[Qemu-commits] [qemu/qemu] c39770: hw/arm: Allow manually specified /psci node

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: c39770cd63776516c4e244702e859d84913ba9ed
      
https://github.com/qemu/qemu/commit/c39770cd63776516c4e244702e859d84913ba9ed
  Author: Andrey Smirnov <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/arm/boot.c

  Log Message:
  -----------
  hw/arm: Allow manually specified /psci node

Change the code to avoid exiting QEMU if user provided DTB contains
manually specified /psci node and skip any /psci related fixups
instead.

Fixes: 4cbca7d9b4 ("hw/arm: Move virt's PSCI DT fixup code to
arm/boot.c")

Signed-off-by: Andrey Smirnov <address@hidden>
Reported-by: Marc Zyngier <address@hidden>
Tested-by: Marc Zyngier <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 8720daad476fd9688b0c7e2453624c8a225c9c72
      
https://github.com/qemu/qemu/commit/8720daad476fd9688b0c7e2453624c8a225c9c72
  Author: Thomas Huth <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/arm/integratorcp.c

  Log Message:
  -----------
  hw/arm/integratorcp: Don't do things that could be fatal in the instance_init

An instance_init function must not fail - and might be called multiple times,
e.g. during device introspection with the 'device-list-properties' QMP
command. Since the integratorcm device ignores this rule, QEMU currently
aborts in this case (though it really should not):

echo "{'execute':'qmp_capabilities'}"\
     "{'execute':'device-list-properties',"\
     "'arguments':{'typename':'integrator_core'}}" \
     | arm-softmmu/qemu-system-arm -M integratorcp,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
RAMBlock "integrator.flash" already registered, abort!
Aborted (core dumped)

Move the problematic code to the realize() function instead to fix this
problem.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: c4869ca630a57f4269bb932ec7f719cef5bc79b8
      
https://github.com/qemu/qemu/commit/c4869ca630a57f4269bb932ec7f719cef5bc79b8
  Author: Onur Sahin <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target-arm: Check undefined opcodes for SWP in A32 decoder

Make sure we are not treating architecturally Undefined instructions
as a SWP, by verifying the opcodes as per section A8.8.229 of ARMv7-A
specification. Bits [21:20] must be zero for this to be a SWP or SWPB.
We also choose to UNDEF for the architecturally UNPREDICTABLE case of
bits [11:8] not being zero.

Signed-off-by: Onur Sahin <address@hidden>
[PMM: tweaked commit message]
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: b318f3265c4cdc7ae7c214bd931abad5bd7c6a5e
      
https://github.com/qemu/qemu/commit/b318f3265c4cdc7ae7c214bd931abad5bd7c6a5e
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/sd/bcm2835_sdhost.c
    M hw/sd/trace-events

  Log Message:
  -----------
  hw/sd/bcm2835_sdhost: Add tracepoints

Add some tracepoints to the bcm2835_sdhost driver, to assist
debugging.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: f3d9fe8f95964308564f0987f7a5e2a88cc887be
      
https://github.com/qemu/qemu/commit/f3d9fe8f95964308564f0987f7a5e2a88cc887be
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/sd/bcm2835_sdhost.c

  Log Message:
  -----------
  hw/sd/bcm2835_sdhost: Don't raise spurious interrupts

The Linux bcm2835_sdhost driver doesn't work on QEMU, because our
model raises spurious data interrupts.  Our function
bcm2835_sdhost_fifo_run() will flag an interrupt any time it is
called with s->datacnt == 0, even if the host hasn't actually issued
a data read or write command yet.  This means that the driver gets a
spurious data interrupt as soon as it enables IRQs and then does
something else that causes us to call the fifo_run routine, like
writing to SDHCFG, and before it does the write to SDCMD to issue the
read.  The driver's IRQ handler then spins forever complaining that
there's no data and the SD controller isn't in a state where there's
going to be any data:

[   41.040738] sdhost-bcm2835 3f202000.mmc: fsm 1, hsts 00000000
[   41.042059] sdhost-bcm2835 3f202000.mmc: fsm 1, hsts 00000000
(continues forever).

Move the interrupt flag setting to more plausible places:
 * for BUSY, raise this as soon as a BUSYWAIT command has executed
 * for DATA, raise this when the FIFO has any space free (for a write)
   or any data in it (for a read)
 * for BLOCK, raise this when the data count is 0 and we've
   actually done some reading or writing

This is pure guesswork since the documentation for this hardware is
not public, but it is sufficient to get the Linux bcm2835_sdhost
driver to work.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: 8aabc5437ba5b69b8ea2f42deadbb9ea9be39b1f
      
https://github.com/qemu/qemu/commit/8aabc5437ba5b69b8ea2f42deadbb9ea9be39b1f
  Author: Thomas Huth <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/arm/allwinner-a10.c

  Log Message:
  -----------
  hw/arm/allwinner-a10: Do not use nd_table in instance_init function

The instance_init function of a device can be called at any time, even
if the device is not going to be used (i.e. not going to be realized).
So a instance_init function must not do things that could cause QEMU
to exit, like calling qemu_check_nic_model(&nd_table[0], ...) for example.
But this is what the instance_init function of the allwinner-a10 device
is currently doing - and this causes QEMU to quit unexpectedly when
you run the 'device-list-properties' QMP command for example:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'allwinner-a10'}}" \
       | arm-softmmu/qemu-system-arm -M mps2-an505,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
Unsupported NIC model: lan9118

... and QEMU quits after printing the last line (which should not happen
just because of running 'device-list-properties' here).

And with the cubieboard, this even causes QEMU to abort():

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'allwinner-a10'}}" \
       | arm-softmmu/qemu-system-arm -M cubieboard,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
Unexpected error in error_set_from_qdev_prop_error() at 
hw/core/qdev-properties.c:1095:
Property 'allwinner-emac.netdev' can't take value 'hub0port0', it's in use
Aborted (core dumped)

To fix the problem we've got to move the offending code to the realize
function instead.

Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: f640a5914f5179aa1af00df70da470e24e055e8d
      
https://github.com/qemu/qemu/commit/f640a5914f5179aa1af00df70da470e24e055e8d
  Author: Thomas Huth <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M hw/arm/fsl-imx6.c
    M hw/arm/fsl-imx7.c

  Log Message:
  -----------
  hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7

QEMU currently exits unexpectedly when trying to introspect the fsl-imx6
and fsl-imx7 devices on systems with many SMP CPUs:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'fsl,imx6'}}" \
       | arm-softmmu/qemu-system-arm -M virt,accel=qtest -qmp stdio -smp 8
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
fsl,imx6: Only 4 CPUs are supported (8 requested)

And:

$ echo "{'execute':'qmp_capabilities'}"\
       "{'execute':'device-list-properties',"\
       " 'arguments':{'typename':'fsl,imx7'}}" \
       | arm-softmmu/qemu-system-arm -M raspi2,accel=qtest -qmp stdio
{"QMP": {"version": {"qemu": {"micro": 91, "minor": 11, "major": 2},
 "package": "build-all"}, "capabilities": []}}
{"return": {}}
fsl,imx7: Only 2 CPUs are supported (4 requested)

This happens because these devices are doing an exit() from their
instance_init function - which should never be done since instance_init
can be called at any time for device introspection! Fix it by moving
the deadly check into the realize() function instead.

Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 8aec759b45fa6986c0b159cb27353d6abb0d5d73
      
https://github.com/qemu/qemu/commit/8aec759b45fa6986c0b159cb27353d6abb0d5d73
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Report unsupported MPU region sizes more clearly

Currently our PMSAv7 and ARMv7M MPU implementation cannot handle
MPU region sizes smaller than our TARGET_PAGE_SIZE. However we
report that in a slightly confusing way:

 DRSR[3]: No support for MPU (sub)region alignment of 9 bits. Minimum is 10

The problem is not the alignment of the region, but its size;
tweak the error message to say so:
 DRSR[3]: No support for MPU (sub)region size of 512 bytes. Minimum is 1024.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: c52e7132d7c885841500f5277f7305f62767fe1d
      
https://github.com/qemu/qemu/commit/c52e7132d7c885841500f5277f7305f62767fe1d
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M cpus.c

  Log Message:
  -----------
  cpus.c: ensure running CPU recalculates icount deadlines on timer expiry

When we run in TCG icount mode, we calculate the number of instructions
to execute using tcg_get_icount_limit(), which ensures that we stop
execution at the next timer deadline. However there is a bug where
currently we do not recalculate that limit if the guest reprograms
a timer so that the next deadline moves closer, and so we will
continue execution until the original limit and fire the timer
later than we should.

Fix this bug in qemu_timer_notify_cb(): if we are currently running
a VCPU in icount mode, we simply need to kick it out of the main
loop and back to tcg_cpu_exec(), where it will recalculate the
icount limit. If we are not currently running a VCPU, then we
retain the existing logic for waking up a halted CPU.

Cc: address@hidden
Fixes: https://bugs.launchpad.net/qemu/+bug/1754038
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Alex Bennée <address@hidden>
Message-id: address@hidden


  Commit: 7f0f4208b3a96f2202e86bc3e58a4c20d390ce1b
      
https://github.com/qemu/qemu/commit/7f0f4208b3a96f2202e86bc3e58a4c20d390ce1b
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M linux-user/signal.c

  Log Message:
  -----------
  linux-user/signal.c: Ensure AArch64 signal frame isn't too small

The AArch64 signal frame design was extended for SVE in commit
8c5931de0ac77388096d79ceb, so that instead of having a fixed setup we
now add various records to the frame, with some of them possibly
overflowing into an extra space outside the original 4K reserved
block in the target_sigcontext.  However, we failed to ensure that we
always at least allocate the 4K reserved block.  This is ABI, and
some userspace programs rely on it.  In particular the dash shell
would segfault if the frame wasn't as big enough.

(Compare the kernel's sigframe_size() function in
arch/arm64/kernel/signal.c.)

Reported-by: Richard Henwood <address@hidden>
Reviewed-by: Laurent Vivier <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Fixes: https://bugs.launchpad.net/bugs/1761535
Fixes: 8c5931de0ac77388096d79ceb
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 9743cd5736263e90d312b2c33bd739ffe1eae70d
      
https://github.com/qemu/qemu/commit/9743cd5736263e90d312b2c33bd739ffe1eae70d
  Author: Richard Henderson <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M target/arm/translate.h
    M tcg/tcg.h

  Log Message:
  -----------
  tcg: Introduce tcg_set_insn_start_param

The parameters for tcg_gen_insn_start are target_ulong, which may be split
into two TCGArg parameters for storage in the opcode on 32-bit hosts.

Fixes the ARM target and its direct use of tcg_set_insn_param, which would
set the wrong argument in the 64-on-32 case.

Cc: address@hidden
Reported-by: address@hidden
Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: bd49e6027cbc207c87633c7add3ebd7d3474cd35
      
https://github.com/qemu/qemu/commit/bd49e6027cbc207c87633c7add3ebd7d3474cd35
  Author: Richard Henderson <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M fpu/softfloat.c

  Log Message:
  -----------
  fpu: Fix rounding mode for floatN_to_uintM_round_to_zero

We incorrectly passed in the current rounding mode
instead of float_round_to_zero.

Signed-off-by: Richard Henderson <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: f41ee66df0ceef0002644d08a61a6a929674898d
      
https://github.com/qemu/qemu/commit/f41ee66df0ceef0002644d08a61a6a929674898d
  Author: Peter Maydell <address@hidden>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M cpus.c
    M fpu/softfloat.c
    M hw/arm/allwinner-a10.c
    M hw/arm/boot.c
    M hw/arm/fsl-imx6.c
    M hw/arm/fsl-imx7.c
    M hw/arm/integratorcp.c
    M hw/sd/bcm2835_sdhost.c
    M hw/sd/trace-events
    M linux-user/signal.c
    M target/arm/helper.c
    M target/arm/translate.c
    M target/arm/translate.h
    M tcg/tcg.h

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180410' 
into staging

target-arm queue:
 * fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
 * tcg: Fix guest state corruption when running 64-bit Arm
   guests on a 32-bit host (especially when using icount)
 * linux-user/signal.c: Ensure AArch64 signal frame isn't too small
 * cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
 * target/arm: Report unsupported MPU region sizes more clearly
 * hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
 * hw/arm/allwinner-a10: Do not use nd_table in instance_init function
 * hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
 * hw/sd/bcm2835_sdhost: Add tracepoints
 * target-arm: Check undefined opcodes for SWP in A32 decoder
 * hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
 * hw/arm: Allow manually specified /psci node

# gpg: Signature made Tue 10 Apr 2018 13:16:12 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180410:
  fpu: Fix rounding mode for floatN_to_uintM_round_to_zero
  tcg: Introduce tcg_set_insn_start_param
  linux-user/signal.c: Ensure AArch64 signal frame isn't too small
  cpus.c: ensure running CPU recalculates icount deadlines on timer expiry
  target/arm: Report unsupported MPU region sizes more clearly
  hw/arm/fsl-imx: Fix introspection problem with fsl-imx6 and fsl-imx7
  hw/arm/allwinner-a10: Do not use nd_table in instance_init function
  hw/sd/bcm2835_sdhost: Don't raise spurious interrupts
  hw/sd/bcm2835_sdhost: Add tracepoints
  target-arm: Check undefined opcodes for SWP in A32 decoder
  hw/arm/integratorcp: Don't do things that could be fatal in the instance_init
  hw/arm: Allow manually specified /psci node

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/df6378eb0e6c...f41ee66df0ce