[Qemu-devel] [PULL 00/18] target-arm queue

[Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

Here's the ARM queue. I know I have a pile of backed-up code
review to do, but I wanted to get these patches out rather
than accumulating a fifty-patch queue...

This is v2: only change is to drop the two smbios patches.

thanks
-- PMM


The following changes since commit 34a4450434f1a5daee06fca223afcbb9c8f1ee24:

  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20150824' into staging (2015-08-25 13:34:57 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20150825-1

for you to fetch changes up to cea66e91212164e02ad1d245c2371f7e8eb59e7f:

  target-arm: Implement AArch64 TLBI operations on IPAs (2015-08-25 16:18:33 +0100)

----------------------------------------------------------------
target-arm queue:
 * add missing EL2/EL3 TLBI operations
 * add missing EL2/EL3 ATS operations
 * add missing EL2/EL3 registers
 * update Xilinx MAINTAINERS info
 * Xilinx: connect the four OCM banks

----------------------------------------------------------------
Alistair Francis (3):
      xlnx-zynqmp: Connect the four OCM banks
      MAINTAINERS: Update Xilinx Maintainership
      MAINTAINERS: Add ZynqMP to MAINTAINERS file

Peter Maydell (15):
      target-arm: Add missing MAIR_EL3 and TPIDR_EL3 registers
      target-arm: Implement missing AMAIR registers
      target-arm: Implement missing AFSR registers
      target-arm: Implement missing ACTLR registers
      target-arm: there is no TTBR1 for 32-bit EL2 stage 1 translations
      target-arm: Wire up AArch64 EL2 and EL3 address translation ops
      target-arm: Add CP_ACCESS_TRAP_UNCATEGORIZED_EL2, 3
      target-arm: Enable the AArch32 ATS12NSO ops
      target-arm: Implement AArch32 ATS1H* operations
      cputlb: Add functions for flushing TLB for a single MMU index
      target-arm: Move TLBI ALLE1/ALLE1IS definitions into numeric order
      target-arm: Restrict AArch64 TLB flushes to the MMU indexes they must touch
      target-arm: Implement missing EL2 TLBI operations
      target-arm: Implement missing EL3 TLB invalidate operations
      target-arm: Implement AArch64 TLBI operations on IPAs

 MAINTAINERS                  |  27 ++-
 cputlb.c                     |  97 +++++++++
 hw/arm/xlnx-zynqmp.c         |  15 ++
 include/exec/exec-all.h      |  47 +++++
 include/hw/arm/xlnx-zynqmp.h |   6 +
 target-arm/cpu.h             |   3 +
 target-arm/helper.c          | 489 ++++++++++++++++++++++++++++++++++++++-----
 target-arm/op_helper.c       |   8 +
 8 files changed, 629 insertions(+), 63 deletions(-)

Re: [Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

On 25 August 2015 at 16:23, Peter Maydell <peter.maydell@linaro.org> wrote:
> Here's the ARM queue. I know I have a pile of backed-up code
> review to do, but I wanted to get these patches out rather
> than accumulating a fifty-patch queue...
>
> This is v2: only change is to drop the two smbios patches.

v2 applied to master.

-- PMM

[Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

Collection of patches before softfreeze:
 * some minor bug fixes
 * ASPEED SCU
 * the m25p80 patchset

The following changes since commit aa8151b7df6b1c521b46583badfec504715018c5:

  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160627' into staging (2016-06-27 12:54:54 +0100)

are available in the git repository at:


  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20160627

for you to fetch changes up to 3830c7a460b8252dc975f8115fdaed8c562d2d75:

  m25p80: Fix WINBOND fast read command handling (2016-06-27 15:37:34 +0100)

----------------------------------------------------------------
target-arm queue:
 * arm_gicv3: add missing 'break' statements
 * cadence_uart: protect against transmit errors
 * cadence_gem: avoid infinite loops with misconfigured buffer
 * cadence_gem: set the 'last' bit when 'wrap' is set
 * reenable tmp105 test case
 * palmetto-bmc: add ASPEED system control unit model
 * m25p80: add new 512Mbit and 1Gbit devices

----------------------------------------------------------------
Alistair Francis (3):
      cadence_uart: Protect against transmit errors
      cadence_gem: Avoid infinite loops with a misconfigured buffer
      cadence_gem: Set the last bit when wrap is set

Andrew Jeffery (3):
      hw/misc: Add a model for the ASPEED System Control Unit
      ast2400: Integrate the SCU model and set silicon revision
      palmetto-bmc: Configure the SCU's hardware strapping register

Marcin Krzeminski (10):
      m25p80: Replace JEDEC ID masking with function.
      m25p80: Make a table for JEDEC ID.
      m25p80: Allow more than four banks.
      m25p80: Introduce COLLECTING_VAR_LEN_DATA state.
      m25p80: Add additional flash commands:
      m25p80: Introduce quad and equad modes.
      m25p80: Introduce configuration registers.
      m25p80: Fast read commands family changes.
      m25p80: New flash devices.
      m25p80: Fix WINBOND fast read command handling

Shannon Zhao (1):
      hw/intc/arm_gicv3: Add missing break

Thomas Huth (1):
      arm: Re-enable tmp105 test

 hw/arm/ast2400.c             |  21 +++
 hw/arm/palmetto-bmc.c        |   2 +
 hw/block/m25p80.c            | 398 +++++++++++++++++++++++++++++++++++--------
 hw/char/cadence_uart.c       |   7 +-
 hw/intc/arm_gicv3_cpuif.c    |   2 +
 hw/misc/Makefile.objs        |   1 +
 hw/misc/aspeed_scu.c         | 283 ++++++++++++++++++++++++++++++
 hw/misc/trace-events         |   3 +
 hw/net/cadence_gem.c         |  13 ++
 include/hw/arm/ast2400.h     |   2 +
 include/hw/misc/aspeed_scu.h |  34 ++++
 tests/Makefile.include       |   2 +-
 12 files changed, 698 insertions(+), 70 deletions(-)
 create mode 100644 hw/misc/aspeed_scu.c
 create mode 100644 include/hw/misc/aspeed_scu.h

Re: [Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

On 27 June 2016 at 15:44, Peter Maydell <peter.maydell@linaro.org> wrote:
> Collection of patches before softfreeze:
>  * some minor bug fixes
>  * ASPEED SCU
>  * the m25p80 patchset
>
> The following changes since commit aa8151b7df6b1c521b46583badfec504715018c5:
>
>   Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160627' into staging (2016-06-27 12:54:54 +0100)
>
> are available in the git repository at:
>
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20160627
>
> for you to fetch changes up to 3830c7a460b8252dc975f8115fdaed8c562d2d75:
>
>   m25p80: Fix WINBOND fast read command handling (2016-06-27 15:37:34 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * arm_gicv3: add missing 'break' statements
>  * cadence_uart: protect against transmit errors
>  * cadence_gem: avoid infinite loops with misconfigured buffer
>  * cadence_gem: set the 'last' bit when 'wrap' is set
>  * reenable tmp105 test case
>  * palmetto-bmc: add ASPEED system control unit model
>  * m25p80: add new 512Mbit and 1Gbit devices

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

ARM queue for 2.10 soft freeze...

thanks
-- PMM

The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:

  Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170717

for you to fetch changes up to e5a6a6e64e82a132cebef023d867085b0a2993d7:

  MAINTAINERS: Add entries for MPS2 board (2017-07-17 13:36:09 +0100)

----------------------------------------------------------------
target-arm queue:
 * new model of the ARM MPS2/MPS2+ FPGA based development board
 * clean up DISAS_* exit conditions and fix various regressions
   since commits e75449a346 8a6b28c7b5 (in particular including
   ones which broke OP-TEE guests)
 * make Cortex-M3 and M4 correctly default to 8 PMSA regions

----------------------------------------------------------------
Alex Bennée (6):
      include/exec/exec-all: document common exit conditions
      target/arm/translate: make DISAS_UPDATE match declared semantics
      target/arm/translate.h: expand comment on DISAS_EXIT
      target/arm/translate: ensure gen_goto_tb sets exit flags
      target/arm: use gen_goto_tb for ISB handling
      target/arm: use DISAS_EXIT for eret handling

Peter Maydell (12):
      qdev-properties.h: Explicitly set the default value for arraylen properties
      qdev: support properties which don't set a default value
      target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions
      hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models
      hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART
      hw/arm/mps2: Add UARTs
      hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device
      hw/arm/mps2: Add timers
      hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller
      hw/arm/mps2: Add SCC
      hw/arm/mps2: Add ethernet
      MAINTAINERS: Add entries for MPS2 board

 hw/arm/Makefile.objs               |   1 +
 hw/char/Makefile.objs              |   1 +
 hw/misc/Makefile.objs              |   1 +
 hw/timer/Makefile.objs             |   1 +
 include/exec/exec-all.h            |  29 ++-
 include/hw/char/cmsdk-apb-uart.h   |  78 +++++++
 include/hw/misc/mps2-scc.h         |  43 ++++
 include/hw/qdev-core.h             |  10 +
 include/hw/qdev-properties.h       |  21 ++
 include/hw/timer/cmsdk-apb-timer.h |  59 ++++++
 target/arm/translate.h             |   5 +-
 hw/arm/mps2.c                      | 385 +++++++++++++++++++++++++++++++++++
 hw/char/cmsdk-apb-uart.c           | 403 +++++++++++++++++++++++++++++++++++++
 hw/core/qdev.c                     |   2 +-
 hw/misc/mps2-scc.c                 | 310 ++++++++++++++++++++++++++++
 hw/timer/cmsdk-apb-timer.c         | 253 +++++++++++++++++++++++
 target/arm/cpu.c                   |  12 +-
 target/arm/translate-a64.c         |  19 +-
 target/arm/translate.c             |  22 +-
 MAINTAINERS                        |  14 +-
 default-configs/arm-softmmu.mak    |   6 +
 hw/char/trace-events               |   9 +
 hw/misc/trace-events               |   8 +
 hw/timer/trace-events              |   5 +
 24 files changed, 1673 insertions(+), 24 deletions(-)
 create mode 100644 include/hw/char/cmsdk-apb-uart.h
 create mode 100644 include/hw/misc/mps2-scc.h
 create mode 100644 include/hw/timer/cmsdk-apb-timer.h
 create mode 100644 hw/arm/mps2.c
 create mode 100644 hw/char/cmsdk-apb-uart.c
 create mode 100644 hw/misc/mps2-scc.c
 create mode 100644 hw/timer/cmsdk-apb-timer.c

Re: [Qemu-devel] [PULL 00/18] target-arm queue

[no-reply]

Hi,

This series seems to have some coding style problems. See output below for
more information:

Subject: [Qemu-devel] [PULL 00/18] target-arm queue
Message-id: 1500295494-8991-1-git-send-email-peter.maydell@linaro.org
Type: series

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
From https://github.com/patchew-project/qemu
 - [tag update]      patchew/20170717110936.23314-1-dgilbert@redhat.com -> patchew/20170717110936.23314-1-dgilbert@redhat.com
Switched to a new branch 'test'
f4eface MAINTAINERS: Add entries for MPS2 board
f1fecfb hw/arm/mps2: Add ethernet
5cc8e71 hw/arm/mps2: Add SCC
5404d5a hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller
3b85601 hw/arm/mps2: Add timers
8784008 hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device
d7ae3d4 hw/arm/mps2: Add UARTs
41c0f2d hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART
c7eb8eb hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models
bdd7af5 target/arm: use DISAS_EXIT for eret handling
ec55bc9 target/arm: use gen_goto_tb for ISB handling
dabdd10 target/arm/translate: ensure gen_goto_tb sets exit flags
759a7d2 target/arm/translate.h: expand comment on DISAS_EXIT
538a900 target/arm/translate: make DISAS_UPDATE match declared semantics
c4d68d9 include/exec/exec-all: document common exit conditions
2d96cb8 target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions
0793ffd qdev: support properties which don't set a default value
90ea21c qdev-properties.h: Explicitly set the default value for arraylen properties

=== OUTPUT BEGIN ===
Checking PATCH 1/18: qdev-properties.h: Explicitly set the default value for arraylen properties...
Checking PATCH 2/18: qdev: support properties which don't set a default value...
Checking PATCH 3/18: target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions...
Checking PATCH 4/18: include/exec/exec-all: document common exit conditions...
Checking PATCH 5/18: target/arm/translate: make DISAS_UPDATE match declared semantics...
Checking PATCH 6/18: target/arm/translate.h: expand comment on DISAS_EXIT...
Checking PATCH 7/18: target/arm/translate: ensure gen_goto_tb sets exit flags...
Checking PATCH 8/18: target/arm: use gen_goto_tb for ISB handling...
Checking PATCH 9/18: target/arm: use DISAS_EXIT for eret handling...
Checking PATCH 10/18: hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models...
ERROR: line over 90 characters
#77: FILE: hw/arm/mps2.c:22:
+ *   https://developer.arm.com/products/system-design/development-boards/cortex-m-prototyping-system

total: 1 errors, 0 warnings, 281 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 11/18: hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART...
ERROR: line over 90 characters
#62: FILE: hw/char/cmsdk-apb-uart.c:15:
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit

total: 1 errors, 0 warnings, 508 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 12/18: hw/arm/mps2: Add UARTs...
Checking PATCH 13/18: hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device...
ERROR: line over 90 characters
#57: FILE: hw/timer/cmsdk-apb-timer.c:15:
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit

total: 1 errors, 0 warnings, 331 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 14/18: hw/arm/mps2: Add timers...
Checking PATCH 15/18: hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller...
ERROR: line over 90 characters
#70: FILE: hw/misc/mps2-scc.c:16:
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.100112_0100_03_en/index.html

ERROR: spaces required around that '*' (ctx:WxV)
#105: FILE: hw/misc/mps2-scc.c:51:
+static bool scc_cfg_write(MPS2SCC *s, unsigned function,
                                   ^

total: 2 errors, 0 warnings, 379 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Checking PATCH 16/18: hw/arm/mps2: Add SCC...
Checking PATCH 17/18: hw/arm/mps2: Add ethernet...
Checking PATCH 18/18: MAINTAINERS: Add entries for MPS2 board...
=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@freelists.org

Re: [Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

On 17 July 2017 at 13:44, Peter Maydell <peter.maydell@linaro.org> wrote:
> ARM queue for 2.10 soft freeze...
>
> thanks
> -- PMM
>
> The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:
>
>   Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)
>
> are available in the git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170717
>
> for you to fetch changes up to e5a6a6e64e82a132cebef023d867085b0a2993d7:
>
>   MAINTAINERS: Add entries for MPS2 board (2017-07-17 13:36:09 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * new model of the ARM MPS2/MPS2+ FPGA based development board
>  * clean up DISAS_* exit conditions and fix various regressions
>    since commits e75449a346 8a6b28c7b5 (in particular including
>    ones which broke OP-TEE guests)
>  * make Cortex-M3 and M4 correctly default to 8 PMSA regions
>

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

ARM queue: nothing particularly exciting, but 18 patches
is enough to send out.

thanks
-- PMM

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

  mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

----------------------------------------------------------------
Alistair Francis (5):
      xlnx-ep108: Rename to ZCU102
      xlnx-zcu102: Manually create the machines
      xlnx-zcu102: Add a machine level secure property
      xlnx-zcu102: Add a machine level virtualization property
      xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):
      AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):
      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
      target/arm: Get PRECISERR and IBUSERR the right way round
      nvic: Don't apply group priority mask to negative priorities
      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
      target/arm: Add and use defines for EXCRET constants
      target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
      mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):
      hw/pci-host/gpex: Set INTx index/gsi mapping
      hw/arm/virt: Set INTx/gsi mapping
      hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):
      target/arm: Avoid an extra temporary for store_exclusive

 hw/arm/Makefile.objs         |   2 +-
 include/hw/arm/xlnx-zynqmp.h |   2 +
 include/hw/pci-host/gpex.h   |   3 +
 target/arm/cpu.h             |  35 +++---
 target/arm/internals.h       |  20 ++++
 hw/arm/mps2.c                |   4 +-
 hw/arm/virt.c                |   1 +
 hw/arm/xlnx-ep108.c          | 139 -----------------------
 hw/arm/xlnx-zcu102.c         | 259 +++++++++++++++++++++++++++++++++++++++++++
 hw/arm/xlnx-zynqmp.c         |   3 +-
 hw/intc/armv7m_nvic.c        |  11 +-
 hw/pci-host/gpex.c           |  22 ++++
 target/arm/cpu.c             |   6 +
 target/arm/helper.c          |  43 ++++---
 target/arm/op_helper.c       |   2 +-
 target/arm/translate-a64.c   |  27 ++---
 16 files changed, 382 insertions(+), 197 deletions(-)
 delete mode 100644 hw/arm/xlnx-ep108.c
 create mode 100644 hw/arm/xlnx-zcu102.c

[Qemu-devel] [PULL 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2

[Peter Maydell]

Use a symbolic constant M_REG_NUM_BANKS for the array size for
registers which are banked by M profile security state, rather
than hardcoding lots of 2s.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 98b9b26..5a1f957 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -81,8 +81,11 @@
  * accessed via env->registerfield[env->v7m.secure] (whether the security
  * extension is implemented or not).
  */
-#define M_REG_NS 0
-#define M_REG_S 1
+enum {
+    M_REG_NS = 0,
+    M_REG_S = 1,
+    M_REG_NUM_BANKS = 2,
+};
 
 /* ARM-specific interrupt pending bits.  */
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
@@ -433,19 +436,19 @@ typedef struct CPUARMState {
         uint32_t other_sp;
         uint32_t other_ss_msp;
         uint32_t other_ss_psp;
-        uint32_t vecbase[2];
-        uint32_t basepri[2];
-        uint32_t control[2];
-        uint32_t ccr[2]; /* Configuration and Control */
-        uint32_t cfsr[2]; /* Configurable Fault Status */
+        uint32_t vecbase[M_REG_NUM_BANKS];
+        uint32_t basepri[M_REG_NUM_BANKS];
+        uint32_t control[M_REG_NUM_BANKS];
+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
-        uint32_t mmfar[2]; /* MemManage Fault Address */
+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
-        unsigned mpu_ctrl[2]; /* MPU_CTRL */
+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
-        uint32_t primask[2];
-        uint32_t faultmask[2];
+        uint32_t primask[M_REG_NUM_BANKS];
+        uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
     } v7m;
 
@@ -546,7 +549,7 @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
-        uint32_t rnr[2];
+        uint32_t rnr[M_REG_NUM_BANKS];
     } pmsav7;
 
     /* PMSAv8 MPU */
@@ -556,10 +559,10 @@ typedef struct CPUARMState {
          *  pmsav7.rnr (region number register)
          *  pmsav7_dregion (number of configured regions)
          */
-        uint32_t *rbar[2];
-        uint32_t *rlar[2];
-        uint32_t mair0[2];
-        uint32_t mair1[2];
+        uint32_t *rbar[M_REG_NUM_BANKS];
+        uint32_t *rlar[M_REG_NUM_BANKS];
+        uint32_t mair0[M_REG_NUM_BANKS];
+        uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
     void *nvic;
-- 
2.7.4

[Qemu-devel] [PULL 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit

[Peter Maydell]

For M profile we must clear the exclusive monitor on reset, exception
entry and exception exit.  We weren't doing any of these things; fix
this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/cpu.c       |  6 ++++++
 target/arm/helper.c    |  2 ++
 target/arm/op_helper.c |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 5d7f24c..a315354 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -444,6 +444,16 @@ void arm_handle_psci_call(ARMCPU *cpu);
 #endif
 
 /**
+ * arm_clear_exclusive: clear the exclusive monitor
+ * @env: CPU env
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+ */
+static inline void arm_clear_exclusive(CPUARMState *env)
+{
+    env->exclusive_addr = -1;
+}
+
+/**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index a1acce3..412e94c 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -235,6 +235,12 @@ static void arm_cpu_reset(CPUState *s)
         env->regs[15] = 0xFFFF0000;
     }
 
+    /* M profile requires that reset clears the exclusive monitor;
+     * A profile does not, but clearing it makes more sense than having it
+     * set with an exclusive access on address zero.
+     */
+    arm_clear_exclusive(env);
+
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 329e517..668e367 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6175,6 +6175,7 @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 
     armv7m_nvic_acknowledge_irq(env->nvic);
     switch_v7m_sp(env, 0);
+    arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
@@ -6354,6 +6355,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     }
 
     /* Otherwise, we have a successful exception exit. */
+    arm_clear_exclusive(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index d1bca46..6a60464 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -1022,7 +1022,7 @@ void HELPER(exception_return)(CPUARMState *env)
 
     aarch64_save_sp(env, cur_el);
 
-    env->exclusive_addr = -1;
+    arm_clear_exclusive(env);
 
     /* We must squash the PSTATE.SS bit to zero unless both of the
      * following hold:
-- 
2.7.4

[Qemu-devel] [PULL 03/18] target/arm: Get PRECISERR and IBUSERR the right way round

[Peter Maydell]

For a bus fault, the M profile BFSR bit PRECISERR means a bus
fault on a data access, and IBUSERR means a bus fault on an
instruction access. We had these the wrong way around; fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 668e367..1741e0d 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6430,15 +6430,15 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
-                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
-                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
                 break;
             case EXCP_DATA_ABORT:
                 env->v7m.cfsr[M_REG_NS] |=
-                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
                 env->v7m.bfar = env->exception.vaddress;
                 qemu_log_mask(CPU_LOG_INT,
-                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
                               env->v7m.bfar);
                 break;
             }
-- 
2.7.4

[Qemu-devel] [PULL 04/18] nvic: Don't apply group priority mask to negative priorities

[Peter Maydell]

In several places we were unconditionally applying the
nvic_gprio_mask() to a priority value. This is incorrect
if the priority is one of the fixed negative priority
values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be
considered as the same priority and so NMI wouldn't
correctly preempt HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 1fecfd6..d3e2056 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -152,8 +152,12 @@ static void nvic_recompute_state(NVICState *s)
         }
     }
 
+    if (active_prio > 0) {
+        active_prio &= nvic_gprio_mask(s);
+    }
+
     s->vectpending = pend_irq;
-    s->exception_prio = active_prio & nvic_gprio_mask(s);
+    s->exception_prio = active_prio;
 
     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
 }
@@ -329,7 +333,10 @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     assert(vec->enabled);
     assert(vec->pending);
 
-    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    pendgroupprio = vec->prio;
+    if (pendgroupprio > 0) {
+        pendgroupprio &= nvic_gprio_mask(s);
+    }
     assert(pendgroupprio < running);
 
     trace_nvic_acknowledge_irq(pending, vec->prio);
-- 
2.7.4

[Qemu-devel] [PULL 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()

[Peter Maydell]

In do_v7m_exception_exit(), there's no need to force the high 4
bits of 'type' to 1 when calling v7m_exception_taken(), because
we know that they're always 1 or we could not have got to this
"handle return to magic exception return address" code. Remove
the unnecessary ORs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 1741e0d..fdd5cc6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6306,7 +6306,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -6348,7 +6348,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

[Qemu-devel] [PULL 06/18] target/arm: Add and use defines for EXCRET constants

[Peter Maydell]

The exception-return magic values get some new bits in v8M, which
makes some bit definitions for them worthwhile.

We don't use the bit definitions for the switch on the low bits
which checks the return type for v7M, because this is defined
in the v7M ARM ARM as a set of valid values rather than via
per-bit checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 14 +++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index a315354..18be370 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -61,6 +61,16 @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
 
+/* Bit definitions for v7M exception return payload */
+FIELD(V7M_EXCRET, ES, 0, 1)
+FIELD(V7M_EXCRET, RES0, 1, 1)
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+FIELD(V7M_EXCRET, MODE, 3, 1)
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+FIELD(V7M_EXCRET, DCRS, 5, 1)
+FIELD(V7M_EXCRET, S, 6, 1)
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index fdd5cc6..a502e4e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6242,7 +6242,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                   " previous exception %d\n",
                   type, env->v7m.exception);
 
-    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
     }
@@ -6255,7 +6255,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & 1;
+            int es = type & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -6491,12 +6491,16 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = 0xfffffff1;
+    lr = R_V7M_EXCRET_RES1_MASK |
+        R_V7M_EXCRET_S_MASK |
+        R_V7M_EXCRET_DCRS_MASK |
+        R_V7M_EXCRET_FTYPE_MASK |
+        R_V7M_EXCRET_ES_MASK;
     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= 4;
+        lr |= R_V7M_EXCRET_SPSEL_MASK;
     }
     if (!arm_v7m_is_handler_mode(env)) {
-        lr |= 8;
+        lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-- 
2.7.4

[Qemu-devel] [PULL 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()

[Peter Maydell]

In the v7M and v8M ARM ARM, the magic exception return values are
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
constants to define bits within them. Rename the 'type' variable
which holds the exception return value in do_v7m_exception_exit()
to excret, making it clearer that it does hold an EXC_RETURN value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index a502e4e..4f41841 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6212,7 +6212,7 @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t type;
+    uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
     bool return_to_sp_process = false;
@@ -6233,18 +6233,19 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * the target value up between env->regs[15] and env->thumb in
      * gen_bx(). Reconstitute it.
      */
-    type = env->regs[15];
+    excret = env->regs[15];
     if (env->thumb) {
-        type |= 1;
+        excret |= 1;
     }
 
     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
                   " previous exception %d\n",
-                  type, env->v7m.exception);
+                  excret, env->v7m.exception);
 
-    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
+                      excret);
     }
 
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
@@ -6255,7 +6256,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & R_V7M_EXCRET_ES_MASK;
+            int es = excret & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -6283,7 +6284,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
-    switch (type & 0xf) {
+    switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
         break;
@@ -6306,7 +6307,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -6341,14 +6342,14 @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-     * exception return type specified then this is a UsageFault.
+     * exception return excret specified then this is a UsageFault.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
         /* Take an INVPC UsageFault by pushing the stack again. */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

[Qemu-devel] [PULL 08/18] xlnx-ep108: Rename to ZCU102

[Peter Maydell]

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is a early access development board. Now that silicon is in
production people have access to the ZCU102. Let's rename the internal
QEMU files and variables to use the ZCU102.

There is no functional change here as the EP108 is still a valid board
option.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                   |  2 +-
 hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index a2e56ec..5ee6f7d 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -13,7 +13,7 @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
similarity index 85%
rename from hw/arm/xlnx-ep108.c
rename to hw/arm/xlnx-zcu102.c
index c339cd4..e9702ed 100644
--- a/hw/arm/xlnx-ep108.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -1,5 +1,5 @@
 /*
- * Xilinx ZynqMP EP108 board
+ * Xilinx ZynqMP ZCU102 board
  *
  * Copyright (C) 2015 Xilinx Inc
  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -25,16 +25,16 @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 
-typedef struct XlnxEP108 {
+typedef struct XlnxZCU102 {
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
-} XlnxEP108;
+} XlnxZCU102;
 
-static struct arm_boot_info xlnx_ep108_binfo;
+static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_ep108_init(MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
-    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -47,7 +47,7 @@ static void xlnx_ep108_init(MachineState *machine)
     }
 
     if (ram_size < 0x08000000) {
-        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                  ram_size);
     }
 
@@ -108,18 +108,18 @@ static void xlnx_ep108_init(MachineState *machine)
 
     /* TODO create and connect IDE devices for ide_drive_get() */
 
-    xlnx_ep108_binfo.ram_size = ram_size;
-    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
-    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
-    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
-    xlnx_ep108_binfo.loader_start = 0;
-    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
+    xlnx_zcu102_binfo.ram_size = ram_size;
+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+    xlnx_zcu102_binfo.loader_start = 0;
+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
 static void xlnx_ep108_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
@@ -130,7 +130,7 @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 static void xlnx_zcu102_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP ZCU102 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
-- 
2.7.4

[Qemu-devel] [PULL 09/18] xlnx-zcu102: Manually create the machines

[Peter Maydell]

From: Alistair Francis <alistair.francis@xilinx.com>

In preperation for future work let's manually create the Xilnx machines.
This will allow us to set properties for the machines in the future.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index e9702ed..5b1f184 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -26,15 +26,24 @@
 #include "qemu/log.h"
 
 typedef struct XlnxZCU102 {
+    MachineState parent_obj;
+
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
 } XlnxZCU102;
 
+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+#define ZCU102_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+
+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+#define EP108_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+
 static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_zcu102_init(MachineState *machine)
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
-    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -116,19 +125,56 @@ static void xlnx_zcu102_init(MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_machine_init(MachineClass *mc)
+static void xlnx_ep108_init(MachineState *machine)
+{
+    XlnxZCU102 *s = EP108_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+}
+
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_zcu102_init;
+    mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_ep108_machine_class_init,
+    .instance_init = xlnx_ep108_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
 
-static void xlnx_zcu102_machine_init(MachineClass *mc)
+static void xlnx_ep108_machine_init_register_types(void)
 {
+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+}
+
+static void xlnx_zcu102_init(MachineState *machine)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_zcu102_machine_instance_init(Object *obj)
+{
+}
+
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP ZCU102 board";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
@@ -136,4 +182,18 @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_zcu102_machine_class_init,
+    .instance_init = xlnx_zcu102_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
+
+static void xlnx_zcu102_machine_init_register_types(void)
+{
+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
+}
+
+type_init(xlnx_zcu102_machine_init_register_types)
+type_init(xlnx_ep108_machine_init_register_types)
-- 
2.7.4

[Qemu-devel] [PULL 10/18] xlnx-zcu102: Add a machine level secure property

[Peter Maydell]

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level secure property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,secure=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index 5b1f184..bd573c4 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -30,6 +30,8 @@ typedef struct XlnxZCU102 {
 
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
+
+    bool secure;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -42,6 +44,20 @@ typedef struct XlnxZCU102 {
 
 static struct arm_boot_info xlnx_zcu102_binfo;
 
+static bool zcu102_get_secure(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->secure;
+}
+
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->secure = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -69,6 +85,8 @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 
     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
                          "ddr-ram", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -134,6 +152,10 @@ static void xlnx_ep108_init(MachineState *machine)
 
 static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = EP108_MACHINE(obj);
+
+    /* EP108, we don't support setting secure */
+    s->secure = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -169,6 +191,16 @@ static void xlnx_zcu102_init(MachineState *machine)
 
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    /* Default to secure mode being disabled */
+    s->secure = false;
+    object_property_add_bool(obj, "secure", zcu102_get_secure,
+                             zcu102_set_secure, NULL);
+    object_property_set_description(obj, "secure",
+                                    "Set on/off to enable/disable the ARM "
+                                    "Security Extensions (TrustZone)",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

[Qemu-devel] [PULL 11/18] xlnx-zcu102: Add a machine level virtualization property

[Peter Maydell]

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level virtualization property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,virtualization=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
 hw/arm/xlnx-zynqmp.c         |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index c2931bf..6eff81a 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -91,6 +91,8 @@ typedef struct XlnxZynqMPState {
 
     /* Has the ARM Security extensions?  */
     bool secure;
+    /* Has the ARM Virtualization extensions?  */
+    bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
 }  XlnxZynqMPState;
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index bd573c4..42deefd 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -32,6 +32,7 @@ typedef struct XlnxZCU102 {
     MemoryRegion ddr_ram;
 
     bool secure;
+    bool virt;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -58,6 +59,20 @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
     s->secure = value;
 }
 
+static bool zcu102_get_virt(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->virt;
+}
+
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->virt = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -87,6 +102,8 @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
                          "ddr-ram", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
                              &error_fatal);
+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -154,8 +171,9 @@ static void xlnx_ep108_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = EP108_MACHINE(obj);
 
-    /* EP108, we don't support setting secure */
+    /* EP108, we don't support setting secure or virt */
     s->secure = false;
+    s->virt = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -201,6 +219,16 @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                     "Set on/off to enable/disable the ARM "
                                     "Security Extensions (TrustZone)",
                                     NULL);
+
+    /* Default to virt (EL2) being disabled */
+    s->virt = false;
+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+                             zcu102_set_virt, NULL);
+    object_property_set_description(obj, "virtualization",
+                                    "Set on/off to enable/disable emulating a "
+                                    "guest CPU which implements the ARM "
+                                    "Virtualization Extensions",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index 22c2a33..2b27daf 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -255,7 +255,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                  s->secure, "has_el3", NULL);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                 false, "has_el2", NULL);
+                                 s->virt, "has_el2", NULL);
         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -427,6 +427,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-- 
2.7.4

[Qemu-devel] [PULL 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated

[Peter Maydell]

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is the same as the ZCU102, mark it as deprecated as we don't
need two machines.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index 42deefd..519a16e 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -180,7 +180,7 @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->desc = "Xilinx ZynqMP EP108 board";
+    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
     mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
-- 
2.7.4

[Qemu-devel] [PULL 13/18] AArch64: Fix single stepping of ERET instruction

[Peter Maydell]

From: Jaroslaw Pelczar <j.pelczar@samsung.com>

Previously when single stepping through ERET instruction via GDB
would result in debugger entering the "next" PC after ERET instruction.
When debugging in kernel mode, this will also cause unintended behavior,
because debugger will try to access memory from EL0 point of view.

Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 9017e30..1bc12d9 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -11348,6 +11348,7 @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         default:
             gen_a64_set_pc_im(dc->pc);
             /* fall through */
+        case DISAS_EXIT:
         case DISAS_JUMP:
             if (dc->base.singlestep_enabled) {
                 gen_exception_internal(EXCP_DEBUG);
-- 
2.7.4

[Qemu-devel] [PULL 14/18] target/arm: Avoid an extra temporary for store_exclusive

[Peter Maydell]

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 1bc12d9..083568c 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1894,7 +1894,7 @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
 }
 
 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-                                TCGv_i64 inaddr, int size, int is_pair)
+                                TCGv_i64 addr, int size, int is_pair)
 {
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -1910,13 +1910,8 @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      */
     TCGLabel *fail_label = gen_new_label();
     TCGLabel *done_label = gen_new_label();
-    TCGv_i64 addr = tcg_temp_local_new_i64();
     TCGv_i64 tmp;
 
-    /* Copy input into a local temp so it is not trashed when the
-     * basic block ends at the branch insn.
-     */
-    tcg_gen_mov_i64(addr, inaddr);
     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
@@ -1927,27 +1922,24 @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
             } else {
                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
             }
-            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
+                                       cpu_exclusive_val, tmp,
                                        get_mem_index(s),
                                        MO_64 | MO_ALIGN | s->be_data);
             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
         } else if (s->be_data == MO_LE) {
-            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         } else {
-            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         }
     } else {
-        TCGv_i64 val = cpu_reg(s, rt);
-        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
-                                   get_mem_index(s),
+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+                                   cpu_reg(s, rt), get_mem_index(s),
                                    size | MO_ALIGN | s->be_data);
         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
     }
-
-    tcg_temp_free_i64(addr);
-
     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
     tcg_temp_free_i64(tmp);
     tcg_gen_br(done_label);
-- 
2.7.4

[Qemu-devel] [PULL 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping

[Peter Maydell]

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/pci-host/gpex.h |  3 +++
 hw/pci-host/gpex.c         | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index 68c9348..aef38b8 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -51,6 +51,9 @@ typedef struct GPEXHost {
     MemoryRegion io_ioport;
     MemoryRegion io_mmio;
     qemu_irq irq[GPEX_NUM_IRQS];
+    int irq_num[GPEX_NUM_IRQS];
 } GPEXHost;
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index 83084b9..41a884d 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -43,6 +43,16 @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(s->irq[irq_num], level);
 }
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+    if (index >= GPEX_NUM_IRQS) {
+        return -EINVAL;
+    }
+
+    s->irq_num[index] = gsi;
+    return 0;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

[Qemu-devel] [PULL 16/18] hw/arm/virt: Set INTx/gsi mapping

[Peter Maydell]

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index fe96557..cfd834d 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1057,6 +1057,7 @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
     }
 
     pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

[Qemu-devel] [PULL 17/18] hw/pci-host/gpex: Implement PCI INTx routing

[Peter Maydell]

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/gpex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index 41a884d..be25245 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -53,6 +53,17 @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
     return 0;
 }
 
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+    PCIINTxRoute route;
+    GPEXHost *s = opaque;
+
+    route.mode = PCI_INTX_ENABLED;
+    route.irq = s->irq_num[pin];
+
+    return route;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -77,6 +88,7 @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
 
     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
     qdev_init_nofail(DEVICE(&s->gpex_root));
 }
 
-- 
2.7.4

[Qemu-devel] [PULL 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines

[Peter Maydell]

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index abb0ab6..769cff8 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -287,8 +287,8 @@ static void mps2_common_init(MachineState *machine)
             cmsdk_apb_uart_create(uartbase[i],
                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, 0),
-                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, i * 2),
+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                   NULL,
                                   uartchr, SYSCLK_FRQ);
         }
-- 
2.7.4

Re: [Qemu-devel] [PULL 00/18] target-arm queue

[Peter Maydell]

On 14 September 2017 at 18:52, Peter Maydell <peter.maydell@linaro.org> wrote:
> ARM queue: nothing particularly exciting, but 18 patches
> is enough to send out.
>
> thanks
> -- PMM
>
> The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
>
>   Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
>
> are available in the git repository at:
>
>   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
>
> for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
>
>   mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
>
> ----------------------------------------------------------------
> target-arm queue:
>  * v7M: various code cleanups
>  * v7M: set correct BFSR bits on bus fault
>  * v7M: clear exclusive monitor on reset and exception entry/exit
>  * v7M: don't apply priority mask to negative priorities
>  * zcu102: support 'secure' and 'virtualization' machine properties
>  * aarch64: fix ERET single stepping
>  * gpex: implement PCI INTx routing
>  * mps2-an511: fix UART overflow interrupt line wiring
>

Applied, thanks.

-- PMM