checking commit a30b1dad815c (target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026)
10/10 Checking commit 374fdb936ee9 (target/arm: NS BusFault on vector table fetch escalates to NS HardFault)
=== OUTPUT END ===

Test command exited with code: 1


The full log is available at
http://patchew.org/logs/20190715134211.23063-1-peter.maydell@linaro.org/testing.checkpatch/?type=message.
---
Email generated automatically by Patchew [https://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On Mon, 15 Jul 2019 at 14:42, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> target-arm queue for rc1 -- these are all bug fixes.
>
> thanks
> -- PMM
>
> The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:
>
>   Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)
>
> are available in the Git repository at:
>
>   https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715
>
> for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:
>
>   target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * report ARMv8-A FP support for AArch32 -cpu max
>  * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
>  * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
>  * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
>  * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
>  * hw/arm/virt: Fix non-secure flash mode
>  * pl031: Correctly migrate state when using -rtc clock=host
>  * fix regression that meant arm926 and arm1026 lost VFP
>    double-precision support
>  * v8M: NS BusFault on vector table fetch escalates to NS HardFault
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/4.1
for any user-visible changes.

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

target-arm queue for rc1 -- these are all bug fixes.

thanks
-- PMM

The following changes since commit b9404bf592e7ba74180e1a54ed7a266ec6ee67f2:

  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20190715' into staging (2019-07-15 12:22:07 +0100)

are available in the Git repository at:

  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190715

for you to fetch changes up to 51c9122e92b776a3f16af0b9282f1dc5012e2a19:

  target/arm: NS BusFault on vector table fetch escalates to NS HardFault (2019-07-15 14:17:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * report ARMv8-A FP support for AArch32 -cpu max
 * hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
 * hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
 * hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
 * hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO
 * hw/arm/virt: Fix non-secure flash mode
 * pl031: Correctly migrate state when using -rtc clock=host
 * fix regression that meant arm926 and arm1026 lost VFP
   double-precision support
 * v8M: NS BusFault on vector table fetch escalates to NS HardFault

----------------------------------------------------------------
Alex Bennée (1):
      target/arm: report ARMv8-A FP support for AArch32 -cpu max

David Engraf (1):
      hw/arm/virt: Fix non-secure flash mode

Peter Maydell (3):
      pl031: Correctly migrate state when using -rtc clock=host
      target/arm: Set VFP-related MVFR0 fields for arm926 and arm1026
      target/arm: NS BusFault on vector table fetch escalates to NS HardFault

Philippe Mathieu-Daudé (5):
      hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrs
      hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memory
      hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]
      hw/ssi/mss-spi: Avoid crash when reading empty RX FIFO
      hw/display/xlnx_dp: Avoid crash when reading empty RX FIFO

 include/hw/timer/pl031.h |  2 ++
 hw/arm/virt.c            |  2 +-
 hw/core/machine.c        |  1 +
 hw/display/xlnx_dp.c     | 15 +++++---
 hw/ssi/mss-spi.c         |  8 ++++-
 hw/ssi/xilinx_spips.c    | 43 +++++++++++++++-------
 hw/timer/pl031.c         | 92 +++++++++++++++++++++++++++++++++++++++++++++---
 target/arm/cpu.c         | 16 +++++++++
 target/arm/m_helper.c    | 21 ++++++++---
 9 files changed, 174 insertions(+), 26 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 23 March 2018 at 18:49, Peter Maydell <peter.maydell@linaro.org> wrote:
> Ten arm-related bug fixes for 2.12...
>
> thanks
> -- PMM
>
> The following changes since commit 4c2c1015905fa1d616750dfe024b4c0b35875950:
>
>   Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20180323' into staging (2018-03-23 10:20:54 +0000)
>
> are available in the Git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180323
>
> for you to fetch changes up to 548f514cf89dd9ab39c0cb4c063097bccf141fdd:
>
>   target/arm: Always set FAR to a known unknown value for debug exceptions (2018-03-23 18:26:46 +0000)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * arm/translate-a64: don't lose interrupts after unmasking via write to DAIF
>  * sdhci: fix incorrect use of Error *
>  * hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
>  * hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
>  * i.MX: Support serial RS-232 break properly
>  * mach-virt: Set VM's SMBIOS system version to mc->name
>  * target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
>  * target/arm: Factor out code to calculate FSR for debug exceptions
>  * target/arm: Set FSR for BKPT, BRK when raising exception
>  * target/arm: Always set FAR to a known unknown value for debug exceptions
>

Applied, thanks.

-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[no-reply]

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: 20180323184958.14252-1-peter.maydell@linaro.org
Subject: [Qemu-devel] [PULL 00/10] target-arm queue

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True
git config --local diff.algorithm histogram

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
e4250a6575 target/arm: Always set FAR to a known unknown value for debug exceptions
5f8ad1e5dc target/arm: Set FSR for BKPT, BRK when raising exception
1f8698e782 target/arm: Factor out code to calculate FSR for debug exceptions
01c3c783a2 target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
6fdd8ed47e mach-virt: Set VM's SMBIOS system version to mc->name
4c27421e3d i.MX: Support serial RS-232 break properly
541bf9ad10 hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
4ba4d6edd9 hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
c5d1bc28c0 sdhci: fix incorrect use of Error *
c8c419d13c arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT

=== OUTPUT BEGIN ===
Checking PATCH 1/10: arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT...
Checking PATCH 2/10: sdhci: fix incorrect use of Error *...
Checking PATCH 3/10: hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses...
Checking PATCH 4/10: hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15...
Checking PATCH 5/10: i.MX: Support serial RS-232 break properly...
ERROR: spaces required around that '<<' (ctx:VxV)
#56: FILE: include/hw/char/imx_serial.h:29:
+#define URXD_FRMERR     (1<<12)   /* Character has frame error */
                           ^

total: 1 errors, 0 warnings, 24 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 6/10: mach-virt: Set VM's SMBIOS system version to mc->name...
Checking PATCH 7/10: target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK...
Checking PATCH 8/10: target/arm: Factor out code to calculate FSR for debug exceptions...
Checking PATCH 9/10: target/arm: Set FSR for BKPT, BRK when raising exception...
Checking PATCH 10/10: target/arm: Always set FAR to a known unknown value for debug exceptions...
=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Ten arm-related bug fixes for 2.12...

thanks
-- PMM

The following changes since commit 4c2c1015905fa1d616750dfe024b4c0b35875950:

  Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20180323' into staging (2018-03-23 10:20:54 +0000)

are available in the Git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180323

for you to fetch changes up to 548f514cf89dd9ab39c0cb4c063097bccf141fdd:

  target/arm: Always set FAR to a known unknown value for debug exceptions (2018-03-23 18:26:46 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm/translate-a64: don't lose interrupts after unmasking via write to DAIF
 * sdhci: fix incorrect use of Error *
 * hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
 * hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
 * i.MX: Support serial RS-232 break properly
 * mach-virt: Set VM's SMBIOS system version to mc->name
 * target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
 * target/arm: Factor out code to calculate FSR for debug exceptions
 * target/arm: Set FSR for BKPT, BRK when raising exception
 * target/arm: Always set FAR to a known unknown value for debug exceptions

----------------------------------------------------------------
Paolo Bonzini (1):
      sdhci: fix incorrect use of Error *

Peter Maydell (6):
      hw/intc/arm_gicv3: Fix secure-GIC NS ICC_PMR and ICC_RPR accesses
      hw/arm/bcm2836: Use the Cortex-A7 instead of Cortex-A15
      target/arm: Honour MDCR_EL2.TDE when routing exceptions due to BKPT/BRK
      target/arm: Factor out code to calculate FSR for debug exceptions
      target/arm: Set FSR for BKPT, BRK when raising exception
      target/arm: Always set FAR to a known unknown value for debug exceptions

Trent Piepho (1):
      i.MX: Support serial RS-232 break properly

Victor Kamensky (1):
      arm/translate-a64: treat DISAS_UPDATE as variant of DISAS_EXIT

Wei Huang (1):
      mach-virt: Set VM's SMBIOS system version to mc->name

 include/hw/arm/virt.h        |  1 +
 include/hw/char/imx_serial.h |  1 +
 target/arm/helper.h          |  1 +
 target/arm/internals.h       | 25 +++++++++++++++++++++++++
 hw/arm/bcm2836.c             |  2 +-
 hw/arm/raspi.c               |  2 +-
 hw/arm/virt.c                |  8 +++++++-
 hw/char/imx_serial.c         |  5 ++++-
 hw/intc/arm_gicv3_cpuif.c    |  6 +++---
 hw/sd/sdhci.c                |  4 ++--
 target/arm/helper.c          |  1 -
 target/arm/op_helper.c       | 33 ++++++++++++++++++++++-----------
 target/arm/translate-a64.c   | 21 ++++++++++++++++-----
 target/arm/translate.c       | 19 ++++++++++++++-----
 14 files changed, 98 insertions(+), 31 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 11 March 2015 at 14:18, Peter Maydell <peter.maydell@linaro.org> wrote:
> target-arm queue: mostly bug fixes, but also the Netduino 2
> machine model. I'm letting that in (even though it's nearly
> hardfreeze) since a new board model isn't going to impact
> other existing uses, and the patches were posted well before
> softfreeze deadline.

Applied, thanks.

PS: if you see "unknown device" failures in make check, this
is a bug in our makefile/dependency generation stuff (currently
being worked on). The workaround is to
 rm $BUILD_TREE/*/config-devices.mak

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

target-arm queue: mostly bug fixes, but also the Netduino 2
machine model. I'm letting that in (even though it's nearly
hardfreeze) since a new board model isn't going to impact
other existing uses, and the patches were posted well before
softfreeze deadline.

-- PMM


The following changes since commit 48412371415a260d00fc7fdcdb400da55f268828:

  Merge remote-tracking branch 'remotes/ehabkost/tags/x86-pull-request' into staging (2015-03-11 11:12:35 +0000)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150311

for you to fetch changes up to 4f9950520a115acf9c0a209f0befa45758ad0215:

  bitops.h: sextract64() return type should be int64_t, not uint64_t (2015-03-11 13:21:06 +0000)

----------------------------------------------------------------
target-arm queue:
 * fix a bug in bitops.h
 * implement SD card support on integratorcp
 * add a missing 'compatible' property for Cortex-A57
 * add Netduino 2 machine model
 * fix command line parsing bug for CPU options with multiple CPUs

----------------------------------------------------------------
Alistair Francis (5):
      stm32f2xx_timer: Add the stm32f2xx Timer
      stm32f2xx_USART: Add the stm32f2xx USART Controller
      stm32f2xx_SYSCFG: Add the stm32f2xx SYSCFG
      stm32f205: Add the stm32f205 SoC
      netduino2: Add the Netduino 2 Machine

Ard Biesheuvel (1):
      hw/arm/virt: fix cmdline parsing bug with CPU options and smp > 1

Jan Kiszka (2):
      integrator/cp: Model CP control registers as sysbus device
      integrator/cp: Implement CARDIN and WPROT signals

Peter Maydell (1):
      bitops.h: sextract64() return type should be int64_t, not uint64_t

Ryota Ozaki (1):
      target-arm: Add missing compatible property to A57

 default-configs/arm-softmmu.mak    |   4 +
 hw/arm/Makefile.objs               |   2 +
 hw/arm/integratorcp.c              |  95 +++++++++--
 hw/arm/netduino2.c                 |  57 +++++++
 hw/arm/stm32f205_soc.c             | 160 ++++++++++++++++++
 hw/arm/virt.c                      |   4 +-
 hw/char/Makefile.objs              |   1 +
 hw/char/stm32f2xx_usart.c          | 229 ++++++++++++++++++++++++++
 hw/misc/Makefile.objs              |   1 +
 hw/misc/stm32f2xx_syscfg.c         | 160 ++++++++++++++++++
 hw/timer/Makefile.objs             |   2 +
 hw/timer/stm32f2xx_timer.c         | 328 +++++++++++++++++++++++++++++++++++++
 include/hw/arm/stm32f205_soc.h     |  57 +++++++
 include/hw/char/stm32f2xx_usart.h  |  73 +++++++++
 include/hw/misc/stm32f2xx_syscfg.h |  61 +++++++
 include/hw/timer/stm32f2xx_timer.h | 101 ++++++++++++
 include/qemu/bitops.h              |   2 +-
 target-arm/cpu64.c                 |   1 +
 18 files changed, 1323 insertions(+), 15 deletions(-)
 create mode 100644 hw/arm/netduino2.c
 create mode 100644 hw/arm/stm32f205_soc.c
 create mode 100644 hw/char/stm32f2xx_usart.c
 create mode 100644 hw/misc/stm32f2xx_syscfg.c
 create mode 100644 hw/timer/stm32f2xx_timer.c
 create mode 100644 include/hw/arm/stm32f205_soc.h
 create mode 100644 include/hw/char/stm32f2xx_usart.h
 create mode 100644 include/hw/misc/stm32f2xx_syscfg.h
 create mode 100644 include/hw/timer/stm32f2xx_timer.h

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 20:45, Richard W.M. Jones <rjones@redhat.com> wrote:
> On Sun, May 04, 2014 at 08:36:20PM +0100, Peter Maydell wrote:
>> OK, so you have a kernel (possibly just kernel config) problem
>> here -- this means QEMU got EPERM trying to open /dev/kvm.
>
> Yes for some reason it was 0600.  I set it to 0666.
>
>> This isn't going to work for aarch64 at the moment because:
>>  * KVM aarch64 currently requires '-cpu host'
>
> OK -- I will play with libguestfs to make sure it passes this flag,
> and try again.

It should in theory be possible to get -cpu cortex-a57 to
work (though I haven't tried it so it's likely missing something
trivial); however that will only work if your host CPU is
actually a Cortex-A57. For any other host you'll need
-cpu host.

> Currently waiting for the host (which has panicked
> again) to be rebooted manually.

If your host has panicked that's a kernel bug :-) (or possibly
a hardware bug if you're unlucky). If it does so reproducibly
when you prod it with QEMU then you should probably retest
with a recent kernel and report it to the kvm-arm mailing list.

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Sun, May 04, 2014 at 08:36:20PM +0100, Peter Maydell wrote:
> OK, so you have a kernel (possibly just kernel config) problem
> here -- this means QEMU got EPERM trying to open /dev/kvm.

Yes for some reason it was 0600.  I set it to 0666.

> This isn't going to work for aarch64 at the moment because:
>  * KVM aarch64 currently requires '-cpu host'

OK -- I will play with libguestfs to make sure it passes this flag,
and try again.  Currently waiting for the host (which has panicked
again) to be rebooted manually.

Thanks again,

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 19:58, Richard W.M. Jones <rjones@redhat.com> wrote:
> On Sun, May 04, 2014 at 07:48:38PM +0100, Peter Maydell wrote:
>> On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
>> > I have real aarch64 hardware, and I'm trying to find a version of
>> > qemu-system-aarch64 which will boot a KVM guest in some form.
>> >
>> > Upstream qemu fails with a bizarre thread-local storage problem (yes,
>> > I've patched glibc to fix the makecontext problem).
>> >
>> > Is there a qemu tree I should be looking at?
>>
>> Upstream is it. I haven't been testing it for a while though; it's possible
>> it bitrotted while I wasn't looking.
>
> OK, it might be a kernel problem then.
>
> This was the issue I was having before:
>
> /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 \
>     -global virtio-blk-device.scsi=off \
>     -nodefconfig \
>     -enable-fips \
>     -nodefaults \
>     -display none \
>     -M virt \
>     -machine accel=kvm:tcg \
>     -m 500 \
>     -no-reboot \
>     -rtc driftfix=slew \
>     -global kvm-pit.lost_tick_policy=discard \
>     -kernel /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/kernel \
>     -initrd /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/initrd \
>     -device virtio-scsi-device,id=scsi \
>     -drive file=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/scratch.1,cache=unsafe,format=raw,id=hd0,if=none \
>     -device scsi-hd,drive=hd0 \
>     -drive file=/home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none \
>     -device scsi-hd,drive=appliance \
>     -device virtio-serial-device \
>     -serial stdio \
>     -chardev socket,path=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/guestfsd.sock,id=channel0 \
>     -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
>     -append 'panic=1 console=ttyS0 udevtimeout=600 no_timer_check acpi=off printk.time=1 cgroup_disable=memory root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=screen'
> Could not access KVM kernel module: Permission denied
> failed to initialize KVM: Permission denied
> Back to tcg accelerator.

OK, so you have a kernel (possibly just kernel config) problem
here -- this means QEMU got EPERM trying to open /dev/kvm.
This isn't going to work for aarch64 at the moment because:
 * KVM aarch64 currently requires '-cpu host'
 * '-cpu host' is a KVM only thing that won't work with TCG
If you don't enable KVM we don't put 'host' in the CPU list
so usually the TCG code can't see it -- however "use KVM
but have the init fail" is a path I hadn't considered for getting
into TCG with -cpu host.

Does this happen if you start with accel=tcg so we're using
TCG all the way through?

You can also ignore all this in favour of just figuring out why
your kernel didn't let us open /dev/kvm...

PS: I didn't see a "-cpu something" in your command line;
I forget what the default is but it's probably not what you want.

> libguestfs: error: appliance closed the connection unexpectedly, see earlier error messages
> libguestfs: child_cleanup: 0x3b5a1770: child process died
> libguestfs: sending SIGTERM to process 12438
> libguestfs: error: /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 killed by signal 11 (Segmentation fault), see debug messages above
>
> The stack trace in qemu when the segfault occurs is:
>
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x000002aae2f17394 in cpu_arm_exec (env=0x3ff8401eed0,
>     env@entry=0x2ab1c978440) at /home/rjones/d/qemu/cpu-exec.c:241
> 241         current_cpu = cpu;
>
> (gdb) print tls__current_cpu
> Cannot find thread-local storage for LWP 12922, executable file /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64:
> TLS not supported on this target
>
> ... and ^^^ that's the part that makes no sense to me.  TLS must
> surely be supported, so there must be something odd about the
> compile-time environment.

I think that message is gdb saying that it doesn't support TLS,
not that the target architecture doesn't support TLS. How ancient
is your gdb? Google suggests that TLS support went into the
aarch64 target somewhat after the initial architecture support
(though still a year or so ago, so I would have expected it to get in...)

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

I think this problem comes from my environment adding -fPIE.

In any case, without that flag it doesn't crash in qemu (it
kernel panics instead ..)


Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Sun, May 04, 2014 at 07:48:38PM +0100, Peter Maydell wrote:
> On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
> > I have real aarch64 hardware, and I'm trying to find a version of
> > qemu-system-aarch64 which will boot a KVM guest in some form.
> >
> > Upstream qemu fails with a bizarre thread-local storage problem (yes,
> > I've patched glibc to fix the makecontext problem).
> >
> > Is there a qemu tree I should be looking at?
> 
> Upstream is it. I haven't been testing it for a while though; it's possible
> it bitrotted while I wasn't looking.

OK, it might be a kernel problem then.

This was the issue I was having before:

/home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 \
    -global virtio-blk-device.scsi=off \
    -nodefconfig \
    -enable-fips \
    -nodefaults \
    -display none \
    -M virt \
    -machine accel=kvm:tcg \
    -m 500 \
    -no-reboot \
    -rtc driftfix=slew \
    -global kvm-pit.lost_tick_policy=discard \
    -kernel /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/kernel \
    -initrd /home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/initrd \
    -device virtio-scsi-device,id=scsi \
    -drive file=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/scratch.1,cache=unsafe,format=raw,id=hd0,if=none \
    -device scsi-hd,drive=hd0 \
    -drive file=/home/rjones/d/libguestfs/tmp/.guestfs-1000/appliance.d/root,snapshot=on,id=appliance,cache=unsafe,if=none \
    -device scsi-hd,drive=appliance \
    -device virtio-serial-device \
    -serial stdio \
    -chardev socket,path=/home/rjones/d/libguestfs/tmp/libguestfsHRi4Tt/guestfsd.sock,id=channel0 \
    -device virtserialport,chardev=channel0,name=org.libguestfs.channel.0 \
    -append 'panic=1 console=ttyS0 udevtimeout=600 no_timer_check acpi=off printk.time=1 cgroup_disable=memory root=/dev/sdb selinux=0 guestfs_verbose=1 TERM=screen'
Could not access KVM kernel module: Permission denied
failed to initialize KVM: Permission denied
Back to tcg accelerator.
libguestfs: error: appliance closed the connection unexpectedly, see earlier error messages
libguestfs: child_cleanup: 0x3b5a1770: child process died
libguestfs: sending SIGTERM to process 12438
libguestfs: error: /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64 killed by signal 11 (Segmentation fault), see debug messages above

The stack trace in qemu when the segfault occurs is:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000002aae2f17394 in cpu_arm_exec (env=0x3ff8401eed0, 
    env@entry=0x2ab1c978440) at /home/rjones/d/qemu/cpu-exec.c:241
241         current_cpu = cpu;

(gdb) print tls__current_cpu 
Cannot find thread-local storage for LWP 12922, executable file /home/rjones/d/qemu/aarch64-softmmu/qemu-system-aarch64:
TLS not supported on this target

... and ^^^ that's the part that makes no sense to me.  TLS must
surely be supported, so there must be something odd about the
compile-time environment.

Linux ***.redhat.com 3.13.0-0.rc7.31.***.aarch64.debug #1 SMP Fri May 2 16:55:22 EDT 2014 aarch64 aarch64 aarch64 GNU/Linux

glibc-2.19.90-11.fc21.aarch64
gcc-4.9.0-1.fc21.aarch64

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://people.redhat.com/~rjones/virt-df/

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 4 May 2014 19:30, Richard W.M. Jones <rjones@redhat.com> wrote:
> I have real aarch64 hardware, and I'm trying to find a version of
> qemu-system-aarch64 which will boot a KVM guest in some form.
>
> Upstream qemu fails with a bizarre thread-local storage problem (yes,
> I've patched glibc to fix the makecontext problem).
>
> Is there a qemu tree I should be looking at?

Upstream is it. I haven't been testing it for a while though; it's possible
it bitrotted while I wasn't looking.

thanks
-- PMM

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Richard W.M. Jones]

On Thu, May 01, 2014 at 03:54:57PM +0100, Peter Maydell wrote:
> Nothing earthshattering here, but it does have the patch which
> actually lets us boot an emulated AArch64 CPU on a board...

Hi Peter,

I have real aarch64 hardware, and I'm trying to find a version of
qemu-system-aarch64 which will boot a KVM guest in some form.

Upstream qemu fails with a bizarre thread-local storage problem (yes,
I've patched glibc to fix the makecontext problem).

Is there a qemu tree I should be looking at?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

On 1 May 2014 15:54, Peter Maydell <peter.maydell@linaro.org> wrote:
> Nothing earthshattering here, but it does have the patch which
> actually lets us boot an emulated AArch64 CPU on a board...
>
> thanks
> -- PMM
>
> The following changes since commit 051b9980b99dbfba22ea5f79bd3708d513ae121d:
>
>   Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-6' into staging (2014-05-01 14:17:33 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140501
>
> for you to fetch changes up to f42c5c8ec8aa0e15583487ffee62964830751623:
>
>   hw/arm/virt: Add support for Cortex-A57 (2014-05-01 15:25:52 +0100)

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Nothing earthshattering here, but it does have the patch which
actually lets us boot an emulated AArch64 CPU on a board...

thanks
-- PMM

The following changes since commit 051b9980b99dbfba22ea5f79bd3708d513ae121d:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-6' into staging (2014-05-01 14:17:33 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20140501

for you to fetch changes up to f42c5c8ec8aa0e15583487ffee62964830751623:

  hw/arm/virt: Add support for Cortex-A57 (2014-05-01 15:25:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * implement XScale cache lockdown cp15 ops
 * fix v7M CPUID base register
 * implement WFE and YIELD as yields for A64
 * fix A64 "BLR LR"
 * support Cortex-A57 in virt machine model
 * a few other minor AArch64 bugfixes

----------------------------------------------------------------
Edgar E. Iglesias (4):
      target-arm: Make vbar_write 64bit friendly on 32bit hosts
      target-arm: A64: Handle blr lr
      target-arm: A64: Fix a typo when declaring TLBI ops
      target-arm: Correct a comment refering to EL0

Peter Maydell (4):
      target-arm: Implement XScale cache lockdown operations as NOPs
      hw/arm/virt: Create the GIC ourselves rather than (ab)using a15mpcore_priv
      hw/arm/virt: Put GIC register banks on 64K boundaries
      hw/arm/virt: Add support for Cortex-A57

Rabin Vincent (1):
      armv7m_nvic: fix CPUID Base Register

Rob Herring (1):
      target-arm: implement WFE/YIELD as a yield for AArch64

 hw/arm/virt.c              | 93 ++++++++++++++++++++++++++++++----------------
 hw/intc/armv7m_nvic.c      |  2 +-
 target-arm/helper.c        | 41 +++++++++++++-------
 target-arm/op_helper.c     |  2 +-
 target-arm/translate-a64.c |  9 ++++-
 5 files changed, 99 insertions(+), 48 deletions(-)

Re: [Qemu-devel] [PULL 00/10] target-arm queue

[andrzej zaborowski]

On 13 December 2011 19:30, Peter Maydell <peter.maydell@linaro.org> wrote:
> Current target-arm pending patches; mostly these are Andreas'
> inference series, plus one from Jean-Christophe that's been
> waiting since before the 1.0 release.
>
> Please pull.

Thanks, pulled (and pushed)

Cheers

[Qemu-devel] [PULL 00/10] target-arm queue

[Peter Maydell]

Current target-arm pending patches; mostly these are Andreas'
inference series, plus one from Jean-Christophe that's been
waiting since before the 1.0 release.

Please pull.

-- PMM

The following changes since commit da5361cc685c004d8bb4e7c5e7b3a52c7aca2c56:

  ccid: make threads joinable (2011-12-12 17:06:22 -0600)

are available in the git repository at:
  git://git.linaro.org/people/pmaydell/qemu-arm.git target-arm.for-upstream

Andreas Färber (9):
      target-arm: Infer ARMv4T feature from ARMv5
      target-arm: Infer ARMv5 feature from ARMv6
      target-arm: Infer ARMv6 feature from v6K
      target-arm: Infer ARMv6(K) feature from ARMv7
      target-arm: Infer AUXCR feature from ARMv6
      target-arm: Infer Thumb2 feature from ARMv7
      target-arm: Infer Thumb division feature from M profile
      target-arm: Infer VFP feature from VFPv3
      target-arm: Infer VFPv3 feature from VFPv4

Jean-Christophe DUBOIS (1):
      arm: Fix CP15 FSR (C5) domain setting

 target-arm/helper.c |   95 ++++++++++++++++++++++----------------------------
 1 files changed, 42 insertions(+), 53 deletions(-)