[Qemu-commits] [qemu/qemu] 8c4f0e: target-arm: Correct handling of writes to CPSR mod...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 8c4f0eb94cc65ee32a12feba88d0b32e3665d5ea
      
https://github.com/qemu/qemu/commit/8c4f0eb94cc65ee32a12feba88d0b32e3665d5ea
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/helper.c

  Log Message:
  -----------
  target-arm: Correct handling of writes to CPSR mode bits from gdb in usermode

In helper.c the expression
  (env->uncached_cpsr & CPSR_M) != CPSR_USER
is always true; the right hand side was supposed to be ARM_CPU_MODE_USR
(an error in commit cb01d391).

Since the incorrect expression was always true, this just meant that
commit cb01d391 had no effect.

However simply changing the RHS here would reveal a logic error: if
the mode is USR we wish to completely ignore the attempt to set the
mode bits, which means that we must clear the CPSR_M bits from mask
to avoid the uncached_cpsr bits being updated at the end of the
function.

Move the condition into the correct place in the code, fix its RHS
constant, and add a comment about the fact that we must be doing a
gdbstub write if we're in user mode.

Fixes: https://bugs.launchpad.net/qemu/+bug/1550503
Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Sergey Fedorov <address@hidden>
Message-id: address@hidden


  Commit: 71c2768433048990c882d058c8b2f62bc17f46e6
      
https://github.com/qemu/qemu/commit/71c2768433048990c882d058c8b2f62bc17f46e6
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  virt: Lift the maximum RAM limit from 30GB to 255GB

The virt board restricts guests to only 30GB of RAM. This is a
hangover from the vexpress-a15 board, and there's no inherent reason
for it. 30GB is smaller than you might reasonably want to provision
a VM for on a beefy server machine. Raise the limit to 255GB.

We choose 255GB because the available space we currently have
below the 1TB boundary is up to the 512GB mark, but we don't
want to paint ourselves into a corner by assigning it all to
RAM. So we make half of it available for RAM, with the 256GB..512GB
range available for future non-RAM expansion purposes.

If we need to provide more RAM to VMs in the future then we need to:
 * allocate a second bank of RAM starting at 2TB and working up
 * fix the DT and ACPI table generation code in QEMU to correctly
   report two split lumps of RAM to the guest
 * fix KVM in the host kernel to allow guests with >40 bit address spaces

The last of these is obviously the trickiest, but it seems
reasonable to assume that anybody configuring a VM with a quarter
of a terabyte of RAM will be doing it on a host with more than a
terabyte of physical address space.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Christoffer Dall <address@hidden>
Tested-by: Wei Huang <address@hidden>
Message-id: address@hidden


  Commit: 0719e71e5297f68b6b4500aa74e1b49d59806342
      
https://github.com/qemu/qemu/commit/0719e71e5297f68b6b4500aa74e1b49d59806342
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/sd/sd.c

  Log Message:
  -----------
  sd.c: Handle NULL block backend in sd_get_inserted()

The sd.c SD card emulation code can be in a state where the
SDState BlockBackend pointer is NULL; this is treated as
"card not present". Add a missing check to sd_get_inserted()
so that we don't segfault in this situation.

(This could be provoked by the guest writing to the SDHCI
register to do a reset on a xilinx-zynq-a9 board; it will
also happen at startup when sdhci implements its DeviceClass
reset method.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Alistair Francis <address@hidden>
Message-id: address@hidden


  Commit: 8b41c30525a529ee69505909908a704fc134d21b
      
https://github.com/qemu/qemu/commit/8b41c30525a529ee69505909908a704fc134d21b
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/sd/sdhci.c

  Log Message:
  -----------
  sdhci: Implement DeviceClass reset

The sdhci device was missing a DeviceClass reset method;
implement it. Poweron reset looks the same as reset commanded
by the guest via the device registers, apart from modelling of
the rpi 'pending insert interrupt on powerup' quirk.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Andrew Baumann <address@hidden>
Message-id: address@hidden


  Commit: 83ec1923cdc794de7a782e99e26daa1d91ca14e9
      
https://github.com/qemu/qemu/commit/83ec1923cdc794de7a782e99e26daa1d91ca14e9
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/virt.c
    M include/hw/arm/virt.h

  Log Message:
  -----------
  hw/arm/virt: Provide a secure-only RAM if booting in Secure mode

If we're booting in Secure mode, provide a secure-only RAM
(just 16MB) so that secure firmware has somewhere to run
from that won't be accessible to the Non-secure guest.

Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden


  Commit: 76151cacfe956248a25b38b5e8429465584f47bb
      
https://github.com/qemu/qemu/commit/76151cacfe956248a25b38b5e8429465584f47bb
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/core/loader.c
    M include/hw/loader.h

  Log Message:
  -----------
  loader: Add load_image_mr() to load ROM image to a MemoryRegion

Add a new function load_image_mr(), which behaves like
load_image_targphys() except that it loads the ROM image to
a specified MemoryRegion rather than to a specified physical
address. This is useful when a ROM blob needs to be loaded
to a particular flash or ROM device but the address of that
device in the machine's address space is not known. (For
instance, ROMs in devices, or ROMs which might exist in
a different address space to the system address space.)

Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Reviewed-by: Paolo Bonzini <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>


  Commit: 16f4a8dc5c671eb176121d576ef28d1e49b84bfe
      
https://github.com/qemu/qemu/commit/16f4a8dc5c671eb176121d576ef28d1e49b84bfe
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  hw/arm/virt: Load bios image to MemoryRegion, not physaddr

If we're loading a BIOS image into the first flash device,
load it into the flash's memory region specifically, not
into the physical address where the flash resides. This will
make a difference when the flash might be in the Secure
address space rather than the Nonsecure one.

Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden


  Commit: 738a5d9fbbd242b4a16cd1837fd3ded610ef1b43
      
https://github.com/qemu/qemu/commit/738a5d9fbbd242b4a16cd1837fd3ded610ef1b43
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  hw/arm/virt: Make first flash device Secure-only if booting secure

If the virt board is started with the 'secure' property set to
request a Secure setup, then make the first flash device be
visible only to the Secure world.

This is a breaking change, but I don't expect it to be noticed
by anybody, because running TZ-aware guests isn't common and
those guests are generally going to be booting from the flash
and implicitly expecting their Non-secure guests to not touch it.

Signed-off-by: Peter Maydell <address@hidden>
Message-id: address@hidden


  Commit: 4824a61a6dc1ce768be5c0a81f16224618104a63
      
https://github.com/qemu/qemu/commit/4824a61a6dc1ce768be5c0a81f16224618104a63
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  hw/arm/virt: Assume EL3 boot rom will handle PSCI if one is provided

If the user passes us an EL3 boot rom, then it is going to want to
implement the PSCI interface itself. In this case, disable QEMU's
internal PSCI implementation so it does not get in the way, and
instead start all CPUs in an SMP configuration at once (the boot
rom will catch them all and pen up the secondaries until needed).
The boot rom code is also responsible for editing the device tree
to include any necessary information about its own PSCI implementation
before eventually passing it to a NonSecure guest.

(This "start all CPUs at once" approach is what both ARM Trusted
Firmware and UEFI expect, since it is what the ARM Foundation Model
does; the other approach would be to provide some emulated hardware
for "start the secondaries" but this is simplest.)

This is a compatibility break, but I don't believe that anybody
was using a secure boot ROM with an SMP configuration. Such a setup
would be somewhat broken since there was nothing preventing nonsecure
guest code from calling the QEMU PSCI function to start up a secondary
core in a way that completely bypassed the secure world.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Message-id: address@hidden


  Commit: eab713941ab83c6d30739e430357e817bf81dad1
      
https://github.com/qemu/qemu/commit/eab713941ab83c6d30739e430357e817bf81dad1
  Author: Andrew Baumann <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/misc/bcm2835_mbox.c
    M hw/misc/bcm2835_property.c

  Log Message:
  -----------
  bcm2835_mbox/property: replace ldl_phys/stl_phys with endian-specific accesses

PMM pointed out that ldl_phys and stl_phys are dependent on the CPU's
endianness, whereas device model code should be independent of
it. This changes the relevant Raspberry Pi devices to explicitly call
the little-endian variants.

Signed-off-by: Andrew Baumann <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: a0e1e6d705b44c3e71621fbf137bb3faf1719b33
      
https://github.com/qemu/qemu/commit/a0e1e6d705b44c3e71621fbf137bb3faf1719b33
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M linux-user/signal.c

  Log Message:
  -----------
  linux-user: arm: fix coding style for some linux-user signal functions

Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 49017bd8b4395ba380c45c2fc41f4353fc2f0f06
      
https://github.com/qemu/qemu/commit/49017bd8b4395ba380c45c2fc41f4353fc2f0f06
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M linux-user/main.c

  Log Message:
  -----------
  linux-user: arm: pass env to get_user_code_*

This matches the idiom used by get_user_data_* later in the series,
and will help when bswap_code will be replaced by SCTLR.B.

Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: f9fd40ebe4f55e0048e002925b8d65e66d56e7a7
      
https://github.com/qemu/qemu/commit/f9fd40ebe4f55e0048e002925b8d65e66d56e7a7
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M linux-user/main.c
    M target-arm/arm_ldst.h
    M target-arm/cpu.c
    M target-arm/cpu.h
    M target-arm/helper.c
    M target-arm/translate-a64.c
    M target-arm/translate.c
    M target-arm/translate.h

  Log Message:
  -----------
  target-arm: implement SCTLR.B, drop bswap_code

bswap_code is a CPU property of sorts ("is the iside endianness the
opposite way round to TARGET_WORDS_BIGENDIAN?") but it is not the
actual CPU state involved here which is SCTLR.B (set for BE32
binaries, clear for BE8).

Replace bswap_code with SCTLR.B, and pass that to arm_ld*_code.
The next patches will make data fetches honor both SCTLR.B and
CPSR.E appropriately.

Signed-off-by: Paolo Bonzini <address@hidden>
[PC changes:
 * rebased on master (Jan 2016)
 * s/TARGET_USER_ONLY/CONFIG_USER_ONLY
 * Use bswap_code() for disas_set_info() instead of raw sctlr_b
]
Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: ed50ff7875d61a75517c92deb0444d73fbbca878
      
https://github.com/qemu/qemu/commit/ed50ff7875d61a75517c92deb0444d73fbbca878
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/cpu.c
    M target-arm/cpu.h

  Log Message:
  -----------
  target-arm: cpu: Move cpu_is_big_endian to header

There is a CPU data endianness test that is used to drive the
virtio_big_endian test.

Move this up to the header so it can be more generally used for endian
tests. The KVM specific cpu_syncronize_state call is left behind in the
virtio specific function.

Rename it arm_cpu-data_is_big_endian() to more accurately capture that
this is for data accesses only.

Reviewed-by: Alistair Francis <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: b2e62d9a7b9a2eb10e451a57813bad168376e122
      
https://github.com/qemu/qemu/commit/b2e62d9a7b9a2eb10e451a57813bad168376e122
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/cpu.h

  Log Message:
  -----------
  arm: cpu: handle BE32 user-mode as BE

endian with address manipulations on subword accesses (to give the
illusion of BE). But user-mode cannot tell the difference and is
already implemented as straight BE. So handle the difference in the
endianess query, where USER mode is BE and system is not.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 9c5a7460389e92d230362a983b5a4158d6a1cefe
      
https://github.com/qemu/qemu/commit/9c5a7460389e92d230362a983b5a4158d6a1cefe
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M linux-user/main.c

  Log Message:
  -----------
  linux-user: arm: set CPSR.E/SCTLR.E0E correctly for BE mode

If doing big-endian linux-user mode, set both the CPSR.E and SCTLR.E0E
bits. This sets big-endian mode for data accesses.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: c3ae85fc8f36b64fb73038214e4359f1e470d169
      
https://github.com/qemu/qemu/commit/c3ae85fc8f36b64fb73038214e4359f1e470d169
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M linux-user/main.c
    M target-arm/cpu.h

  Log Message:
  -----------
  linux-user: arm: handle CPSR.E correctly in strex emulation

Now that CPSR.E is set correctly, prepare for when setend will be able
to change it; bswap data in and out of strex manually by comparing
SCTLR.B, CPSR.E and TARGET_WORDS_BIGENDIAN (we do not have the luxury
of using TCGMemOps).

Signed-off-by: Paolo Bonzini <address@hidden>
[ PC changes:
  * Moved SCTLR/CPSR logic to arm_cpu_data_is_big_endian
]
Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 73462dddf670c32c45c8ea359658092b0365b2d4
      
https://github.com/qemu/qemu/commit/73462dddf670c32c45c8ea359658092b0365b2d4
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/helper.c

  Log Message:
  -----------
  target-arm: implement SCTLR.EE

Implement SCTLR.EE bit which controls data endianess for exceptions
and page table translations. SCTLR.EE is mirrored to the CPSR.E bit
on exception entry.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 12dcc3217dc86b7dccee293b2f6e3fa4f7b014ae
      
https://github.com/qemu/qemu/commit/12dcc3217dc86b7dccee293b2f6e3fa4f7b014ae
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: pass DisasContext to gen_aa32_ld*/st*

We'll need the DisasContext in the next patch to retrieve the
desired endianness, so pass it as a whole to gen_aa32_ld*/st*.

Unfortunately we cannot let those functions call get_mem_index,
because of user-mode load/store instructions.

Signed-off-by: Paolo Bonzini <address@hidden>
[ PC changes:
 * Fix long lines
]
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: dacf0a2ff7d39ab12bd90f2f5496a3889facd54a
      
https://github.com/qemu/qemu/commit/dacf0a2ff7d39ab12bd90f2f5496a3889facd54a
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/translate-a64.c
    M target-arm/translate.c
    M target-arm/translate.h

  Log Message:
  -----------
  target-arm: introduce disas flag for endianness

Introduce a disas flag for setting the CPU data endianness. This allows
control of the endianness from the CPU state rather than hard-coding it
to TARGET_WORDS_BIGENDIAN.

Signed-off-by: Paolo Bonzini <address@hidden>
[ PC changes:
  * Split off as new patch from original:
  "target-arm: introduce tbflag for CPSR.E"
  * Wrote commit message from scratch
]
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: aa6489da4e297fb3ffcbc09b50afd700395b6386
      
https://github.com/qemu/qemu/commit/aa6489da4e297fb3ffcbc09b50afd700395b6386
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/translate-a64.c

  Log Message:
  -----------
  target-arm: a64: Add endianness support

Set the dc->mo_endianness flag for AA64 and use it in all ldst ops.

Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 91cca2cda9823b1e7a049cb308a05104b5076cba
      
https://github.com/qemu/qemu/commit/91cca2cda9823b1e7a049cb308a05104b5076cba
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/cpu.h
    M target-arm/translate-a64.c
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: introduce tbflag for endianness

Introduce a tbflags for endianness, set based upon the CPUs current
endianness. This in turn propagates through to the disas endianness
flag.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 9886ecdf31165de2d4b8bccc1a220bd6ac8bc192
      
https://github.com/qemu/qemu/commit/9886ecdf31165de2d4b8bccc1a220bd6ac8bc192
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/helper.h
    M target-arm/op_helper.c
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: implement setend

Since this is not a high-performance path, just use a helper to
flip the E bit and force a lookup in the hash table since the
flags have changed.

Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: e334bd3190f6c4ca12f1d40d316dc471c70009ab
      
https://github.com/qemu/qemu/commit/e334bd3190f6c4ca12f1d40d316dc471c70009ab
  Author: Paolo Bonzini <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/cpu.h
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: implement BE32 mode in system emulation

System emulation only has a little-endian target; BE32 mode
is implemented by adjusting the low bits of the address
for every byte and halfword load and store.  64-bit accesses
flip the low and high words.

Signed-off-by: Paolo Bonzini <address@hidden>
[PC changes:
  * rebased against master (Jan 2016)
]
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 04ae712a9f31fe21eacfcaeb689c7e6d0a7e251c
      
https://github.com/qemu/qemu/commit/04ae712a9f31fe21eacfcaeb689c7e6d0a7e251c
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/core/loader.c
    M include/hw/loader.h

  Log Message:
  -----------
  loader: add API to load elf header

Add an API to load an elf header header from a file. Populates a
buffer with the header contents, as well as a boolean for whether the
elf is 64b or not. Both arguments are optional.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
[PMM: Fix typo in comment]
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 140b7ce5fff6fc660b2484dfd9d33ed2e42ec5a9
      
https://github.com/qemu/qemu/commit/140b7ce5fff6fc660b2484dfd9d33ed2e42ec5a9
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M include/hw/loader.h

  Log Message:
  -----------
  loader: load_elf(): Add doc comment

Document the usage of load_elf() for clarity on current features.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 7ef295ea5b412cbaf82f719ccd49efb51296e841
      
https://github.com/qemu/qemu/commit/7ef295ea5b412cbaf82f719ccd49efb51296e841
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/alpha/dp264.c
    M hw/arm/armv7m.c
    M hw/arm/boot.c
    M hw/core/loader.c
    M hw/cris/boot.c
    M hw/i386/multiboot.c
    M hw/lm32/lm32_boards.c
    M hw/lm32/milkymist.c
    M hw/m68k/an5206.c
    M hw/m68k/dummy_m68k.c
    M hw/m68k/mcf5208.c
    M hw/microblaze/boot.c
    M hw/mips/mips_fulong2e.c
    M hw/mips/mips_malta.c
    M hw/mips/mips_mipssim.c
    M hw/mips/mips_r4k.c
    M hw/moxie/moxiesim.c
    M hw/openrisc/openrisc_sim.c
    M hw/pci-host/prep.c
    M hw/ppc/e500.c
    M hw/ppc/mac_newworld.c
    M hw/ppc/mac_oldworld.c
    M hw/ppc/ppc440_bamboo.c
    M hw/ppc/spapr.c
    M hw/ppc/virtex_ml507.c
    M hw/s390x/ipl.c
    M hw/sparc/leon3.c
    M hw/sparc/sun4m.c
    M hw/sparc64/sun4u.c
    M hw/tricore/tricore_testboard.c
    M hw/xtensa/sim.c
    M hw/xtensa/xtfpga.c
    M include/hw/elf_ops.h
    M include/hw/loader.h

  Log Message:
  -----------
  loader: Add data swap option to load-elf

Some CPUs are of an opposite data-endianness to other components in the
system. Sometimes elfs have the data sections layed out with this CPU
data-endianness accounting for when loaded via the CPU, so byte swaps
(relative to other system components) will occur.

The leading example, is ARM's BE32 mode, which is is basically LE with
address manipulation on half-word and byte accesses to access the
hw/byte reversed address. This means that word data is invariant
across LE and BE32. This also means that instructions are still LE.
The expectation is that the elf will be loaded via the CPU in this
endianness scheme, which means the data in the elf is reversed at
compile time.

As QEMU loads via the system memory directly, rather than the CPU, we
need a mechanism to reverse elf data endianness to implement this
possibility.

Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Crosthwaite <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 9776f636455b6f0d9c14dce112242ed653f954b4
      
https://github.com/qemu/qemu/commit/9776f636455b6f0d9c14dce112242ed653f954b4
  Author: Peter Crosthwaite <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/arm/boot.c
    M include/hw/arm/arm.h

  Log Message:
  -----------
  arm: boot: Support big-endian elfs

Support ARM big-endian ELF files in system-mode emulation. When loading
an elf, determine the endianness mode expected by the elf, and set the
relevant CPU state accordingly.

With this, big-endian modes are now fully supported via system-mode LE,
so there is no need to restrict the elf loading to the TARGET
endianness so the ifdeffery on TARGET_WORDS_BIGENDIAN goes away.

Signed-off-by: Peter Crosthwaite <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
[PMM: fix typo in comments]
Signed-off-by: Peter Maydell <address@hidden>


  Commit: a55c910e0b18aee2f67b129f0046b53cb8c42f21
      
https://github.com/qemu/qemu/commit/a55c910e0b18aee2f67b129f0046b53cb8c42f21
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/cpu/a15mpcore.c
    M hw/intc/arm_gic.c
    M hw/intc/arm_gic_common.c

  Log Message:
  -----------
  hw/intc/arm_gic.c: Implement GICv2 GICC_DIR

The GICv2 introduces a new CPU interface register GICC_DIR, which
allows an OS to split the "priority drop" and "deactivate interrupt"
parts of interrupt completion. Implement this register.
(Note that the register is at offset 0x1000 in the CPU interface,
which means it is on a different 4K page from all the other registers.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Sergey Fedorov <address@hidden>
Message-id: address@hidden


  Commit: ba63cf47a93041137a94e86b7d0cd87fc896949b
      
https://github.com/qemu/qemu/commit/ba63cf47a93041137a94e86b7d0cd87fc896949b
  Author: Ralf-Philipp Weinmann <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M target-arm/translate.c

  Log Message:
  -----------
  target-arm: Only trap SRS from S-EL1 if specified mode is MON

Commit cbc0326b6fb9 caused SRS instructions executed from Secure
EL1 to trap to EL3 even if the specified mode was not monitor mode.

According to the ARMv8 Architecture reference manual [F6.1.203], ALL
of the following conditions need to be met for SRS to trap to EL3:
* It is executed at Secure PL1.
* The specified mode is monitor mode.
* EL3 is using AArch64.

Correct the condition governing the trap to EL3 to check the
specified mode.

Signed-off-by: Ralf-Philipp Weinmann <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
[PMM: tweaked comment text to read 'specified mode'; edited
 commit message]
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 3c0f12df65da872d5fbccae469f2cb21ed1c03b7
      
https://github.com/qemu/qemu/commit/3c0f12df65da872d5fbccae469f2cb21ed1c03b7
  Author: Peter Maydell <address@hidden>
  Date:   2016-03-04 (Fri, 04 Mar 2016)

  Changed paths:
    M hw/alpha/dp264.c
    M hw/arm/armv7m.c
    M hw/arm/boot.c
    M hw/arm/virt.c
    M hw/core/loader.c
    M hw/cpu/a15mpcore.c
    M hw/cris/boot.c
    M hw/i386/multiboot.c
    M hw/intc/arm_gic.c
    M hw/intc/arm_gic_common.c
    M hw/lm32/lm32_boards.c
    M hw/lm32/milkymist.c
    M hw/m68k/an5206.c
    M hw/m68k/dummy_m68k.c
    M hw/m68k/mcf5208.c
    M hw/microblaze/boot.c
    M hw/mips/mips_fulong2e.c
    M hw/mips/mips_malta.c
    M hw/mips/mips_mipssim.c
    M hw/mips/mips_r4k.c
    M hw/misc/bcm2835_mbox.c
    M hw/misc/bcm2835_property.c
    M hw/moxie/moxiesim.c
    M hw/openrisc/openrisc_sim.c
    M hw/pci-host/prep.c
    M hw/ppc/e500.c
    M hw/ppc/mac_newworld.c
    M hw/ppc/mac_oldworld.c
    M hw/ppc/ppc440_bamboo.c
    M hw/ppc/spapr.c
    M hw/ppc/virtex_ml507.c
    M hw/s390x/ipl.c
    M hw/sd/sd.c
    M hw/sd/sdhci.c
    M hw/sparc/leon3.c
    M hw/sparc/sun4m.c
    M hw/sparc64/sun4u.c
    M hw/tricore/tricore_testboard.c
    M hw/xtensa/sim.c
    M hw/xtensa/xtfpga.c
    M include/hw/arm/arm.h
    M include/hw/arm/virt.h
    M include/hw/elf_ops.h
    M include/hw/loader.h
    M linux-user/main.c
    M linux-user/signal.c
    M target-arm/arm_ldst.h
    M target-arm/cpu.c
    M target-arm/cpu.h
    M target-arm/helper.c
    M target-arm/helper.h
    M target-arm/op_helper.c
    M target-arm/translate-a64.c
    M target-arm/translate.c
    M target-arm/translate.h

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20160304' 
into staging

target-arm queue:
 * Correct handling of writes to CPSR from gdbstub in user mode
 * virt: lift maximum RAM limit to 255GB
 * sdhci: implement reset
 * virt: if booting in Secure mode, provide secure-only RAM, make first
   flash device secure-only, and assume the EL3 boot rom will handle PSCI
 * bcm2835: use explicit endianness accessors rather than ldl/stl_phys
 * support big-endian in system mode for ARM
 * implement SETEND instruction
 * arm_gic: implement the GICv2 GICC_DIR register
 * fix SRS bug: only trap from S-EL1 to EL3 if specified mode is Mon

# gpg: Signature made Fri 04 Mar 2016 11:38:53 GMT using RSA key ID 14360CDE
# gpg: Good signature from "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"

* remotes/pmaydell/tags/pull-target-arm-20160304: (30 commits)
  target-arm: Only trap SRS from S-EL1 if specified mode is MON
  hw/intc/arm_gic.c: Implement GICv2 GICC_DIR
  arm: boot: Support big-endian elfs
  loader: Add data swap option to load-elf
  loader: load_elf(): Add doc comment
  loader: add API to load elf header
  target-arm: implement BE32 mode in system emulation
  target-arm: implement setend
  target-arm: introduce tbflag for endianness
  target-arm: a64: Add endianness support
  target-arm: introduce disas flag for endianness
  target-arm: pass DisasContext to gen_aa32_ld*/st*
  target-arm: implement SCTLR.EE
  linux-user: arm: handle CPSR.E correctly in strex emulation
  linux-user: arm: set CPSR.E/SCTLR.E0E correctly for BE mode
  arm: cpu: handle BE32 user-mode as BE
  target-arm: cpu: Move cpu_is_big_endian to header
  target-arm: implement SCTLR.B, drop bswap_code
  linux-user: arm: pass env to get_user_code_*
  linux-user: arm: fix coding style for some linux-user signal functions
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/2d3b7c0164e1...3c0f12df65da