Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

This fix a segfault (that is caused by b3af018f) of following command:

$ qemu-img convert some_img sheepdog:some_img

Cc: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NLiu Yuan <namei.unix@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The ability of the new opcodes to byte-swap the memory operation
simplifies the code in and around dec_load and dec_store significantly.
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Tested-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Cc: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>

# By Richard Henderson
# Via Richard Henderson
* rth/tcg-temp-order:
  tcg: Use bitmaps for free temporaries

Message-id: 1386698065-6661-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Vincenzo Maffione (2) and others
# Via Stefan Hajnoczi
* stefanha/net-next:
  net: Update netdev peer on link change
  virtio-net: don't update mac_table in error state
  MAINTAINERS: Add netmap maintainers
  net: Adding netmap network backend

Message-id: 1386594692-21278-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

target-arm queue:
 * support REFCNT register on integrator/cp board
 * implement the A9MP's global timer
 * add the 'virt' platform
 * support '-cpu host' on KVM/ARM
 * Cadence GEM ethernet device bugfixes
 * Implement 32-bit ARMv8 VSEL, VMAXNM, VMINNM
 * fix TTBCR write masking
 * update 32 bit decoder to use new qemu_ld/st TCG opcodes

# gpg: Signature made Tue 10 Dec 2013 06:22:01 AM PST using RSA key ID 14360CDE
# gpg: Can't check signature: public key not found

# By Peter Crosthwaite (16) and others
# Via Peter Maydell
* pmaydell/tags/pull-target-arm-20131210: (37 commits)
  target-arm: fix TTBCR write masking
  target-arm: Use new qemu_ld/st opcodes
  target-arm: Implement ARMv8 SIMD VMAXNM and VMINNM instructions.
  target-arm: Implement ARMv8 FP VMAXNM and VMINNM instructions.
  softfloat: Add minNum() and maxNum() functions to softfloat.
  softfloat: Remove unused argument from MINMAX macro.
  target-arm: Implement ARMv8 VSEL instruction.
  target-arm: Move call to disas_vfp_insn out of disas_coproc_insn.
  net/cadence_gem: Don't rx packets when no rx buffer available
  net/cadence_gem: Improve can_receive debug printfery
  net/cadence_gem: Fix register w1c logic
  net/cadence_gem: Fix small packet FCS stripping
  net/cadence_gem: Fix rx multi-fragment packets
  net/cadence_gem: Add missing VMSTATE_END_OF_LIST
  net/cadence_gem: Implement SAR (de)activation
  net/cadence_gem: Implement SAR match bit in rx desc
  net/cadence_gem: Implement RX descriptor match mode flags
  net/cadence_gem: Prefetch rx descriptors ASAP
  net/cadence_gem: simplify rx buf descriptor walking
  net/cadence_gem: Don't assert against 0 buffer address
  ...

Message-id: 1386686613-2390-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Change audio wakeup rate from 250 Hz to 100 Hz.
Emulation bugfixes for intel-hda and adlib.

# gpg: Signature made Mon 09 Dec 2013 06:04:16 AM PST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

# By Gerd Hoffmann (2) and others
# Via Gerd Hoffmann
* kraxel/tags/pull-audio-1:
  intel-hda: fix position buffer
  adlib: fix patching of port I/O addresses
  audio: adjust pulse to 100Hz wakeup rate
  audio: Lower default wakeup rate to 100 times / second

Message-id: 1386597974-26506-1-git-send-email-kraxel@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Stefan Weil
# Via Alon Levy
* alon/libcacard_ccid.4:
  libcacard: Fix compilation for older versions of glib (bug #1258168)

Message-id: 1386596263-26151-1-git-send-email-alevy@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Stefan Weil
# Via Michael Tokarev
* mjt/trivial-patches:
  qxl: Add missing trace.h (fix broken build)

Message-id: 1386441094-9971-1-git-send-email-mjt@msgid.tls.msk.ru
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

We previously allocated 32-bits per temp for the next_free_temp entry.
We now allocate 4 bits per temp across the 4 bitmaps.

Using a linked list meant that if a translator is tweeked, resulting in
temps being freed in a different order, that would have follow-on effects
throughout the TB.  Always allocating the lowest free temp means that
follow-on effects are minimized, which can make it easier to diff output
when debugging the translators.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Current implementation is not accurate according to ARMv7-AR reference
manual. See "B4.1.153 TTBCR, Translation Table Base Control Register,
VMSA | TTBCR format when using the Long-descriptor translation table
format". When LPAE feature is supported, EAE, bit[31] selects
translation descriptor format and, therefore, TTBCR format.
Signed-off-by: NSergey Fedorov <s.fedorov@samsung.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386657709-23399-1-git-send-email-s.fedorov@samsung.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Retain the existing gen_aa32_* inlines, to aid compilation for A64.

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Message-id: 1386628626-21627-1-git-send-email-rth@twiddle.net
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This adds support for the ARMv8 Advanced SIMD VMAXNM and VMINNM
instructions.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Message-id: 1386158099-9239-7-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This adds support for the ARMv8 floating point VMAXNM and VMINNM
instructions.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386158099-9239-6-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add floatnn_minnum() and floatnn_maxnum() functions which are equivalent
to the minNum() and maxNum() functions from IEEE 754-2008. They are
similar to min() and max() but differ in the handling of QNaN arguments.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Message-id: 1386158099-9239-5-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The nan_exp argument is not used, so remove it.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386158099-9239-4-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This adds support for the VSEL floating point selection instruction
which was added in ARMv8.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386158099-9239-3-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Floating point is an extension to the instruction set rather than
a coprocessor, so call it directly from the ARM and Thumb decode
functions.
Signed-off-by: NWill Newton <will.newton@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386158099-9239-2-git-send-email-will.newton@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Return false from can_receive() when no valid buffer descriptor is
available. Ensures against mass packet droppage in some applications.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: cde00ef774e84e2586bf10fd37b542f75bf36cfb.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Currently this just floods indicating that can_receive has been called
by the net framework. Instead, save the result of the most recent
can_receive callback as state and only print a message if the result
changes (indicating some sort of actual state change in GEM). Make said
debug message more meaningful as well.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 2eb74ca6a5756aea242d9f525961db95d6cfcf2c.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This write-1-clear logic was incorrect. It was always clearing w1c
bits regardless of whether the written value was 1 or not. i.e. it
was implementing a write-anything-to-clear strategy.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: ed905b04d3343966ded425f06aa2224bc7a35b59.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The minimum packet size is 64, however this is before FCS stripping
occurs. So when FCS stripping the minimum packet size is 60. Fix.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 8aac5bd737f9cf48b87f32943d7eb5939061e546.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Bytes_to_copy was being updated before its final use where it
advances the rx buffer pointer. This was causing total mayhem,
where packet data for any subsequent fragments was being fetched
from the wrong place.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: c2a1c65c1fd06eb274442a0fa4a6839d940e145e.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 8f8c2bfb15f40fb5f0d5766aa4cd3d54c596de6a.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The Specific address registers can be enabled or disabled by software.
QEMU was assuming they were always enabled. Implement the
disable/enable feature. SARs are disabled by writing to the lower half
register. They are re-enabled by then writing the upper half.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 49efd1f7450af8f980b967d3054245bae137866c.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Bit 27 of the RX buffer desc word 1 should be set when the packet was
accepted due to specific address register match. Implement.

This feature is absent from the Xilinx documentation (UG585) but the
behaviour is tested as accurate on real hardware.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 7e3f26fc4ab244e8123efc12723e7164730abdcb.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The various Rx packet address matching mode flags were not being set in
the rx descriptor. Implement.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 6002a24a6a8ceaa11d3009ab5392840d1c084b28.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The real hardware prefetches rx buffer descriptors ASAP and
potentially throws relevant interrupts following the fetch
even in the absence of a received packet.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 41629e35edfdb1f02f1e401f2c3d0e2e4c9e44b3.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

There was a replication of the rx descriptor address walking logic.
Reorder the flow control to remove. This refactoring also obsoletes
the local variables packet_desc_addr and last_desc_addr.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 2a425b457ff0b57274bf206ad2236690cd7f5909.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This has no real hardware analog and asserting correctness of DMA
addresses is not a perhiperal level problem. Delete.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: fc02417eb1874cb05e4f20531c6203c5a00110f1.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

We were updating the ownership bit of all descriptors if packets
get split and written through several descriptors.
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: d61b7847b51487118783c93765a485bc5c66d272.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Cadence GEM has a MAC level loopback mode. Implement. Use the same basic
operation as the already implemented PHY loopback.
Reported-by: NDeepika Dhamija <deepika@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 3a0baf1b6b2fc1be638bdf1a37408ec38988e970.1386136219.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Support -cpu host in virt machine (treating it like an A15, ie
with a GIC v2 and the A15's private peripherals.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-12-git-send-email-peter.maydell@linaro.org

Implement '-cpu host' for ARM when we're using KVM, broadly
in line with other KVM-supporting architectures.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-11-git-send-email-peter.maydell@linaro.org

Instead of assuming that a KVM target CPU must always be a
Cortex-A15 and hardcoding this in kvm_arch_init_vcpu(),
store the KVM_ARM_TARGET_* value in the ARMCPU class,
and use that.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-10-git-send-email-peter.maydell@linaro.org

Add 'virt' platform support corresponding to arch/arm/mach-virt
in the Linux kernel tree. This has no platform-specific code but
can use any device whose kernel driver is is able to work purely
from a device tree node. We use this to instantiate a minimal
set of devices: a GIC and some virtio-mmio transports.
Signed-off-by: NJohn Rigby <john.rigby@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-8-git-send-email-peter.maydell@linaro.org
[PMM:
 Significantly overhauled:
 * renamed user-facing machine to just "virt"
 * removed the A9 support (it can't work since the A9 has no
   generic timers)
 * added virtio-mmio transports instead of random set of 'soc' devices
   (though we retain a pl011 UART)
 * instead of updating io_base as we step through adding devices,
   define a memory map with an array (similar to vexpress)
 * similarly, define irqmap with an array
 * folded in some minor fixes from John's aarch64-support patch
 * rather than explicitly doing endian-swapping on FDT cells,
   use fdt APIs that let us just pass in host-endian values
   and let the fdt layer take care of the swapping
 * miscellaneous minor code cleanups and style fixes
]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

New ARM boards are generally expected to boot their secondary CPUs
via the PSCI interface, rather than ad-hoc "loop around in holding
pen code" as hw/arm/boot.c implements. In particular this is
necessary for mach-virt kernels. For KVM we achieve this by creating
the VCPUs with a feature flag marking them as starting in PSCI
powered-down state; the guest kernel will then make a PSCI call
(implemented in the host kernel) to start the secondaries at
an address of its choosing once it has got the primary CPU up.

Implement this setting of the feature flag, controlled by a
qdev property for ARMCPU, which board code can set if it is a
PSCI system.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-7-git-send-email-peter.maydell@linaro.org

Linux requires device tree CPU nodes to include a 'compatible'
string describing the CPU. Add a field in the ARMCPU struct for
this so that boards which construct a device tree can insert
the correct CPU nodes.

Note that there is currently no officially specified 'compatible'
string for the TI925T, Cortex-M3 or SA1110 CPUs.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-6-git-send-email-peter.maydell@linaro.org

Provide versions of the KVM PSCI constants to non-KVM code;
this will allow us to avoid an ifdef in boards which set up
a PSCI node in the device tree.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-5-git-send-email-peter.maydell@linaro.org

If no fdt is provided on command line and the new field
get_dtb in struct arm_boot_info is set then call it to
get a device tree blob.
Signed-off-by: NJohn Rigby <john.rigby@linaro.org>
Reviewed-by: NChristoffer Dall <christoffer.dall@linaro.org>
Message-id: 1385140638-10444-4-git-send-email-peter.maydell@linaro.org
[PMM: minor tweaks and cleanup]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>