Series comparison

-[Qemu-devel] [PULL 00/30] target-arm queue
+[Qemu-devel] [PULL 0/9] target-arm queue
-ARM queu; includes all the NVIC rewrite patches.
+ARM bugfixes for rc1...
 The QOMify-armv7m patchset hasn't got enough review just
 yet but I may be able to sneak it in before freeze
 tomorrow if it gets review. Didn't want to hold this lot
 up waiting, anyway.
 thanks
 -- PMM
-The following changes since commit 8f2d7c341184a95d05476ea3c45dbae2b9ddbe51:
+The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:
-  Merge remote-tracking branch 'remotes/berrange/tags/pull-qcrypto-2017-02-27-1' into staging (2017-02-27 15:33:21 +0000)
+  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)
 are available in the git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170227
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113
-for you to fetch changes up to 94d5bcf5a7f3799660b62098a5183f161aad0601:
+for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:
-  hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID (2017-02-27 17:23:16 +0000)
+  accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * raspi2: implement RNG module, GPIO and new SD card controller
+ * translate-a64.c: silence gcc5 warning
-   (sufficient to boot new raspbian kernels)
+ * highbank: validate register offset before access
- * sdhci: bugfixes for block transfers
+ * MAINTAINERS: Add entries for Smartfusion2
- * virt: fix cpu object reference leak
+ * accel/tcg/translate-all: expand cpu_restore_state addr check
- * Add missing fp_access_check() to aarch64 crypto instructions
+   (so usermode insn aborts don't crash with an assertion failure)
- * cputlb: Don't assume do_unassigned_access() never returns
+ * fix TCG initialization of some Arm boards by allowing them
- * virt: Add a user option to disallow ITS instantiation
+   to specify min/default number of CPUs to create
  * i.MX timers: fix reset handling
  * ARMv7M NVIC: rewrite to fix broken priority handling and masking
  * exynos: Fix proper mapping of CPUs by providing real cluster ID
  * exynos: Fix Linux kernel division by zero for PLLs
 ----------------------------------------------------------------
-Clement Deschamps (4):
+Alex Bennée (1):
-      bcm2835_sdhost: add bcm2835 sdhost controller
+      accel/tcg/translate-all: expand cpu_restore_state addr check
       hw/sd: add card-reparenting function
       bcm2835_gpio: add bcm2835 gpio controller
       bcm2835: add sdhost and gpio controllers
-Eric Auger (1):
+Alistair Francis (2):
-      hw/arm/virt: Add a user option to disallow ITS instantiation
+      xlnx-zynqmp: Properly support the smp command line option
       xlnx-zcu102: Add an info message deprecating the EP108
-Igor Mammedov (1):
+Emilio G. Cota (4):
-      hw/arm/virt: fix cpu object reference leak
+      arm/translate-a64: mark path as unreachable to eliminate warning
       qom: move CPUClass.tcg_initialize to a global
       xlnx-zcu102: Specify the max number of CPUs for the EP108
       hw: add .min_cpus and .default_cpus fields to machine_class
-Krzysztof Kozlowski (2):
+Prasad J Pandit (1):
-      hw/arm/exynos: Fix Linux kernel division by zero for PLLs
+      highbank: validate register offset before access
       hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID
-Kurban Mallachiev (1):
+Subbaraya Sundeep (1):
-      ARM i.MX timers: fix reset handling
+      MAINTAINERS: Add entries for Smartfusion2
-Marcin Chojnacki (1):
+ include/exec/exec-all.h    | 11 ++++++++++
-      target-arm: Implement BCM2835 hardware RNG
+ include/hw/boards.h        |  5 +++++
  include/qom/cpu.h          |  1 -
  accel/tcg/translate-all.c  | 52 ++++++++++++++++++++++++++--------------------
  exec.c                     |  5 +++--
  hw/arm/exynos4_boards.c    | 12 ++++-------
  hw/arm/highbank.c          | 17 +++++++++++++--
  hw/arm/raspi.c             |  2 ++
  hw/arm/xlnx-zcu102.c       |  9 +++++++-
  hw/arm/xlnx-zynqmp.c       | 26 ++++++++++++++---------
  target/arm/translate-a64.c |  2 ++
  vl.c                       | 21 ++++++++++++++++---
  MAINTAINERS                | 17 +++++++++++++++
  qemu-doc.texi              |  7 +++++++
 files changed, 137 insertions(+), 50 deletions(-)
-Michael Davidsaver (5):
-      armv7m: Rewrite NVIC to not use any GIC code
-      arm: gic: Remove references to NVIC
-      armv7m: Escalate exceptions to HardFault if necessary
-      armv7m: Simpler and faster exception start
-      armv7m: VECTCLRACTIVE and VECTRESET are UNPREDICTABLE
-Nick Reilly (1):
-      Add missing fp_access_check() to aarch64 crypto instructions
-Peter Maydell (10):
-      bcm2835_rng: Use qcrypto_random_bytes() rather than rand()
-      cputlb: Don't assume do_unassigned_access() never returns
-      armv7m: Rename nvic_state to NVICState
-      armv7m: Implement reading and writing of PRIGROUP
-      armv7m: Fix condition check for taking exceptions
-      armv7m: Remove unused armv7m_nvic_acknowledge_irq() return value
-      armv7m: Extract "exception taken" code into functions
-      armv7m: Check exception return consistency
-      armv7m: Raise correct kind of UsageFault for attempts to execute ARM code
-      armv7m: Allow SHCSR writes to change pending and active bits
-Prasad J Pandit (4):
-      sd: sdhci: mask transfer mode register value
-      sd: sdhci: check transfer mode register in multi block transfer
-      sd: sdhci: conditionally invoke multi block transfer
-      sd: sdhci: Remove block count enable check in single block transfers
- hw/gpio/Makefile.objs                |   1 +
- hw/misc/Makefile.objs                |   3 +-
- hw/sd/Makefile.objs                  |   1 +
- hw/intc/gic_internal.h               |   7 +-
- include/hw/arm/bcm2835_peripherals.h |   6 +
- include/hw/arm/virt.h                |   1 +
- include/hw/gpio/bcm2835_gpio.h       |  39 ++
- include/hw/misc/bcm2835_rng.h        |  27 ++
- include/hw/sd/bcm2835_sdhost.h       |  48 ++
- include/hw/sd/sd.h                   |  11 +
- target/arm/cpu.h                     |  23 +-
- cputlb.c                             |  15 +-
- hw/arm/bcm2835_peripherals.c         |  58 ++-
- hw/arm/exynos4210.c                  |  18 +
- hw/arm/virt.c                        |  32 +-
- hw/gpio/bcm2835_gpio.c               | 353 ++++++++++++++
- hw/intc/arm_gic.c                    |  31 +-
- hw/intc/arm_gic_common.c             |  23 +-
- hw/intc/armv7m_nvic.c                | 885 ++++++++++++++++++++++++++++-------
- hw/misc/bcm2835_rng.c                | 149 ++++++
- hw/misc/exynos4210_clk.c             | 164 +++++++
- hw/sd/bcm2835_sdhost.c               | 429 +++++++++++++++++
- hw/sd/core.c                         |  30 ++
- hw/sd/sdhci.c                        |  25 +-
- hw/timer/imx_gpt.c                   |  33 +-
- linux-user/main.c                    |   1 +
- target/arm/cpu.c                     |  16 +-
- target/arm/helper.c                  | 245 +++++++---
- target/arm/translate-a64.c           |  12 +
- target/arm/translate.c               |   8 +-
- hw/intc/trace-events                 |  15 +
-files changed, 2376 insertions(+), 333 deletions(-)
- create mode 100644 include/hw/gpio/bcm2835_gpio.h
- create mode 100644 include/hw/misc/bcm2835_rng.h
- create mode 100644 include/hw/sd/bcm2835_sdhost.h
- create mode 100644 hw/gpio/bcm2835_gpio.c
- create mode 100644 hw/misc/bcm2835_rng.c
- create mode 100644 hw/misc/exynos4210_clk.c
- create mode 100644 hw/sd/bcm2835_sdhost.c

-[Qemu-devel] [PULL 01/30] target-arm: Implement BCM2835 hardware RNG
+Deleted patch
-From: Marcin Chojnacki <marcinch7@gmail.com>
-Recent vanilla Raspberry Pi kernels started to make use of
-the hardware random number generator in BCM2835 SoC. As a
-result, those kernels wouldn't work anymore under QEMU
-but rather just freeze during the boot process.
-This patch implements a trivial BCM2835 compatible RNG,
-and adds it as a peripheral to BCM2835 platform, which
-allows to boot a vanilla Raspberry Pi kernel under Qemu.
-Changes since v1:
- * Prevented guest from writing [31..20] bits in rng_status
- * Removed redundant minimum_version_id_old
- * Added field entries for the state
- * Changed realize function to reset
-Signed-off-by: Marcin Chojnacki <marcinch7@gmail.com>
-Message-id: 20170210210857.47893-1-marcinch7@gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/Makefile.objs                |   1 +
- include/hw/arm/bcm2835_peripherals.h |   2 +
- include/hw/misc/bcm2835_rng.h        |  27 ++++++++
- hw/arm/bcm2835_peripherals.c         |  15 +++++
- hw/misc/bcm2835_rng.c                | 124 +++++++++++++++++++++++++++++++++++
-files changed, 169 insertions(+)
- create mode 100644 include/hw/misc/bcm2835_rng.h
- create mode 100644 hw/misc/bcm2835_rng.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_sdrc.o
- obj-$(CONFIG_OMAP) += omap_tap.o
- obj-$(CONFIG_RASPI) += bcm2835_mbox.o
- obj-$(CONFIG_RASPI) += bcm2835_property.o
-+obj-$(CONFIG_RASPI) += bcm2835_rng.o
- obj-$(CONFIG_SLAVIO) += slavio_misc.o
- obj-$(CONFIG_ZYNQ) += zynq_slcr.o
- obj-$(CONFIG_ZYNQ) += zynq-xadc.o
-diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2835_peripherals.h
-+++ b/include/hw/arm/bcm2835_peripherals.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/dma/bcm2835_dma.h"
- #include "hw/intc/bcm2835_ic.h"
- #include "hw/misc/bcm2835_property.h"
-+#include "hw/misc/bcm2835_rng.h"
- #include "hw/misc/bcm2835_mbox.h"
- #include "hw/sd/sdhci.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
-     BCM2835DMAState dma;
-     BCM2835ICState ic;
-     BCM2835PropertyState property;
-+    BCM2835RngState rng;
-     BCM2835MboxState mboxes;
-     SDHCIState sdhci;
- } BCM2835PeripheralState;
-diff --git a/include/hw/misc/bcm2835_rng.h b/include/hw/misc/bcm2835_rng.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/misc/bcm2835_rng.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * BCM2835 Random Number Generator emulation
-+ *
-+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef BCM2835_RNG_H
-+#define BCM2835_RNG_H
-+
-+#include "hw/sysbus.h"
-+
-+#define TYPE_BCM2835_RNG "bcm2835-rng"
-+#define BCM2835_RNG(obj) \
-+        OBJECT_CHECK(BCM2835RngState, (obj), TYPE_BCM2835_RNG)
-+
-+typedef struct {
-+    SysBusDevice busdev;
-+    MemoryRegion iomem;
-+
-+    uint32_t rng_ctrl;
-+    uint32_t rng_status;
-+} BCM2835RngState;
-+
-+#endif
-diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2835_peripherals.c
-+++ b/hw/arm/bcm2835_peripherals.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
-     object_property_add_const_link(OBJECT(&s->property), "dma-mr",
-                                    OBJECT(&s->gpu_bus_mr), &error_abort);
-+    /* Random Number Generator */
-+    object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
-+    object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
-+    qdev_set_parent_bus(DEVICE(&s->rng), sysbus_get_default());
-+
-     /* Extended Mass Media Controller */
-     object_initialize(&s->sdhci, sizeof(s->sdhci), TYPE_SYSBUS_SDHCI);
-     object_property_add_child(obj, "sdhci", OBJECT(&s->sdhci), NULL);
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
-                       qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
-+    /* Random Number Generator */
-+    object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
-+    if (err) {
-+        error_propagate(errp, err);
-+        return;
-+    }
-+
-+    memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
-+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
-+
-     /* Extended Mass Media Controller */
-     object_property_set_int(OBJECT(&s->sdhci), BCM2835_SDHC_CAPAREG, "capareg",
-                             &err);
-diff --git a/hw/misc/bcm2835_rng.c b/hw/misc/bcm2835_rng.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/bcm2835_rng.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * BCM2835 Random Number Generator emulation
-+ *
-+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "hw/misc/bcm2835_rng.h"
-+
-+static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
-+                                 unsigned size)
-+{
-+    BCM2835RngState *s = (BCM2835RngState *)opaque;
-+    uint32_t res = 0;
-+
-+    assert(size == 4);
-+
-+    switch (offset) {
-+    case 0x0:    /* rng_ctrl */
-+        res = s->rng_ctrl;
-+        break;
-+    case 0x4:    /* rng_status */
-+        res = s->rng_status | (1 << 24);
-+        break;
-+    case 0x8:    /* rng_data */
-+        res = rand();
-+        break;
-+
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "bcm2835_rng_read: Bad offset %x\n",
-+                      (int)offset);
-+        res = 0;
-+        break;
-+    }
-+
-+    return res;
-+}
-+
-+static void bcm2835_rng_write(void *opaque, hwaddr offset,
-+                              uint64_t value, unsigned size)
-+{
-+    BCM2835RngState *s = (BCM2835RngState *)opaque;
-+
-+    assert(size == 4);
-+
-+    switch (offset) {
-+    case 0x0:    /* rng_ctrl */
-+        s->rng_ctrl = value;
-+        break;
-+    case 0x4:    /* rng_status */
-+        /* we shouldn't let the guest write to bits [31..20] */
-+        s->rng_status &= ~0xFFFFF;        /* clear 20 lower bits */
-+        s->rng_status |= value & 0xFFFFF; /* set them to new value */
-+        break;
-+
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "bcm2835_rng_write: Bad offset %x\n",
-+                      (int)offset);
-+        break;
-+    }
-+}
-+
-+static const MemoryRegionOps bcm2835_rng_ops = {
-+    .read = bcm2835_rng_read,
-+    .write = bcm2835_rng_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+};
-+
-+static const VMStateDescription vmstate_bcm2835_rng = {
-+    .name = TYPE_BCM2835_RNG,
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(rng_ctrl, BCM2835RngState),
-+        VMSTATE_UINT32(rng_status, BCM2835RngState),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void bcm2835_rng_init(Object *obj)
-+{
-+    BCM2835RngState *s = BCM2835_RNG(obj);
-+
-+    memory_region_init_io(&s->iomem, obj, &bcm2835_rng_ops, s,
-+                          TYPE_BCM2835_RNG, 0x10);
-+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
-+}
-+
-+static void bcm2835_rng_reset(DeviceState *dev)
-+{
-+    BCM2835RngState *s = BCM2835_RNG(dev);
-+
-+    s->rng_ctrl = 0;
-+    s->rng_status = 0;
-+}
-+
-+static void bcm2835_rng_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->reset = bcm2835_rng_reset;
-+    dc->vmsd = &vmstate_bcm2835_rng;
-+}
-+
-+static TypeInfo bcm2835_rng_info = {
-+    .name          = TYPE_BCM2835_RNG,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(BCM2835RngState),
-+    .class_init    = bcm2835_rng_class_init,
-+    .instance_init = bcm2835_rng_init,
-+};
-+
-+static void bcm2835_rng_register_types(void)
-+{
-+    type_register_static(&bcm2835_rng_info);
-+}
-+
-+type_init(bcm2835_rng_register_types)
---
-.7.4

-[Qemu-devel] [PULL 02/30] bcm2835_rng: Use qcrypto_random_bytes() rather than rand()
+Deleted patch
-Switch to using qcrypto_random_bytes() rather than rand() as
-our source of randomness for the BCM2835 RNG.
-If qcrypto_random_bytes() fails, we don't want to return the guest a
-non-random value in case they're really using it for cryptographic
-purposes, so the best we can do is a fatal error.  This shouldn't
-happen unless something's broken, though.
-In theory we could implement this device's full FIFO and interrupt
-semantics and then just stop filling the FIFO.  That's a lot of work,
-though, and doesn't really give a very nice diagnostic to the user
-since the guest will just seem to hang.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
----
- hw/misc/bcm2835_rng.c | 27 ++++++++++++++++++++++++++-
-file changed, 26 insertions(+), 1 deletion(-)
-diff --git a/hw/misc/bcm2835_rng.c b/hw/misc/bcm2835_rng.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/bcm2835_rng.c
-+++ b/hw/misc/bcm2835_rng.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu/log.h"
-+#include "qapi/error.h"
-+#include "crypto/random.h"
- #include "hw/misc/bcm2835_rng.h"
-+static uint32_t get_random_bytes(void)
-+{
-+    uint32_t res;
-+    Error *err = NULL;
-+
-+    if (qcrypto_random_bytes((uint8_t *)&res, sizeof(res), &err) < 0) {
-+        /* On failure we don't want to return the guest a non-random
-+         * value in case they're really using it for cryptographic
-+         * purposes, so the best we can do is die here.
-+         * This shouldn't happen unless something's broken.
-+         * In theory we could implement this device's full FIFO
-+         * and interrupt semantics and then just stop filling the
-+         * FIFO. That's a lot of work, though, so we assume any
-+         * errors are systematic problems and trust that if we didn't
-+         * fail as the guest inited then we won't fail later on
-+         * mid-run.
-+         */
-+        error_report_err(err);
-+        exit(1);
-+    }
-+    return res;
-+}
-+
- static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
-                                  unsigned size)
- {
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
-         res = s->rng_status | (1 << 24);
-         break;
-     case 0x8:    /* rng_data */
--        res = rand();
-+        res = get_random_bytes();
-         break;
-     default:
---
-.7.4

-[Qemu-devel] [PULL 03/30] sd: sdhci: mask transfer mode register value
+Deleted patch
-From: Prasad J Pandit <pjp@fedoraproject.org>
-In SDHCI protocol, the transfer mode register is defined
-to be of 6 bits. Mask its value with '0x0037' so that an
-invalid value could not be assigned.
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20170214185225.7994-2-ppandit@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@
-     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
-     (SDHC_CAPAB_TOCLKFREQ))
-+#define MASK_TRNMOD     0x0037
- #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
- static uint8_t sdhci_slotint(SDHCIState *s)
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
-             value &= ~SDHC_TRNS_DMA;
-         }
--        MASKED_WRITE(s->trnmod, mask, value);
-+        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
-         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
-         /* Writing to the upper byte of CMDREG triggers SD command generation */
---
-.7.4

-[Qemu-devel] [PULL 04/30] sd: sdhci: check transfer mode register in multi block transfer
+Deleted patch
-From: Prasad J Pandit <pjp@fedoraproject.org>
-In the SDHCI protocol, the transfer mode register value
-is used during multi block transfer to check if block count
-register is enabled and should be updated. Transfer mode
-register could be set such that, block count register would
-not be updated, thus leading to an infinite loop. Add check
-to avoid it.
-Reported-by: Wjjzhang <wjjzhang@tencent.com>
-Reported-by: Jiang Xin <jiangxin1@huawei.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 20170214185225.7994-3-ppandit@redhat.com
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci.c | 10 +++++-----
-file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
-     uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);
-     uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
-+    if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {
-+        qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");
-+        return;
-+    }
-+
-     /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
-      * possible stop at page boundary if initial address is not page aligned,
-      * allow them to work properly */
-@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
-     if (s->trnmod & SDHC_TRNS_DMA) {
-         switch (SDHC_DMA_TYPE(s->hostctl)) {
-         case SDHC_CTRL_SDMA:
--            if ((s->trnmod & SDHC_TRNS_MULTI) &&
--                    (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {
--                break;
--            }
--
-             if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
-                 sdhci_sdma_transfer_single_block(s);
-             } else {
---
-.7.4

-[Qemu-devel] [PULL 05/30] sd: sdhci: conditionally invoke multi block transfer
+Deleted patch
-From: Prasad J Pandit <pjp@fedoraproject.org>
-In sdhci_write invoke multi block transfer if it is enabled
-in the transfer mode register 's->trnmod'.
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 20170214185225.7994-4-ppandit@redhat.com
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci.c | 6 +++++-
-file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         /* Writing to last byte of sdmasysad might trigger transfer */
-         if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt &&
-                 s->blksize && SDHC_DMA_TYPE(s->hostctl) == SDHC_CTRL_SDMA) {
--            sdhci_sdma_transfer_multi_blocks(s);
-+            if (s->trnmod & SDHC_TRNS_MULTI) {
-+                sdhci_sdma_transfer_multi_blocks(s);
-+            } else {
-+                sdhci_sdma_transfer_single_block(s);
-+            }
-         }
-         break;
-     case SDHC_BLKSIZE:
---
-.7.4

-[Qemu-devel] [PULL 08/30] Add missing fp_access_check() to aarch64 crypto instructions
+[Qemu-devel] [PULL 1/9] arm/translate-a64: mark path as unreachable to eliminate warning
-From: Nick Reilly <nreilly@blackberry.com>
+From: "Emilio G. Cota" <cota@braap.org>
-The aarch64 crypto instructions for AES and SHA are missing the
+Fixes the following warning when compiling with gcc 5.4.0 with -O1
-check for if the FPU is enabled.
+optimizations and --enable-debug:
-Signed-off-by: Nick Reilly <nreilly@blackberry.com>
+target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
 target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (!post_index) {
         ^
 target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
      bool post_index;
           ^
 target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (writeback) {
         ^
 target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
      bool writeback;
           ^
 Note that idx comes from selecting 2 bits, and therefore its value
 can be at most 3.
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 12 ++++++++++++
+ target/arm/translate-a64.c | 2 ++
-file changed, 12 insertions(+)
+file changed, 2 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
-         return;
+         post_index = false;
          writeback = true;
          break;
 +    default:
 +        g_assert_not_reached();
      }
-+    if (!fp_access_check(s)) {
+     if (rn == 31) {
 +        return;
 +    }
 +
      /* Note that we convert the Vx register indexes into the
       * index within the vfp.regs[] array, so we can share the
       * helper with the AArch32 instructions.
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 +    if (!fp_access_check(s)) {
 +        return;
 +    }
 +
      tcg_rd_regno = tcg_const_i32(rd << 1);
      tcg_rn_regno = tcg_const_i32(rn << 1);
      tcg_rm_regno = tcg_const_i32(rm << 1);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 +    if (!fp_access_check(s)) {
 +        return;
 +    }
 +
      tcg_rd_regno = tcg_const_i32(rd << 1);
      tcg_rn_regno = tcg_const_i32(rn << 1);
 --
 .7.4

-[Qemu-devel] [PULL 25/30] bcm2835_sdhost: add bcm2835 sdhost controller
+[Qemu-devel] [PULL 2/9] highbank: validate register offset before access
-From: Clement Deschamps <clement.deschamps@antfield.fr>
+From: Prasad J Pandit <pjp@fedoraproject.org>
-This adds the BCM2835 SDHost controller from Arasan.
+An 'offset' parameter sent to highbank register r/w functions
 could be greater than number(NUM_REGS=0x200) of hb registers,
 leading to an OOB access issue. Add check to avoid it.
-Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
+Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
-Message-id: 20170224164021.9066-2-clement.deschamps@antfield.fr
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
 Message-id: 20171113062658.9697-1-ppandit@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/Makefile.objs            |   1 +
+ hw/arm/highbank.c | 17 +++++++++++++++--
- include/hw/sd/bcm2835_sdhost.h |  48 +++++
+file changed, 15 insertions(+), 2 deletions(-)
  hw/sd/bcm2835_sdhost.c         | 429 +++++++++++++++++++++++++++++++++++++++++
 files changed, 478 insertions(+)
  create mode 100644 include/hw/sd/bcm2835_sdhost.h
  create mode 100644 hw/sd/bcm2835_sdhost.c
-diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
+diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/Makefile.objs
+--- a/hw/arm/highbank.c
-+++ b/hw/sd/Makefile.objs
++++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SDHCI) += sdhci.o
  obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
  obj-$(CONFIG_OMAP) += omap_mmc.o
  obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
 +obj-$(CONFIG_RASPI) += bcm2835_sdhost.o
 diff --git a/include/hw/sd/bcm2835_sdhost.h b/include/hw/sd/bcm2835_sdhost.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/sd/bcm2835_sdhost.h
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #include "hw/ide/ahci.h"
-+ * Raspberry Pi (BCM2835) SD Host Controller
+ #include "hw/cpu/a9mpcore.h"
-+ *
+ #include "hw/cpu/a15mpcore.h"
 + * Copyright (c) 2017 Antfield SAS
 + *
 + * Authors:
 + *  Clement Deschamps <clement.deschamps@antfield.fr>
 + *  Luc Michel <luc.michel@antfield.fr>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#ifndef BCM2835_SDHOST_H
 +#define BCM2835_SDHOST_H
 +
 +#include "hw/sysbus.h"
 +#include "hw/sd/sd.h"
 +
 +#define TYPE_BCM2835_SDHOST "bcm2835-sdhost"
 +#define BCM2835_SDHOST(obj) \
 +        OBJECT_CHECK(BCM2835SDHostState, (obj), TYPE_BCM2835_SDHOST)
 +
 +#define BCM2835_SDHOST_FIFO_LEN 16
 +
 +typedef struct {
 +    SysBusDevice busdev;
 +    SDBus sdbus;
 +    MemoryRegion iomem;
 +
 +    uint32_t cmd;
 +    uint32_t cmdarg;
 +    uint32_t status;
 +    uint32_t rsp[4];
 +    uint32_t config;
 +    uint32_t edm;
 +    uint32_t vdd;
 +    uint32_t hbct;
 +    uint32_t hblc;
 +    int32_t fifo_pos;
 +    int32_t fifo_len;
 +    uint32_t fifo[BCM2835_SDHOST_FIFO_LEN];
 +    uint32_t datacnt;
 +
 +    qemu_irq irq;
 +} BCM2835SDHostState;
 +
 +#endif
 diff --git a/hw/sd/bcm2835_sdhost.c b/hw/sd/bcm2835_sdhost.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/sd/bcm2835_sdhost.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Raspberry Pi (BCM2835) SD Host Controller
 + *
 + * Copyright (c) 2017 Antfield SAS
 + *
 + * Authors:
 + *  Clement Deschamps <clement.deschamps@antfield.fr>
 + *  Luc Michel <luc.michel@antfield.fr>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
-+#include "sysemu/blockdev.h"
-+#include "hw/sd/bcm2835_sdhost.h"
+ #define SMP_BOOT_ADDR           0x100
-+
+ #define SMP_BOOT_REG            0x40
-+#define TYPE_BCM2835_SDHOST_BUS "bcm2835-sdhost-bus"
+@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
-+#define BCM2835_SDHOST_BUS(obj) \
+         }
-+    OBJECT_CHECK(SDBus, (obj), TYPE_BCM2835_SDHOST_BUS)
+     }
-+
-+#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
+-    regs[offset/4] = value;
-+#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
++    if (offset / 4 >= NUM_REGS) {
-+#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
++        qemu_log_mask(LOG_GUEST_ERROR,
-+#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
++                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
 +#define SDRSP0 0x10 /* SD card rsp (31:0)         - 32 R   */
 +#define SDRSP1 0x14 /* SD card rsp (63:32)        - 32 R   */
 +#define SDRSP2 0x18 /* SD card rsp (95:64)        - 32 R   */
 +#define SDRSP3 0x1c /* SD card rsp (127:96)       - 32 R   */
 +#define SDHSTS 0x20 /* SD host status                  - 11 R   */
 +#define SDVDD  0x30 /* SD card power control           -  1 R/W */
 +#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
 +#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
 +#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
 +#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
 +#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
 +
 +#define SDCMD_NEW_FLAG                  0x8000
 +#define SDCMD_FAIL_FLAG                 0x4000
 +#define SDCMD_BUSYWAIT                  0x800
 +#define SDCMD_NO_RESPONSE               0x400
 +#define SDCMD_LONG_RESPONSE             0x200
 +#define SDCMD_WRITE_CMD                 0x80
 +#define SDCMD_READ_CMD                  0x40
 +#define SDCMD_CMD_MASK                  0x3f
 +
 +#define SDCDIV_MAX_CDIV                 0x7ff
 +
 +#define SDHSTS_BUSY_IRPT                0x400
 +#define SDHSTS_BLOCK_IRPT               0x200
 +#define SDHSTS_SDIO_IRPT                0x100
 +#define SDHSTS_REW_TIME_OUT             0x80
 +#define SDHSTS_CMD_TIME_OUT             0x40
 +#define SDHSTS_CRC16_ERROR              0x20
 +#define SDHSTS_CRC7_ERROR               0x10
 +#define SDHSTS_FIFO_ERROR               0x08
 +/* Reserved */
 +/* Reserved */
 +#define SDHSTS_DATA_FLAG                0x01
 +
 +#define SDHCFG_BUSY_IRPT_EN     (1 << 10)
 +#define SDHCFG_BLOCK_IRPT_EN    (1 << 8)
 +#define SDHCFG_SDIO_IRPT_EN     (1 << 5)
 +#define SDHCFG_DATA_IRPT_EN     (1 << 4)
 +#define SDHCFG_SLOW_CARD        (1 << 3)
 +#define SDHCFG_WIDE_EXT_BUS     (1 << 2)
 +#define SDHCFG_WIDE_INT_BUS     (1 << 1)
 +#define SDHCFG_REL_CMD_LINE     (1 << 0)
 +
 +#define SDEDM_FORCE_DATA_MODE   (1 << 19)
 +#define SDEDM_CLOCK_PULSE       (1 << 20)
 +#define SDEDM_BYPASS            (1 << 21)
 +
 +#define SDEDM_WRITE_THRESHOLD_SHIFT 9
 +#define SDEDM_READ_THRESHOLD_SHIFT 14
 +#define SDEDM_THRESHOLD_MASK     0x1f
 +
 +#define SDEDM_FSM_MASK           0xf
 +#define SDEDM_FSM_IDENTMODE      0x0
 +#define SDEDM_FSM_DATAMODE       0x1
 +#define SDEDM_FSM_READDATA       0x2
 +#define SDEDM_FSM_WRITEDATA      0x3
 +#define SDEDM_FSM_READWAIT       0x4
 +#define SDEDM_FSM_READCRC        0x5
 +#define SDEDM_FSM_WRITECRC       0x6
 +#define SDEDM_FSM_WRITEWAIT1     0x7
 +#define SDEDM_FSM_POWERDOWN      0x8
 +#define SDEDM_FSM_POWERUP        0x9
 +#define SDEDM_FSM_WRITESTART1    0xa
 +#define SDEDM_FSM_WRITESTART2    0xb
 +#define SDEDM_FSM_GENPULSES      0xc
 +#define SDEDM_FSM_WRITEWAIT2     0xd
 +#define SDEDM_FSM_STARTPOWDOWN   0xf
 +
 +#define SDDATA_FIFO_WORDS        16
 +
 +static void bcm2835_sdhost_update_irq(BCM2835SDHostState *s)
 +{
 +    uint32_t irq = s->status &
 +        (SDHSTS_BUSY_IRPT | SDHSTS_BLOCK_IRPT | SDHSTS_SDIO_IRPT);
 +    qemu_set_irq(s->irq, !!irq);
 +}
 +
 +static void bcm2835_sdhost_send_command(BCM2835SDHostState *s)
 +{
 +    SDRequest request;
 +    uint8_t rsp[16];
 +    int rlen;
 +
 +    request.cmd = s->cmd & SDCMD_CMD_MASK;
 +    request.arg = s->cmdarg;
 +
 +    rlen = sdbus_do_command(&s->sdbus, &request, rsp);
 +    if (rlen < 0) {
 +        goto error;
 +    }
 +    if (!(s->cmd & SDCMD_NO_RESPONSE)) {
 +#define RWORD(n) (((uint32_t)rsp[n] << 24) | (rsp[n + 1] << 16) \
 +                  | (rsp[n + 2] << 8) | rsp[n + 3])
 +        if (rlen == 0 || (rlen == 4 && (s->cmd & SDCMD_LONG_RESPONSE))) {
 +            goto error;
 +        }
 +        if (rlen != 4 && rlen != 16) {
 +            goto error;
 +        }
 +        if (rlen == 4) {
 +            s->rsp[0] = RWORD(0);
 +            s->rsp[1] = s->rsp[2] = s->rsp[3] = 0;
 +        } else {
 +            s->rsp[0] = RWORD(12);
 +            s->rsp[1] = RWORD(8);
 +            s->rsp[2] = RWORD(4);
 +            s->rsp[3] = RWORD(0);
 +        }
 +#undef RWORD
 +    }
 +    return;
 +
 +error:
 +    s->cmd |= SDCMD_FAIL_FLAG;
 +    s->status |= SDHSTS_CMD_TIME_OUT;
 +}
 +
 +static void bcm2835_sdhost_fifo_push(BCM2835SDHostState *s, uint32_t value)
 +{
 +    int n;
 +
 +    if (s->fifo_len == BCM2835_SDHOST_FIFO_LEN) {
 +        /* FIFO overflow */
 +        return;
 +    }
-+    n = (s->fifo_pos + s->fifo_len) & (BCM2835_SDHOST_FIFO_LEN - 1);
++    regs[offset / 4] = value;
-+    s->fifo_len++;
+ }
-+    s->fifo[n] = value;
-+}
+ static uint64_t hb_regs_read(void *opaque, hwaddr offset,
                               unsigned size)
  {
 +    uint32_t value;
      uint32_t *regs = opaque;
 -    uint32_t value = regs[offset/4];
 +
-+static uint32_t bcm2835_sdhost_fifo_pop(BCM2835SDHostState *s)
++    if (offset / 4 >= NUM_REGS) {
-+{
++        qemu_log_mask(LOG_GUEST_ERROR,
-+    uint32_t value;
++                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
 +
 +    if (s->fifo_len == 0) {
 +        /* FIFO underflow */
 +        return 0;
 +    }
-+    value = s->fifo[s->fifo_pos];
++    value = regs[offset / 4];
-+    s->fifo_len--;
-+    s->fifo_pos = (s->fifo_pos + 1) & (BCM2835_SDHOST_FIFO_LEN - 1);
+     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
-+    return value;
+         value |= 0x30000000;
 +}
 +
 +static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s)
 +{
 +    uint32_t value = 0;
 +    int n;
 +    int is_read;
 +
 +    is_read = (s->cmd & SDCMD_READ_CMD) != 0;
 +    if (s->datacnt != 0 && (!is_read || sdbus_data_ready(&s->sdbus))) {
 +        if (is_read) {
 +            n = 0;
 +            while (s->datacnt && s->fifo_len < BCM2835_SDHOST_FIFO_LEN) {
 +                value |= (uint32_t)sdbus_read_data(&s->sdbus) << (n * 8);
 +                s->datacnt--;
 +                n++;
 +                if (n == 4) {
 +                    bcm2835_sdhost_fifo_push(s, value);
 +                    n = 0;
 +                    value = 0;
 +                }
 +            }
 +            if (n != 0) {
 +                bcm2835_sdhost_fifo_push(s, value);
 +            }
 +        } else { /* write */
 +            n = 0;
 +            while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) {
 +                if (n == 0) {
 +                    value = bcm2835_sdhost_fifo_pop(s);
 +                    n = 4;
 +                }
 +                n--;
 +                s->datacnt--;
 +                sdbus_write_data(&s->sdbus, value & 0xff);
 +                value >>= 8;
 +            }
 +        }
 +    }
 +    if (s->datacnt == 0) {
 +        s->status |= SDHSTS_DATA_FLAG;
 +
 +        s->edm &= ~0xf;
 +        s->edm |= SDEDM_FSM_DATAMODE;
 +
 +        if (s->config & SDHCFG_DATA_IRPT_EN) {
 +            s->status |= SDHSTS_SDIO_IRPT;
 +        }
 +
 +        if ((s->cmd & SDCMD_BUSYWAIT) && (s->config & SDHCFG_BUSY_IRPT_EN)) {
 +            s->status |= SDHSTS_BUSY_IRPT;
 +        }
 +
 +        if ((s->cmd & SDCMD_WRITE_CMD) && (s->config & SDHCFG_BLOCK_IRPT_EN)) {
 +            s->status |= SDHSTS_BLOCK_IRPT;
 +        }
 +
 +        bcm2835_sdhost_update_irq(s);
 +    }
 +
 +    s->edm &= ~(0x1f << 4);
 +    s->edm |= ((s->fifo_len & 0x1f) << 4);
 +}
 +
 +static uint64_t bcm2835_sdhost_read(void *opaque, hwaddr offset,
 +    unsigned size)
 +{
 +    BCM2835SDHostState *s = (BCM2835SDHostState *)opaque;
 +    uint32_t res = 0;
 +
 +    switch (offset) {
 +    case SDCMD:
 +        res = s->cmd;
 +        break;
 +    case SDHSTS:
 +        res = s->status;
 +        break;
 +    case SDRSP0:
 +        res = s->rsp[0];
 +        break;
 +    case SDRSP1:
 +        res = s->rsp[1];
 +        break;
 +    case SDRSP2:
 +        res = s->rsp[2];
 +        break;
 +    case SDRSP3:
 +        res = s->rsp[3];
 +        break;
 +    case SDEDM:
 +        res = s->edm;
 +        break;
 +    case SDVDD:
 +        res = s->vdd;
 +        break;
 +    case SDDATA:
 +        res = bcm2835_sdhost_fifo_pop(s);
 +        bcm2835_sdhost_fifo_run(s);
 +        break;
 +    case SDHBCT:
 +        res = s->hbct;
 +        break;
 +    case SDHBLC:
 +        res = s->hblc;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 +                      __func__, offset);
 +        res = 0;
 +        break;
 +    }
 +
 +    return res;
 +}
 +
 +static void bcm2835_sdhost_write(void *opaque, hwaddr offset,
 +    uint64_t value, unsigned size)
 +{
 +    BCM2835SDHostState *s = (BCM2835SDHostState *)opaque;
 +
 +    switch (offset) {
 +    case SDCMD:
 +        s->cmd = value;
 +        if (value & SDCMD_NEW_FLAG) {
 +            bcm2835_sdhost_send_command(s);
 +            bcm2835_sdhost_fifo_run(s);
 +            s->cmd &= ~SDCMD_NEW_FLAG;
 +        }
 +        break;
 +    case SDTOUT:
 +        break;
 +    case SDCDIV:
 +        break;
 +    case SDHSTS:
 +        s->status &= ~value;
 +        bcm2835_sdhost_update_irq(s);
 +        break;
 +    case SDARG:
 +        s->cmdarg = value;
 +        break;
 +    case SDEDM:
 +        if ((value & 0xf) == 0xf) {
 +            /* power down */
 +            value &= ~0xf;
 +        }
 +        s->edm = value;
 +        break;
 +    case SDHCFG:
 +        s->config = value;
 +        bcm2835_sdhost_fifo_run(s);
 +        break;
 +    case SDVDD:
 +        s->vdd = value;
 +        break;
 +    case SDDATA:
 +        bcm2835_sdhost_fifo_push(s, value);
 +        bcm2835_sdhost_fifo_run(s);
 +        break;
 +    case SDHBCT:
 +        s->hbct = value;
 +        break;
 +    case SDHBLC:
 +        s->hblc = value;
 +        s->datacnt = s->hblc * s->hbct;
 +        bcm2835_sdhost_fifo_run(s);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 +                      __func__, offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps bcm2835_sdhost_ops = {
 +    .read = bcm2835_sdhost_read,
 +    .write = bcm2835_sdhost_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static const VMStateDescription vmstate_bcm2835_sdhost = {
 +    .name = TYPE_BCM2835_SDHOST,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(cmd, BCM2835SDHostState),
 +        VMSTATE_UINT32(cmdarg, BCM2835SDHostState),
 +        VMSTATE_UINT32(status, BCM2835SDHostState),
 +        VMSTATE_UINT32_ARRAY(rsp, BCM2835SDHostState, 4),
 +        VMSTATE_UINT32(config, BCM2835SDHostState),
 +        VMSTATE_UINT32(edm, BCM2835SDHostState),
 +        VMSTATE_UINT32(vdd, BCM2835SDHostState),
 +        VMSTATE_UINT32(hbct, BCM2835SDHostState),
 +        VMSTATE_UINT32(hblc, BCM2835SDHostState),
 +        VMSTATE_INT32(fifo_pos, BCM2835SDHostState),
 +        VMSTATE_INT32(fifo_len, BCM2835SDHostState),
 +        VMSTATE_UINT32_ARRAY(fifo, BCM2835SDHostState, BCM2835_SDHOST_FIFO_LEN),
 +        VMSTATE_UINT32(datacnt, BCM2835SDHostState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void bcm2835_sdhost_init(Object *obj)
 +{
 +    BCM2835SDHostState *s = BCM2835_SDHOST(obj);
 +
 +    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
 +                        TYPE_BCM2835_SDHOST_BUS, DEVICE(s), "sd-bus");
 +
 +    memory_region_init_io(&s->iomem, obj, &bcm2835_sdhost_ops, s,
 +                          TYPE_BCM2835_SDHOST, 0x1000);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 +    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
 +}
 +
 +static void bcm2835_sdhost_reset(DeviceState *dev)
 +{
 +    BCM2835SDHostState *s = BCM2835_SDHOST(dev);
 +
 +    s->cmd = 0;
 +    s->cmdarg = 0;
 +    s->edm = 0x0000c60f;
 +    s->config = 0;
 +    s->hbct = 0;
 +    s->hblc = 0;
 +    s->datacnt = 0;
 +    s->fifo_pos = 0;
 +    s->fifo_len = 0;
 +}
 +
 +static void bcm2835_sdhost_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = bcm2835_sdhost_reset;
 +    dc->vmsd = &vmstate_bcm2835_sdhost;
 +}
 +
 +static TypeInfo bcm2835_sdhost_info = {
 +    .name          = TYPE_BCM2835_SDHOST,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(BCM2835SDHostState),
 +    .class_init    = bcm2835_sdhost_class_init,
 +    .instance_init = bcm2835_sdhost_init,
 +};
 +
 +static const TypeInfo bcm2835_sdhost_bus_info = {
 +    .name = TYPE_BCM2835_SDHOST_BUS,
 +    .parent = TYPE_SD_BUS,
 +    .instance_size = sizeof(SDBus),
 +};
 +
 +static void bcm2835_sdhost_register_types(void)
 +{
 +    type_register_static(&bcm2835_sdhost_info);
 +    type_register_static(&bcm2835_sdhost_bus_info);
 +}
 +
 +type_init(bcm2835_sdhost_register_types)
 --
 .7.4

-[Qemu-devel] [PULL 30/30] hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID
+[Qemu-devel] [PULL 3/9] MAINTAINERS: Add entries for Smartfusion2
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-The Exynos4210 has cluster ID 0x9 in its MPIDR register (raw value
+Voluntarily add myself as maintainer for Smartfusion2
 x8000090x).  If this cluster ID is not provided, then Linux kernel
 cannot map DeviceTree nodes to MPIDR values resulting in kernel
 warning and lack of any secondary CPUs:
-    DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map
+Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-    ...
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-    smp: Bringing up secondary CPUs ...
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-    smp: Brought up 1 node, 1 CPU
+Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
     SMP: Total of 1 processors activated (24.00 BogoMIPS).
 Provide a cluster ID so Linux will see proper MPIDR and will try to
 bring the secondary CPU online.
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Message-id: 20170226200142.31169-2-krzk@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4210.c | 12 ++++++++++++
+ MAINTAINERS | 17 +++++++++++++++++
-file changed, 12 insertions(+)
+file changed, 17 insertions(+)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/MAINTAINERS
-+++ b/hw/arm/exynos4210.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
-                        info->smp_loader_start);
+ S: Maintained
- }
+ F: hw/arm/netduino2.c
-+static uint64_t exynos4210_calc_affinity(int cpu)
++SmartFusion2
-+{
++M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-+    uint64_t mp_affinity;
++S: Maintained
 +F: hw/arm/msf2-soc.c
 +F: hw/misc/msf2-sysreg.c
 +F: hw/timer/mss-timer.c
 +F: hw/ssi/mss-spi.c
 +F: include/hw/arm/msf2-soc.h
 +F: include/hw/misc/msf2-sysreg.h
 +F: include/hw/timer/mss-timer.h
 +F: include/hw/ssi/mss-spi.h
 +
-+    /* Exynos4210 has 0x9 as cluster ID */
++Emcraft M2S-FG484
-+    mp_affinity = (0x9 << ARM_AFF1_SHIFT) | cpu;
++M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 +S: Maintained
 +F: hw/arm/msf2-som.c
 +
-+    return mp_affinity;
+ CRIS Machines
-+}
+ -------------
-+
+ Axis Dev88
  Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
          unsigned long ram_size)
  {
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
          }
          s->cpu[n] = ARM_CPU(cpuobj);
 +        object_property_set_int(cpuobj, exynos4210_calc_affinity(n),
 +                                "mp-affinity", &error_abort);
          object_property_set_int(cpuobj, EXYNOS4210_SMP_PRIVATE_BASE_ADDR,
                                  "reset-cbar", &error_abort);
          object_property_set_bool(cpuobj, true, "realized", &error_fatal);
 --
 .7.4

-[Qemu-devel] [PULL 28/30] bcm2835: add sdhost and gpio controllers
+[Qemu-devel] [PULL 4/9] qom: move CPUClass.tcg_initialize to a global
-From: Clement Deschamps <clement.deschamps@antfield.fr>
+From: "Emilio G. Cota" <cota@braap.org>
-This adds the bcm2835_sdhost and bcm2835_gpio to the BCM2835 platform.
+c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
 introduces a per-CPUClass bool that we check so that the target CPU
 is initialized for TCG only once. This works well except when
 we end up creating more than one CPUClass, in which case we end
 up incorrectly initializing TCG more than once, i.e. once for
 each CPUClass.
-For supporting the SD controller selection (alternate function of GPIOs
+This can be replicated with:
--53), the bcm2835_gpio now exposes an sdbus.
+  $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
-It also has a link to both the sdbus of sdhci and sdhost controllers,
+      -global driver=xlnx,,zynqmp,property=has_rpu,value=on
-and the card is reparented from one bus to another when the alternate
+In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
-function of GPIOs 48-53 is modified.
+whereas the "regular" CPUs are prefixed by "cortex-a53-". This
 results in two CPUClass instances being created.
-Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
+Fix it by introducing a static variable, so that only the first
-Message-id: 20170224164021.9066-5-clement.deschamps@antfield.fr
+target CPU being initialized will initialize the target-dependent
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+part of TCG, regardless of CPUClass instances.
 Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alistair Francis <alistair.francis@xilinx.com>
 Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2835_peripherals.h |  4 ++++
+ include/qom/cpu.h | 1 -
- hw/arm/bcm2835_peripherals.c         | 43 ++++++++++++++++++++++++++++++++++--
+ exec.c            | 5 +++--
-files changed, 45 insertions(+), 2 deletions(-)
+files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
+diff --git a/include/qom/cpu.h b/include/qom/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2835_peripherals.h
+--- a/include/qom/cpu.h
-+++ b/include/hw/arm/bcm2835_peripherals.h
++++ b/include/qom/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
- #include "hw/misc/bcm2835_rng.h"
+     /* Keep non-pointer data at the end to minimize holes.  */
- #include "hw/misc/bcm2835_mbox.h"
+     int gdb_num_core_regs;
- #include "hw/sd/sdhci.h"
+     bool gdb_stop_before_watchpoint;
-+#include "hw/sd/bcm2835_sdhost.h"
+-    bool tcg_initialized;
-+#include "hw/gpio/bcm2835_gpio.h"
+ } CPUClass;
- #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
+ #ifdef HOST_WORDS_BIGENDIAN
- #define BCM2835_PERIPHERALS(obj) \
+diff --git a/exec.c b/exec.c
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
      BCM2835RngState rng;
      BCM2835MboxState mboxes;
      SDHCIState sdhci;
 +    BCM2835SDHostState sdhost;
 +    BCM2835GpioState gpio;
  } BCM2835PeripheralState;
  #endif /* BCM2835_PERIPHERALS_H */
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2835_peripherals.c
+--- a/exec.c
-+++ b/hw/arm/bcm2835_peripherals.c
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
-     object_property_add_child(obj, "sdhci", OBJECT(&s->sdhci), NULL);
+ void cpu_exec_realizefn(CPUState *cpu, Error **errp)
-     qdev_set_parent_bus(DEVICE(&s->sdhci), sysbus_get_default());
+ {
+     CPUClass *cc = CPU_GET_CLASS(cpu);
-+    /* SDHOST */
++    static bool tcg_target_initialized;
-+    object_initialize(&s->sdhost, sizeof(s->sdhost), TYPE_BCM2835_SDHOST);
-+    object_property_add_child(obj, "sdhost", OBJECT(&s->sdhost), NULL);
+     cpu_list_add(cpu);
-+    qdev_set_parent_bus(DEVICE(&s->sdhost), sysbus_get_default());
-+
+-    if (tcg_enabled() && !cc->tcg_initialized) {
-     /* DMA Channels */
+-        cc->tcg_initialized = true;
-     object_initialize(&s->dma, sizeof(s->dma), TYPE_BCM2835_DMA);
++    if (tcg_enabled() && !tcg_target_initialized) {
-     object_property_add_child(obj, "dma", OBJECT(&s->dma), NULL);
++        tcg_target_initialized = true;
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
+         cc->tcg_initialize();
      object_property_add_const_link(OBJECT(&s->dma), "dma-mr",
                                     OBJECT(&s->gpu_bus_mr), &error_abort);
 +
 +    /* GPIO */
 +    object_initialize(&s->gpio, sizeof(s->gpio), TYPE_BCM2835_GPIO);
 +    object_property_add_child(obj, "gpio", OBJECT(&s->gpio), NULL);
 +    qdev_set_parent_bus(DEVICE(&s->gpio), sysbus_get_default());
 +
 +    object_property_add_const_link(OBJECT(&s->gpio), "sdbus-sdhci",
 +                                   OBJECT(&s->sdhci.sdbus), &error_abort);
 +    object_property_add_const_link(OBJECT(&s->gpio), "sdbus-sdhost",
 +                                   OBJECT(&s->sdhost.sdbus), &error_abort);
  }
  static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
          qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
                                 INTERRUPT_ARASANSDIO));
 -    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->sdhci), "sd-bus",
 -                              &err);
 +
 +    /* SDHOST */
 +    object_property_set_bool(OBJECT(&s->sdhost), true, "realized", &err);
      if (err) {
          error_propagate(errp, err);
          return;
      }
-+    memory_region_add_subregion(&s->peri_mr, MMCI0_OFFSET,
-+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhost), 0));
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhost), 0,
-+        qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
-+                               INTERRUPT_SDIO));
-+
-     /* DMA Channels */
-     object_property_set_bool(OBJECT(&s->dma), true, "realized", &err);
-     if (err) {
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
-                                                   BCM2835_IC_GPU_IRQ,
-                                                   INTERRUPT_DMA0 + n));
-     }
-+
-+    /* GPIO */
-+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
-+    if (err) {
-+        error_propagate(errp, err);
-+        return;
-+    }
-+
-+    memory_region_add_subregion(&s->peri_mr, GPIO_OFFSET,
-+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->gpio), 0));
-+
-+    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->gpio), "sd-bus",
-+                              &err);
-+    if (err) {
-+        error_propagate(errp, err);
-+        return;
-+    }
- }
- static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
 --
 .7.4

-[Qemu-devel] [PULL 22/30] armv7m: Check exception return consistency
+[Qemu-devel] [PULL 5/9] xlnx-zynqmp: Properly support the smp command line option
-Implement the exception return consistency checks
+From: Alistair Francis <alistair.francis@xilinx.com>
 described in the v7M pseudocode ExceptionReturn().
-Inspired by a patch from Michael Davidsaver's series, but
+Allow the -smp command line option to control the number of CPUs we
-this is a reimplementation from scratch based on the
+create.
 ARM ARM pseudocode.
+Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
+Reviewed-by: Emilio G. Cota <cota@braap.org>
+Tested-by: Emilio G. Cota <cota@braap.org>
+Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 ---
- target/arm/cpu.h      |  12 +++++-
+ hw/arm/xlnx-zcu102.c |  3 ++-
- hw/intc/armv7m_nvic.c |  12 +++++-
+ hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
- target/arm/helper.c   | 112 +++++++++++++++++++++++++++++++++++++++++++++-----
+files changed, 18 insertions(+), 11 deletions(-)
 files changed, 123 insertions(+), 13 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/xlnx-zcu102.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
- #endif
+ {
- void armv7m_nvic_set_pending(void *opaque, int irq);
+     MachineClass *mc = MACHINE_CLASS(oc);
- void armv7m_nvic_acknowledge_irq(void *opaque);
--void armv7m_nvic_complete_irq(void *opaque, int irq);
+-    mc->desc = "Xilinx ZynqMP ZCU102 board";
-+/**
++    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
-+ * armv7m_nvic_complete_irq: complete specified interrupt or exception
++               "the value of smp";
-+ * @opaque: the NVIC
+     mc->init = xlnx_zcu102_init;
-+ * @irq: the exception number to complete
+     mc->block_default_type = IF_IDE;
-+ *
+     mc->units_per_default_bus = 1;
-+ * Returns: -1 if the irq was not active
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 + *           1 if completing this irq brought us back to base (no active irqs)
 + *           0 if there is still an irq active after this one was completed
 + * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
 + */
 +int armv7m_nvic_complete_irq(void *opaque, int irq);
  /* Interface for defining coprocessor registers.
   * Registers are defined in tables of arm_cp_reginfo structs
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
      nvic_irq_update(s);
  }
 -void armv7m_nvic_complete_irq(void *opaque, int irq)
 +int armv7m_nvic_complete_irq(void *opaque, int irq)
  {
-     NVICState *s = (NVICState *)opaque;
+     Error *err = NULL;
-     VecInfo *vec;
+     int i;
-+    int ret;
++    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
-     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
+-    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
++    for (i = 0; i < num_rpus; i++) {
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_complete_irq(void *opaque, int irq)
+         char *name;
-     trace_nvic_complete_irq(irq);
+         object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
-+    if (!vec->active) {
+ {
-+        /* Tell the caller this was an illegal exception return */
+     XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
-+        return -1;
+     int i;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                            "cortex-a53-" TYPE_ARM_CPU);
          object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      MemoryRegion *system_memory = get_system_memory();
      uint8_t i;
      uint64_t ram_size;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
      const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
      ram_addr_t ddr_low_size, ddr_high_size;
      qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
      qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
 -    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
 +    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
      /* Realize APUs before realizing the GIC. KVM requires this.  */
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          char *name;
          object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          }
      }
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          qemu_irq irq;
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      }
      if (s->has_rpu) {
 -        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
 -        if (err) {
 -            error_propagate(errp, err);
 -            return;
 -        }
 +        info_report("The 'has_rpu' property is no longer required, to use the "
 +                    "RPUs just use -smp 6.");
 +    }
 +
-+    ret = nvic_rettobase(s);
++    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
-+
++    if (err) {
-     vec->active = 0;
++        error_propagate(errp, err);
      if (vec->level) {
          /* Re-pend the exception if it's still held high; only
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_complete_irq(void *opaque, int irq)
      }
      nvic_irq_update(s);
 +
 +    return ret;
  }
  /* callback when external interrupt line is changed */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
      v7m_push(env, env->regs[0]);
  }
 -static void do_v7m_exception_exit(CPUARMState *env)
 +static void do_v7m_exception_exit(ARMCPU *cpu)
  {
 +    CPUARMState *env = &cpu->env;
      uint32_t type;
      uint32_t xpsr;
 -
 +    bool ufault = false;
 +    bool return_to_sp_process = false;
 +    bool return_to_handler = false;
 +    bool rettobase = false;
 +
 +    /* We can only get here from an EXCP_EXCEPTION_EXIT, and
 +     * arm_v7m_do_unassigned_access() enforces the architectural rule
 +     * that jumps to magic addresses don't have magic behaviour unless
 +     * we're in Handler mode (compare pseudocode BXWritePC()).
 +     */
 +    assert(env->v7m.exception != 0);
 +
 +    /* In the spec pseudocode ExceptionReturn() is called directly
 +     * from BXWritePC() and gets the full target PC value including
 +     * bit zero. In QEMU's implementation we treat it as a normal
 +     * jump-to-register (which is then caught later on), and so split
 +     * the target value up between env->regs[15] and env->thumb in
 +     * gen_bx(). Reconstitute it.
 +     */
      type = env->regs[15];
 +    if (env->thumb) {
 +        type |= 1;
 +    }
 +
 +    qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
 +                  " previous exception %d\n",
 +                  type, env->v7m.exception);
 +
 +    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
 +                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
 +    }
 +
      if (env->v7m.exception != ARMV7M_EXCP_NMI) {
          /* Auto-clear FAULTMASK on return from other than NMI */
          env->daif &= ~PSTATE_F;
      }
 -    if (env->v7m.exception != 0) {
 -        armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
 +
 +    switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception)) {
 +    case -1:
 +        /* attempt to exit an exception that isn't active */
 +        ufault = true;
 +        break;
 +    case 0:
 +        /* still an irq active now */
 +        break;
 +    case 1:
 +        /* we returned to base exception level, no nesting.
 +         * (In the pseudocode this is written using "NestedActivation != 1"
 +         * where we have 'rettobase == false'.)
 +         */
 +        rettobase = true;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    switch (type & 0xf) {
 +    case 1: /* Return to Handler */
 +        return_to_handler = true;
 +        break;
 +    case 13: /* Return to Thread using Process stack */
 +        return_to_sp_process = true;
 +        /* fall through */
 +    case 9: /* Return to Thread using Main stack */
 +        if (!rettobase &&
 +            !(env->v7m.ccr & R_V7M_CCR_NONBASETHRDENA_MASK)) {
 +            ufault = true;
 +        }
 +        break;
 +    default:
 +        ufault = true;
 +    }
 +
 +    if (ufault) {
 +        /* Bad exception return: instead of popping the exception
 +         * stack, directly take a usage fault on the current stack.
 +         */
 +        env->v7m.cfsr |= R_V7M_CFSR_INVPC_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
 +        v7m_exception_taken(cpu, type | 0xf0000000);
 +        qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
 +                      "stackframe: failed exception return integrity check\n");
 +        return;
      }
-     /* Switch to the target stack.  */
+     if (!s->boot_cpu_ptr) {
 -    switch_v7m_sp(env, (type & 4) != 0);
 +    switch_v7m_sp(env, return_to_sp_process);
      /* Pop registers.  */
      env->regs[0] = v7m_pop(env);
      env->regs[1] = v7m_pop(env);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(CPUARMState *env)
      /* Undo stack alignment.  */
      if (xpsr & 0x200)
          env->regs[13] |= 4;
 -    /* ??? The exception return type specifies Thread/Handler mode.  However
 -       this is also implied by the xPSR value. Not sure what to do
 -       if there is a mismatch.  */
 -    /* ??? Likewise for mismatches between the CONTROL register and the stack
 -       pointer.  */
 +
 +    /* The restored xPSR exception field will be zero if we're
 +     * resuming in Thread mode. If that doesn't match what the
 +     * exception return type specified then this is a UsageFault.
 +     */
 +    if (return_to_handler == (env->v7m.exception == 0)) {
 +        /* Take an INVPC UsageFault by pushing the stack again. */
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
 +        env->v7m.cfsr |= R_V7M_CFSR_INVPC_MASK;
 +        v7m_push_stack(cpu);
 +        v7m_exception_taken(cpu, type | 0xf0000000);
 +        qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
 +                      "failed exception return integrity check\n");
 +        return;
 +    }
 +
 +    /* Otherwise, we have a successful exception exit. */
 +    qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
  }
  static void arm_log_exception(int idx)
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
      case EXCP_IRQ:
          break;
      case EXCP_EXCEPTION_EXIT:
 -        do_v7m_exception_exit(env);
 +        do_v7m_exception_exit(cpu);
          return;
      default:
          cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
 --
 .7.4

-[Qemu-devel] [PULL 11/30] ARM i.MX timers: fix reset handling
+[Qemu-devel] [PULL 6/9] xlnx-zcu102: Add an info message deprecating the EP108
-From: Kurban Mallachiev <mallachiev@ispras.ru>
+From: Alistair Francis <alistair.francis@xilinx.com>
-The i.MX timer device can be reset by writing to the SWR bit
+The EP108 was an early access development board that is no longer used.
-of the CR register. This has to behave differently from hard
+Add an info message to convert any users to the ZCU102 instead. On QEMU
-(power-on) reset because it does not reset all of the bits
+they are both identical.
 in the CR register.
-We were incorrectly implementing soft reset and hard reset
+This patch also updated the qemu-doc.texi file to indicate that the
-the same way, and in addition had a logic error which meant
+EP108 has been deprecated.
 that we were clearing the bits that soft-reset is supposed
 to preserve and not touching the bits that soft-reset clears.
 This was not correct behaviour for either kind of reset.
-Separate out the soft reset and hard reset code paths, and
+Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-correct the handling of reset of the CR register so that it
+Reviewed-by: Emilio G. Cota <cota@braap.org>
-is correct in both cases.
+Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
 Signed-off-by: Kurban Mallachiev <mallachiev@ispras.ru>
 [PMM: rephrased commit message, spacing on operators;
  use bool rather than int for is_soft_reset]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/imx_gpt.c | 33 +++++++++++++++++++++++++--------
+ hw/arm/xlnx-zcu102.c | 3 +++
-file changed, 25 insertions(+), 8 deletions(-)
+ qemu-doc.texi        | 7 +++++++
 files changed, 10 insertions(+)
-diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
+diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_gpt.c
+--- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/timer/imx_gpt.c
++++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t imx_gpt_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
-     return reg_value;
+ {
      XlnxZCU102 *s = EP108_MACHINE(machine);
 +    info_report("The Xilinx EP108 machine is deprecated, please use the "
 +                "ZCU102 machine instead. It has the same features supported.");
 +
      xlnx_zynqmp_init(s, machine);
  }
--static void imx_gpt_reset(DeviceState *dev)
+diff --git a/qemu-doc.texi b/qemu-doc.texi
--{
+index XXXXXXX..XXXXXXX 100644
--    IMXGPTState *s = IMX_GPT(dev);
+--- a/qemu-doc.texi
++++ b/qemu-doc.texi
-+static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
+@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
-+{
+ The ``spapr-pci-vfio-host-bridge'' device type is replaced by
-     /* stop timer */
+ the ``spapr-pci-host-bridge'' device type.
-     ptimer_stop(s->timer);
++@section System emulator machines
 -    /*
 -     * Soft reset doesn't touch some bits; hard reset clears them
 +    /* Soft reset and hard reset differ only in their handling of the CR
 +     * register -- soft reset preserves the values of some bits there.
       */
 -    s->cr &= ~(GPT_CR_EN|GPT_CR_ENMOD|GPT_CR_STOPEN|GPT_CR_DOZEN|
 -               GPT_CR_WAITEN|GPT_CR_DBGEN);
 +    if (is_soft_reset) {
 +        /* Clear all CR bits except those that are preserved by soft reset. */
 +        s->cr &= GPT_CR_EN | GPT_CR_ENMOD | GPT_CR_STOPEN | GPT_CR_DOZEN |
 +            GPT_CR_WAITEN | GPT_CR_DBGEN |
 +            (GPT_CR_CLKSRC_MASK << GPT_CR_CLKSRC_SHIFT);
 +    } else {
 +        s->cr = 0;
 +    }
      s->sr = 0;
      s->pr = 0;
      s->ir = 0;
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_reset(DeviceState *dev)
      }
  }
 +static void imx_gpt_soft_reset(DeviceState *dev)
 +{
 +    IMXGPTState *s = IMX_GPT(dev);
 +    imx_gpt_reset_common(s, true);
 +}
 +
-+static void imx_gpt_reset(DeviceState *dev)
++@subsection Xilinx EP108 (since 2.11.0)
 +{
 +    IMXGPTState *s = IMX_GPT(dev);
 +    imx_gpt_reset_common(s, false);
 +}
 +
- static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
++The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
-                           unsigned size)
++The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
- {
++
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
+ @node License
-         s->cr = value & ~0x7c14;
+ @appendix License
-         if (s->cr & GPT_CR_SWR) { /* force reset */
              /* handle the reset */
 -            imx_gpt_reset(DEVICE(s));
 +            imx_gpt_soft_reset(DEVICE(s));
          } else {
              /* set our freq, as the source might have changed */
              imx_gpt_set_freq(s);
 --
 .7.4

-[Qemu-devel] [PULL 26/30] hw/sd: add card-reparenting function
+[Qemu-devel] [PULL 7/9] xlnx-zcu102: Specify the max number of CPUs for the EP108
-From: Clement Deschamps <clement.deschamps@antfield.fr>
+From: "Emilio G. Cota" <cota@braap.org>
-Provide a new function sdbus_reparent_card() in sd core for reparenting
+Just like the zcu102, the ep108 can instantiate several CPUs.
 a card from a SDBus to another one.
-This function is required by the raspi platform, where the two SD
+Signed-off-by: Emilio G. Cota <cota@braap.org>
-controllers can be dynamically switched.
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 1510343626-25861-5-git-send-email-cota@braap.org
 Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
 Message-id: 20170224164021.9066-3-clement.deschamps@antfield.fr
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: added a doc comment to the header file]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sd.h | 11 +++++++++++
+ hw/arm/xlnx-zcu102.c | 1 +
- hw/sd/core.c       | 30 ++++++++++++++++++++++++++++++
+file changed, 1 insertion(+)
 files changed, 41 insertions(+)
-diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
+diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sd.h
+--- a/hw/arm/xlnx-zcu102.c
-+++ b/include/hw/sd/sd.h
++++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ uint8_t sdbus_read_data(SDBus *sd);
+@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
- bool sdbus_data_ready(SDBus *sd);
+     mc->block_default_type = IF_IDE;
- bool sdbus_get_inserted(SDBus *sd);
+     mc->units_per_default_bus = 1;
- bool sdbus_get_readonly(SDBus *sd);
+     mc->ignore_memory_transaction_failures = true;
-+/**
++    mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 + * sdbus_reparent_card: Reparent an SD card from one controller to another
 + * @from: controller bus to remove card from
 + * @to: controller bus to move card to
 + *
 + * Reparent an SD card, effectively unplugging it from one controller
 + * and inserting it into another. This is useful for SoCs like the
 + * bcm2835 which have two SD controllers and connect a single SD card
 + * to them, selected by the guest reprogramming GPIO line routing.
 + */
 +void sdbus_reparent_card(SDBus *from, SDBus *to);
  /* Functions to be used by SD devices to report back to qdevified controllers */
  void sdbus_set_inserted(SDBus *sd, bool inserted);
 diff --git a/hw/sd/core.c b/hw/sd/core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/core.c
 +++ b/hw/sd/core.c
@@ -XXX,XX +XXX,XX @@ void sdbus_set_readonly(SDBus *sdbus, bool readonly)
      }
  }
-+void sdbus_reparent_card(SDBus *from, SDBus *to)
+ static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
 +{
 +    BusChild *kid = QTAILQ_FIRST(&from->qbus.children);
 +    SDState *card;
 +    SDCardClass *sc;
 +    bool readonly;
 +
 +    /* We directly reparent the card object rather than implementing this
 +     * as a hotpluggable connection because we don't want to expose SD cards
 +     * to users as being hotpluggable, and we can get away with it in this
 +     * limited use case. This could perhaps be implemented more cleanly in
 +     * future by adding support to the hotplug infrastructure for "device
 +     * can be hotplugged only via code, not by user".
 +     */
 +
 +    if (!kid) {
 +        return;
 +    }
 +
 +    card = SD_CARD(kid->child);
 +    sc = SD_CARD_GET_CLASS(card);
 +    readonly = sc->get_readonly(card);
 +
 +    sdbus_set_inserted(from, false);
 +    object_unparent(OBJECT(kid));
 +    qdev_set_parent_bus(DEVICE(card), &to->qbus);
 +    sdbus_set_inserted(to, true);
 +    sdbus_set_readonly(to, readonly);
 +}
 +
  static const TypeInfo sd_bus_info = {
      .name = TYPE_SD_BUS,
      .parent = TYPE_BUS,
 --
 .7.4

-[Qemu-devel] [PULL 10/30] hw/arm/virt: Add a user option to disallow ITS instantiation
+[Qemu-devel] [PULL 8/9] hw: add .min_cpus and .default_cpus fields to machine_class
-From: Eric Auger <eric.auger@redhat.com>
+From: "Emilio G. Cota" <cota@braap.org>
-In 2.9 ITS will block save/restore and migration use cases. As such,
+max_cpus needs to be an upper bound on the number of vCPUs
-let's introduce a user option that allows to turn its instantiation
+initialized; otherwise TCG region initialization breaks.
 off, along with GICv3. With the "its" option turned false, migration
 will be possible, obviously at the expense of MSI support (with GICv3).
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Some boards initialize a hard-coded number of vCPUs, which is not
-Message-id: 1487681108-14452-1-git-send-email-eric.auger@redhat.com
+captured by the global max_cpus and therefore breaks TCG initialization.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Fix it by adding the .min_cpus field to machine_class.
 This commit also changes some user-facing behaviour: we now die if
 -smp is below this hard-coded vCPU minimum instead of silently
 ignoring the passed -smp value (sometimes announcing this by printing
 a warning). However, the introduction of .default_cpus lessens the
 likelihood that users will notice this: if -smp isn't set, we now
 assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
 if a user does not set -smp, they always get a correct number of vCPUs.
 This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
 softmmu", 2017-10-24), which broke TCG initialization for some
 ARM boards.
 Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
 Reported-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h |  1 +
+ include/hw/boards.h     |  5 +++++
- hw/arm/virt.c         | 31 +++++++++++++++++++++++++++++--
+ hw/arm/exynos4_boards.c | 12 ++++--------
-files changed, 30 insertions(+), 2 deletions(-)
+ hw/arm/raspi.c          |  2 ++
  hw/arm/xlnx-zcu102.c    |  2 ++
  vl.c                    | 21 ++++++++++++++++++---
 files changed, 31 insertions(+), 11 deletions(-)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+diff --git a/include/hw/boards.h b/include/hw/boards.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/include/hw/boards.h
-+++ b/include/hw/arm/virt.h
++++ b/include/hw/boards.h
 @@ -XXX,XX +XXX,XX @@ typedef struct {
-     FWCfgState *fw_cfg;
-     bool secure;
+ /**
-     bool highmem;
+  * MachineClass:
-+    bool its;
++ * @max_cpus: maximum number of CPUs supported. Default: 1
-     bool virt;
++ * @min_cpus: minimum number of CPUs supported. Default: 1
-     int32_t gic_version;
++ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
-     struct arm_boot_info bootinfo;
+  * @get_hotplug_handler: this function is called during bus-less
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+  *    device hotplug. If defined it returns pointer to an instance
   *    of HotplugHandler object, which handles hotplug operation
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
      BlockInterfaceType block_default_type;
      int units_per_default_bus;
      int max_cpus;
 +    int min_cpus;
 +    int default_cpus;
      unsigned int no_serial:1,
          no_parallel:1,
          use_virtcon:1,
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/virt.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@
- static void create_gic(VirtMachineState *vms, qemu_irq *pic)
+ #include "qemu-common.h"
  #include "cpu.h"
  #include "sysemu/sysemu.h"
 -#include "sysemu/qtest.h"
  #include "hw/sysbus.h"
  #include "net/net.h"
  #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
                             Exynos4BoardType board_type)
  {
-     /* We create a standalone GIC */
+     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
--    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-     DeviceState *gicdev;
+-
-     SysBusDevice *gicbusdev;
+-    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-     const char *gictype;
+-        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
-@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, qemu_irq *pic)
+-                     " value",
+-                     mc->name, EXYNOS4210_NCPUS);
-     fdt_add_gic_node(vms);
+-    }
--    if (type == 3 && !vmc->no_its) {
+     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
-+    if (type == 3 && vms->its) {
+     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
-         create_its(vms, gicdev);
+@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
-     } else if (type == 2) {
+     mc->desc = "Samsung NURI board (Exynos4210)";
-         create_v2m(vms, pic);
+     mc->init = nuri_init;
-@@ -XXX,XX +XXX,XX @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+     mc->max_cpus = EXYNOS4210_NCPUS;
-     vms->highmem = value;
++    mc->min_cpus = EXYNOS4210_NCPUS;
 +    mc->default_cpus = EXYNOS4210_NCPUS;
      mc->ignore_memory_transaction_failures = true;
  }
-+static bool virt_get_its(Object *obj, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
-+{
+     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
+     mc->init = smdkc210_init;
      mc->max_cpus = EXYNOS4210_NCPUS;
 +    mc->min_cpus = EXYNOS4210_NCPUS;
 +    mc->default_cpus = EXYNOS4210_NCPUS;
      mc->ignore_memory_transaction_failures = true;
  }
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->max_cpus = BCM2836_NCPUS;
 +    mc->min_cpus = BCM2836_NCPUS;
 +    mc->default_cpus = BCM2836_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
      mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 +    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
  }
  static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
      mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 +    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
  }
  static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
 diff --git a/vl.c b/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/vl.c
 +++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
  Chardev *sclp_hds[MAX_SCLP_CONSOLES];
  int win2k_install_hack = 0;
  int singlestep = 0;
 -int smp_cpus = 1;
 -unsigned int max_cpus = 1;
 +int smp_cpus;
 +unsigned int max_cpus;
  int smp_cores = 1;
  int smp_threads = 1;
  int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          exit(0);
      }
 +    /* machine_class: default to UP */
 +    machine_class->max_cpus = machine_class->max_cpus ?: 1;
 +    machine_class->min_cpus = machine_class->min_cpus ?: 1;
 +    machine_class->default_cpus = machine_class->default_cpus ?: 1;
 +
-+    return vms->its;
++    /* default to machine_class->default_cpus */
-+}
++    smp_cpus = machine_class->default_cpus;
 +    max_cpus = machine_class->default_cpus;
 +
-+static void virt_set_its(Object *obj, bool value, Error **errp)
+     smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
-+{
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
+-    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
-+
++    /* sanity-check smp_cpus and max_cpus against machine_class */
-+    vms->its = value;
++    if (smp_cpus < machine_class->min_cpus) {
-+}
++        error_report("Invalid SMP CPUs %d. The min CPUs "
-+
++                     "supported by machine '%s' is %d", smp_cpus,
- static char *virt_get_gic_version(Object *obj, Error **errp)
++                     machine_class->name, machine_class->min_cpus);
- {
++        exit(1);
      VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ type_init(machvirt_machine_init);
  static void virt_2_9_instance_init(Object *obj)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
 +    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
      /* EL3 is disabled by default on virt: this makes us consistent
       * between KVM and TCG for this board, and it also allows us to
@@ -XXX,XX +XXX,XX @@ static void virt_2_9_instance_init(Object *obj)
                                      "Set GIC version. "
                                      "Valid values are 2, 3 and host", NULL);
 +    if (vmc->no_its) {
 +        vms->its = false;
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
 +        object_property_add_bool(obj, "its", virt_get_its,
 +                                 virt_set_its, NULL);
 +        object_property_set_description(obj, "its",
 +                                        "Set on/off to enable/disable "
 +                                        "ITS instantiation",
 +                                        NULL);
 +    }
-+
+     if (max_cpus > machine_class->max_cpus) {
-     vms->memmap = a15memmap;
+         error_report("Invalid SMP CPUs %d. The max CPUs "
-     vms->irqmap = a15irqmap;
+                      "supported by machine '%s' is %d", max_cpus,
  }
 --
 .7.4

-[Qemu-devel] [PULL 06/30] sd: sdhci: Remove block count enable check in single block transfers
+[Qemu-devel] [PULL 9/9] accel/tcg/translate-all: expand cpu_restore_state addr check
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-In SDHCI protocol, the 'Block count enable' bit of the Transfer
+We are still seeing signals during translation time when we walk over
-Mode register is relevant only in multi block transfers. We need
+a page protection boundary. This expands the check to ensure the host
-not check it in single block transfers.
+PC is inside the code generation buffer. The original suggestion was
 to check versus tcg_ctx.code_gen_ptr but as we now segment the
 translation buffer we have to settle for just a general check for
 being inside.
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+I've also fixed up the declaration to make it clear it can deal with
-Message-id: 20170214185225.7994-5-ppandit@redhat.com
+invalid addresses. A later patch will fix up the call sites.
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Laurent Vivier <laurent@vivier.eu>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
 Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Cc: Richard Henderson <rth@twiddle.net>
 Tested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 6 +-----
+ include/exec/exec-all.h   | 11 ++++++++++
-file changed, 1 insertion(+), 5 deletions(-)
+ accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
 files changed, 40 insertions(+), 23 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/include/exec/exec-all.h
-+++ b/hw/sd/sdhci.c
++++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
+@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
                            target_ulong *data);
  void cpu_gen_init(void);
 +
 +/**
 + * cpu_restore_state:
 + * @cpu: the vCPU state is to be restore to
 + * @searched_pc: the host PC the fault occurred at
 + * @return: true if state was restored, false otherwise
 + *
 + * Attempt to restore the state for a fault occurring in translated
 + * code. If the searched_pc is not in translated code no state is
 + * restored and the function returns false.
 + */
  bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
  void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
      return 0;
  }
- /* single block SDMA transfer */
+-bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
 +bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
  {
      TranslationBlock *tb;
      bool r = false;
 +    uintptr_t check_offset;
 -    /* A retaddr of zero is invalid so we really shouldn't have ended
 -     * up here. The target code has likely forgotten to check retaddr
 -     * != 0 before attempting to restore state. We return early to
 -     * avoid blowing up on a recursive tb_lock(). The target must have
 -     * previously survived a failed cpu_restore_state because
 -     * tb_find_pc(0) would have failed anyway. It still should be
 -     * fixed though.
 +    /* The host_pc has to be in the region of current code buffer. If
 +     * it is not we will not be able to resolve it here. The two cases
 +     * where host_pc will not be correct are:
 +     *
 +     *  - fault during translation (instruction fetch)
 +     *  - fault from helper (not using GETPC() macro)
 +     *
 +     * Either way we need return early to avoid blowing up on a
 +     * recursive tb_lock() as we can't resolve it here.
 +     *
 +     * We are using unsigned arithmetic so if host_pc <
 +     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
 +     * above the code_gen_buffer_size
       */
 -
- static void sdhci_sdma_transfer_single_block(SDHCIState *s)
+-    if (!retaddr) {
- {
+-        return r;
-     int n;
+-    }
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
+-
-             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
+-    tb_lock();
 -    tb = tb_find_pc(retaddr);
 -    if (tb) {
 -        cpu_restore_state_from_tb(cpu, tb, retaddr);
 -        if (tb->cflags & CF_NOCACHE) {
 -            /* one-shot translation, invalidate it immediately */
 -            tb_phys_invalidate(tb, -1);
 -            tb_remove(tb);
 +    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
 +
 +    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
 +        tb_lock();
 +        tb = tb_find_pc(host_pc);
 +        if (tb) {
 +            cpu_restore_state_from_tb(cpu, tb, host_pc);
 +            if (tb->cflags & CF_NOCACHE) {
 +                /* one-shot translation, invalidate it immediately */
 +                tb_phys_invalidate(tb, -1);
 +                tb_remove(tb);
 +            }
 +            r = true;
          }
+-        r = true;
++        tb_unlock();
      }
--
+-    tb_unlock();
--    if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
--        s->blkcnt--;
+     return r;
 -    }
 +    s->blkcnt--;
      sdhci_end_transfer(s);
  }
 --
 .7.4

-[Qemu-devel] [PULL 07/30] hw/arm/virt: fix cpu object reference leak
+Deleted patch
-From: Igor Mammedov <imammedo@redhat.com>
-object_new(FOO) returns an object with ref_cnt == 1
-and following
-  object_property_set_bool(cpuobj, true, "realized", NULL)
-set parent of cpuobj to '/machine/unattached' which makes
-ref_cnt == 2.
-Since machvirt_init() doesn't take ownership of cpuobj
-returned by object_new() it should explicitly drop
-reference to cpuobj when dangling pointer is about to
-go out of scope like it's done pc_new_cpu() to avoid
-object leak.
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Message-id: 1487253461-269218-1-git-send-email-imammedo@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-         }
-         object_property_set_bool(cpuobj, true, "realized", NULL);
-+        object_unref(cpuobj);
-     }
-     fdt_add_timer_nodes(vms);
-     fdt_add_cpu_nodes(vms);
---
-.7.4

-[Qemu-devel] [PULL 09/30] cputlb: Don't assume do_unassigned_access() never returns
+Deleted patch
-In get_page_addr_code(), if the guest PC doesn't correspond to RAM
-then we currently run the CPU's do_unassigned_access() hook if it has
-one, and otherwise we give up and exit QEMU with a more-or-less
-useful message.  This code assumes that the do_unassigned_access hook
-will never return, because if it does then we'll plough on attempting
-to use a non-RAM TLB entry to get a RAM address and will abort() in
-qemu_ram_addr_from_host_nofail().  Unfortunately some CPU
-implementations of this hook do return: Microblaze, SPARC and the ARM
-v7M.
-Change the code to call report_bad_exec() if the hook returns, as
-well as if it didn't have one.  This means we can tidy it up to use
-the cpu_unassigned_access() function which wraps the "get the CPU
-class and call the hook if it has one" work, since we aren't trying
-to distinguish "no hook" from "hook existed and returned" any more.
-This brings the handling of this hook into line with the handling
-used for data accesses, where "hook returned" is treated the
-same as "no hook existed" and gets you the default behaviour.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <rth@twiddle.net>
----
- cputlb.c | 15 +++++++--------
-file changed, 7 insertions(+), 8 deletions(-)
-diff --git a/cputlb.c b/cputlb.c
-index XXXXXXX..XXXXXXX 100644
---- a/cputlb.c
-+++ b/cputlb.c
-@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
-     pd = iotlbentry->addr & ~TARGET_PAGE_MASK;
-     mr = iotlb_to_region(cpu, pd, iotlbentry->attrs);
-     if (memory_region_is_unassigned(mr)) {
--        CPUClass *cc = CPU_GET_CLASS(cpu);
--
--        if (cc->do_unassigned_access) {
--            cc->do_unassigned_access(cpu, addr, false, true, 0, 4);
--        } else {
--            report_bad_exec(cpu, addr);
--            exit(1);
--        }
-+        cpu_unassigned_access(cpu, addr, false, true, 0, 4);
-+        /* The CPU's unassigned access hook might have longjumped out
-+         * with an exception. If it didn't (or there was no hook) then
-+         * we can't proceed further.
-+         */
-+        report_bad_exec(cpu, addr);
-+        exit(1);
-     }
-     p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
-     return qemu_ram_addr_from_host_nofail(p);
---
-.7.4

-[Qemu-devel] [PULL 12/30] armv7m: Rename nvic_state to NVICState
+Deleted patch
-Rename the nvic_state struct to NVICState, to match
-our naming conventions.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 44 ++++++++++++++++++++++----------------------
-file changed, 22 insertions(+), 22 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
- #include "gic_internal.h"
- #include "qemu/log.h"
--typedef struct {
-+typedef struct NVICState {
-     GICState gic;
-     ARMCPU *cpu;
-     struct {
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     MemoryRegion container;
-     uint32_t num_irq;
-     qemu_irq sysresetreq;
--} nvic_state;
-+} NVICState;
- #define TYPE_NVIC "armv7m_nvic"
- /**
-@@ -XXX,XX +XXX,XX @@ typedef struct NVICClass {
- #define NVIC_GET_CLASS(obj) \
-     OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC)
- #define NVIC(obj) \
--    OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC)
-+    OBJECT_CHECK(NVICState, (obj), TYPE_NVIC)
- static const uint8_t nvic_id[] = {
-x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
-@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
- int system_clock_scale;
- /* Conversion factor from qemu timer to SysTick frequencies.  */
--static inline int64_t systick_scale(nvic_state *s)
-+static inline int64_t systick_scale(NVICState *s)
- {
-     if (s->systick.control & SYSTICK_CLKSOURCE)
-         return system_clock_scale;
-@@ -XXX,XX +XXX,XX @@ static inline int64_t systick_scale(nvic_state *s)
-         return 1000;
- }
--static void systick_reload(nvic_state *s, int reset)
-+static void systick_reload(NVICState *s, int reset)
- {
-     /* The Cortex-M3 Devices Generic User Guide says that "When the
-      * ENABLE bit is set to 1, the counter loads the RELOAD value from the
-@@ -XXX,XX +XXX,XX @@ static void systick_reload(nvic_state *s, int reset)
- static void systick_timer_tick(void * opaque)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     s->systick.control |= SYSTICK_COUNTFLAG;
-     if (s->systick.control & SYSTICK_TICKINT) {
-         /* Trigger the interrupt.  */
-@@ -XXX,XX +XXX,XX @@ static void systick_timer_tick(void * opaque)
-     }
- }
--static void systick_reset(nvic_state *s)
-+static void systick_reset(NVICState *s)
- {
-     s->systick.control = 0;
-     s->systick.reload = 0;
-@@ -XXX,XX +XXX,XX @@ static void systick_reset(nvic_state *s)
-    IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
- void armv7m_nvic_set_pending(void *opaque, int irq)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     if (irq >= 16)
-         irq += 16;
-     gic_set_pending_private(&s->gic, 0, irq);
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq)
- /* Make pending IRQ active.  */
- int armv7m_nvic_acknowledge_irq(void *opaque)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     uint32_t irq;
-     irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED);
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_acknowledge_irq(void *opaque)
- void armv7m_nvic_complete_irq(void *opaque, int irq)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     if (irq >= 16)
-         irq += 16;
-     gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED);
- }
--static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
-+static uint32_t nvic_readl(NVICState *s, uint32_t offset)
- {
-     ARMCPU *cpu = s->cpu;
-     uint32_t val;
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
-     }
- }
--static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
-+static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
- {
-     ARMCPU *cpu = s->cpu;
-     uint32_t oldval;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
- static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
-                                  unsigned size)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     uint32_t offset = addr;
-     int i;
-     uint32_t val;
-@@ -XXX,XX +XXX,XX @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
- static void nvic_sysreg_write(void *opaque, hwaddr addr,
-                               uint64_t value, unsigned size)
- {
--    nvic_state *s = (nvic_state *)opaque;
-+    NVICState *s = (NVICState *)opaque;
-     uint32_t offset = addr;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {
-     .version_id = 1,
-     .minimum_version_id = 1,
-     .fields = (VMStateField[]) {
--        VMSTATE_UINT32(systick.control, nvic_state),
--        VMSTATE_UINT32(systick.reload, nvic_state),
--        VMSTATE_INT64(systick.tick, nvic_state),
--        VMSTATE_TIMER_PTR(systick.timer, nvic_state),
-+        VMSTATE_UINT32(systick.control, NVICState),
-+        VMSTATE_UINT32(systick.reload, NVICState),
-+        VMSTATE_INT64(systick.tick, NVICState),
-+        VMSTATE_TIMER_PTR(systick.timer, NVICState),
-         VMSTATE_END_OF_LIST()
-     }
- };
- static void armv7m_nvic_reset(DeviceState *dev)
- {
--    nvic_state *s = NVIC(dev);
-+    NVICState *s = NVIC(dev);
-     NVICClass *nc = NVIC_GET_CLASS(s);
-     nc->parent_reset(dev);
-     /* Common GIC reset resets to disabled; the NVIC doesn't have
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
- static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
- {
--    nvic_state *s = NVIC(dev);
-+    NVICState *s = NVIC(dev);
-     NVICClass *nc = NVIC_GET_CLASS(s);
-     Error *local_err = NULL;
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
-      */
-     GICState *s = ARM_GIC_COMMON(obj);
-     DeviceState *dev = DEVICE(obj);
--    nvic_state *nvic = NVIC(obj);
-+    NVICState *nvic = NVIC(obj);
-     /* The ARM v7m may have anything from 0 to 496 external interrupt
-      * IRQ lines. We default to 64. Other boards may differ and should
-      * set the num-irq property appropriately.
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo armv7m_nvic_info = {
-     .name          = TYPE_NVIC,
-     .parent        = TYPE_ARM_GIC_COMMON,
-     .instance_init = armv7m_nvic_instance_init,
--    .instance_size = sizeof(nvic_state),
-+    .instance_size = sizeof(NVICState),
-     .class_init    = armv7m_nvic_class_init,
-     .class_size    = sizeof(NVICClass),
- };
---
-.7.4

-[Qemu-devel] [PULL 13/30] armv7m: Implement reading and writing of PRIGROUP
+Deleted patch
-Add a state field for the v7M PRIGROUP register and implent
-reading and writing it. The current NVIC doesn't honour
-the values written, but the new version will.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 14 ++++++++------
-file changed, 8 insertions(+), 6 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
- typedef struct NVICState {
-     GICState gic;
-     ARMCPU *cpu;
-+
-+    uint32_t prigroup;
-+
-     struct {
-         uint32_t control;
-         uint32_t reload;
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
-     case 0xd08: /* Vector Table Offset.  */
-         return cpu->env.v7m.vecbase;
-     case 0xd0c: /* Application Interrupt/Reset Control.  */
--        return 0xfa050000;
-+        return 0xfa050000 | (s->prigroup << 8);
-     case 0xd10: /* System Control.  */
-         /* TODO: Implement SLEEPONEXIT.  */
-         return 0;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-             if (value & 1) {
-                 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
-             }
--            if (value & 0x700) {
--                qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n");
--            }
-+            s->prigroup = extract32(value, 8, 3);
-         }
-         break;
-     case 0xd10: /* System Control.  */
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_sysreg_ops = {
- static const VMStateDescription vmstate_nvic = {
-     .name = "armv7m_nvic",
--    .version_id = 1,
--    .minimum_version_id = 1,
-+    .version_id = 2,
-+    .minimum_version_id = 2,
-     .fields = (VMStateField[]) {
-         VMSTATE_UINT32(systick.control, NVICState),
-         VMSTATE_UINT32(systick.reload, NVICState),
-         VMSTATE_INT64(systick.tick, NVICState),
-         VMSTATE_TIMER_PTR(systick.timer, NVICState),
-+        VMSTATE_UINT32(prigroup, NVICState),
-         VMSTATE_END_OF_LIST()
-     }
- };
---
-.7.4

-[Qemu-devel] [PULL 14/30] armv7m: Rewrite NVIC to not use any GIC code
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-Despite some superficial similarities of register layout, the
-M-profile NVIC is really very different from the A-profile GIC.
-Our current attempt to reuse the GIC code means that we have
-significant bugs in our NVIC.
-Implement the NVIC as an entirely separate device, to give
-us somewhere we can get the behaviour correct.
-This initial commit does not attempt to implement exception
-priority escalation, since the GIC-based code didn't either.
-It does fix a few bugs in passing:
- * ICSR.RETTOBASE polarity was wrong and didn't account for
-   internal exceptions
- * ICSR.VECTPENDING was 16 too high if the pending exception
-   was for an external interrupt
- * UsageFault, BusFault and MemFault were not disabled on reset
-   as they are supposed to be
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-[PMM: reworked, various bugs and stylistic cleanups]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 738 ++++++++++++++++++++++++++++++++++++++++----------
- hw/intc/trace-events  |  15 +
-files changed, 609 insertions(+), 144 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "qemu/timer.h"
- #include "hw/arm/arm.h"
-+#include "target/arm/cpu.h"
- #include "exec/address-spaces.h"
--#include "gic_internal.h"
- #include "qemu/log.h"
-+#include "trace.h"
-+
-+/* IRQ number counting:
-+ *
-+ * the num-irq property counts the number of external IRQ lines
-+ *
-+ * NVICState::num_irq counts the total number of exceptions
-+ * (external IRQs, the 15 internal exceptions including reset,
-+ * and one for the unused exception number 0).
-+ *
-+ * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
-+ *
-+ * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
-+ *
-+ * Iterating through all exceptions should typically be done with
-+ * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
-+ *
-+ * The external qemu_irq lines are the NVIC's external IRQ lines,
-+ * so line 0 is exception 16.
-+ *
-+ * In the terminology of the architecture manual, "interrupts" are
-+ * a subcategory of exception referring to the external interrupts
-+ * (which are exception numbers NVIC_FIRST_IRQ and upward).
-+ * For historical reasons QEMU tends to use "interrupt" and
-+ * "exception" more or less interchangeably.
-+ */
-+#define NVIC_FIRST_IRQ 16
-+#define NVIC_MAX_VECTORS 512
-+#define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
-+
-+/* Effective running priority of the CPU when no exception is active
-+ * (higher than the highest possible priority value)
-+ */
-+#define NVIC_NOEXC_PRIO 0x100
-+
-+typedef struct VecInfo {
-+    /* Exception priorities can range from -3 to 255; only the unmodifiable
-+     * priority values for RESET, NMI and HardFault can be negative.
-+     */
-+    int16_t prio;
-+    uint8_t enabled;
-+    uint8_t pending;
-+    uint8_t active;
-+    uint8_t level; /* exceptions <=15 never set level */
-+} VecInfo;
- typedef struct NVICState {
--    GICState gic;
-+    /*< private >*/
-+    SysBusDevice parent_obj;
-+    /*< public >*/
-+
-     ARMCPU *cpu;
-+    VecInfo vectors[NVIC_MAX_VECTORS];
-     uint32_t prigroup;
-+    /* vectpending and exception_prio are both cached state that can
-+     * be recalculated from the vectors[] array and the prigroup field.
-+     */
-+    unsigned int vectpending; /* highest prio pending enabled exception */
-+    int exception_prio; /* group prio of the highest prio active exception */
-+
-     struct {
-         uint32_t control;
-         uint32_t reload;
-         int64_t tick;
-         QEMUTimer *timer;
-     } systick;
-+
-     MemoryRegion sysregmem;
--    MemoryRegion gic_iomem_alias;
-     MemoryRegion container;
-+
-     uint32_t num_irq;
-+    qemu_irq excpout;
-     qemu_irq sysresetreq;
- } NVICState;
- #define TYPE_NVIC "armv7m_nvic"
--/**
-- * NVICClass:
-- * @parent_reset: the parent class' reset handler.
-- *
-- * A model of the v7M NVIC and System Controller
-- */
--typedef struct NVICClass {
--    /*< private >*/
--    ARMGICClass parent_class;
--    /*< public >*/
--    DeviceRealize parent_realize;
--    void (*parent_reset)(DeviceState *dev);
--} NVICClass;
--
--#define NVIC_CLASS(klass) \
--    OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC)
--#define NVIC_GET_CLASS(obj) \
--    OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC)
-+
- #define NVIC(obj) \
-     OBJECT_CHECK(NVICState, (obj), TYPE_NVIC)
-@@ -XXX,XX +XXX,XX @@ static void systick_reset(NVICState *s)
-     timer_del(s->systick.timer);
- }
--/* The external routines use the hardware vector numbering, ie. the first
--   IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
-+static int nvic_pending_prio(NVICState *s)
-+{
-+    /* return the priority of the current pending interrupt,
-+     * or NVIC_NOEXC_PRIO if no interrupt is pending
-+     */
-+    return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO;
-+}
-+
-+/* Return the value of the ISCR RETTOBASE bit:
-+ * 1 if there is exactly one active exception
-+ * 0 if there is more than one active exception
-+ * UNKNOWN if there are no active exceptions (we choose 1,
-+ * which matches the choice Cortex-M3 is documented as making).
-+ *
-+ * NB: some versions of the documentation talk about this
-+ * counting "active exceptions other than the one shown by IPSR";
-+ * this is only different in the obscure corner case where guest
-+ * code has manually deactivated an exception and is about
-+ * to fail an exception-return integrity check. The definition
-+ * above is the one from the v8M ARM ARM and is also in line
-+ * with the behaviour documented for the Cortex-M3.
-+ */
-+static bool nvic_rettobase(NVICState *s)
-+{
-+    int irq, nhand = 0;
-+
-+    for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
-+        if (s->vectors[irq].active) {
-+            nhand++;
-+            if (nhand == 2) {
-+                return 0;
-+            }
-+        }
-+    }
-+
-+    return 1;
-+}
-+
-+/* Return the value of the ISCR ISRPENDING bit:
-+ * 1 if an external interrupt is pending
-+ * 0 if no external interrupt is pending
-+ */
-+static bool nvic_isrpending(NVICState *s)
-+{
-+    int irq;
-+
-+    /* We can shortcut if the highest priority pending interrupt
-+     * happens to be external or if there is nothing pending.
-+     */
-+    if (s->vectpending > NVIC_FIRST_IRQ) {
-+        return true;
-+    }
-+    if (s->vectpending == 0) {
-+        return false;
-+    }
-+
-+    for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
-+        if (s->vectors[irq].pending) {
-+            return true;
-+        }
-+    }
-+    return false;
-+}
-+
-+/* Return a mask word which clears the subpriority bits from
-+ * a priority value for an M-profile exception, leaving only
-+ * the group priority.
-+ */
-+static inline uint32_t nvic_gprio_mask(NVICState *s)
-+{
-+    return ~0U << (s->prigroup + 1);
-+}
-+
-+/* Recompute vectpending and exception_prio */
-+static void nvic_recompute_state(NVICState *s)
-+{
-+    int i;
-+    int pend_prio = NVIC_NOEXC_PRIO;
-+    int active_prio = NVIC_NOEXC_PRIO;
-+    int pend_irq = 0;
-+
-+    for (i = 1; i < s->num_irq; i++) {
-+        VecInfo *vec = &s->vectors[i];
-+
-+        if (vec->enabled && vec->pending && vec->prio < pend_prio) {
-+            pend_prio = vec->prio;
-+            pend_irq = i;
-+        }
-+        if (vec->active && vec->prio < active_prio) {
-+            active_prio = vec->prio;
-+        }
-+    }
-+
-+    s->vectpending = pend_irq;
-+    s->exception_prio = active_prio & nvic_gprio_mask(s);
-+
-+    trace_nvic_recompute_state(s->vectpending, s->exception_prio);
-+}
-+
-+/* Return the current execution priority of the CPU
-+ * (equivalent to the pseudocode ExecutionPriority function).
-+ * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
-+ */
-+static inline int nvic_exec_prio(NVICState *s)
-+{
-+    CPUARMState *env = &s->cpu->env;
-+    int running;
-+
-+    if (env->daif & PSTATE_F) { /* FAULTMASK */
-+        running = -1;
-+    } else if (env->daif & PSTATE_I) { /* PRIMASK */
-+        running = 0;
-+    } else if (env->v7m.basepri > 0) {
-+        running = env->v7m.basepri & nvic_gprio_mask(s);
-+    } else {
-+        running = NVIC_NOEXC_PRIO; /* lower than any possible priority */
-+    }
-+    /* consider priority of active handler */
-+    return MIN(running, s->exception_prio);
-+}
-+
-+/* caller must call nvic_irq_update() after this */
-+static void set_prio(NVICState *s, unsigned irq, uint8_t prio)
-+{
-+    assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
-+    assert(irq < s->num_irq);
-+
-+    s->vectors[irq].prio = prio;
-+
-+    trace_nvic_set_prio(irq, prio);
-+}
-+
-+/* Recompute state and assert irq line accordingly.
-+ * Must be called after changes to:
-+ *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
-+ *  prigroup
-+ */
-+static void nvic_irq_update(NVICState *s)
-+{
-+    int lvl;
-+    int pend_prio;
-+
-+    nvic_recompute_state(s);
-+    pend_prio = nvic_pending_prio(s);
-+
-+    /* Raise NVIC output if this IRQ would be taken, except that we
-+     * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
-+     * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
-+     * to those CPU registers don't cause us to recalculate the NVIC
-+     * pending info.
-+     */
-+    lvl = (pend_prio < s->exception_prio);
-+    trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
-+    qemu_set_irq(s->excpout, lvl);
-+}
-+
-+static void armv7m_nvic_clear_pending(void *opaque, int irq)
-+{
-+    NVICState *s = (NVICState *)opaque;
-+    VecInfo *vec;
-+
-+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
-+
-+    vec = &s->vectors[irq];
-+    trace_nvic_clear_pending(irq, vec->enabled, vec->prio);
-+    if (vec->pending) {
-+        vec->pending = 0;
-+        nvic_irq_update(s);
-+    }
-+}
-+
- void armv7m_nvic_set_pending(void *opaque, int irq)
- {
-     NVICState *s = (NVICState *)opaque;
--    if (irq >= 16)
--        irq += 16;
--    gic_set_pending_private(&s->gic, 0, irq);
-+    VecInfo *vec;
-+
-+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
-+
-+    vec = &s->vectors[irq];
-+    trace_nvic_set_pending(irq, vec->enabled, vec->prio);
-+    if (!vec->pending) {
-+        vec->pending = 1;
-+        nvic_irq_update(s);
-+    }
- }
- /* Make pending IRQ active.  */
- int armv7m_nvic_acknowledge_irq(void *opaque)
- {
-     NVICState *s = (NVICState *)opaque;
--    uint32_t irq;
--
--    irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED);
--    if (irq == 1023)
--        hw_error("Interrupt but no vector\n");
--    if (irq >= 32)
--        irq -= 16;
--    return irq;
-+    CPUARMState *env = &s->cpu->env;
-+    const int pending = s->vectpending;
-+    const int running = nvic_exec_prio(s);
-+    int pendgroupprio;
-+    VecInfo *vec;
-+
-+    assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
-+
-+    vec = &s->vectors[pending];
-+
-+    assert(vec->enabled);
-+    assert(vec->pending);
-+
-+    pendgroupprio = vec->prio & nvic_gprio_mask(s);
-+    assert(pendgroupprio < running);
-+
-+    trace_nvic_acknowledge_irq(pending, vec->prio);
-+
-+    vec->active = 1;
-+    vec->pending = 0;
-+
-+    env->v7m.exception = s->vectpending;
-+
-+    nvic_irq_update(s);
-+
-+    return env->v7m.exception;
- }
- void armv7m_nvic_complete_irq(void *opaque, int irq)
- {
-     NVICState *s = (NVICState *)opaque;
--    if (irq >= 16)
--        irq += 16;
--    gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED);
-+    VecInfo *vec;
-+
-+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
-+
-+    vec = &s->vectors[irq];
-+
-+    trace_nvic_complete_irq(irq);
-+
-+    vec->active = 0;
-+    if (vec->level) {
-+        /* Re-pend the exception if it's still held high; only
-+         * happens for extenal IRQs
-+         */
-+        assert(irq >= NVIC_FIRST_IRQ);
-+        vec->pending = 1;
-+    }
-+
-+    nvic_irq_update(s);
-+}
-+
-+/* callback when external interrupt line is changed */
-+static void set_irq_level(void *opaque, int n, int level)
-+{
-+    NVICState *s = opaque;
-+    VecInfo *vec;
-+
-+    n += NVIC_FIRST_IRQ;
-+
-+    assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
-+
-+    trace_nvic_set_irq_level(n, level);
-+
-+    /* The pending status of an external interrupt is
-+     * latched on rising edge and exception handler return.
-+     *
-+     * Pulsing the IRQ will always run the handler
-+     * once, and the handler will re-run until the
-+     * level is low when the handler completes.
-+     */
-+    vec = &s->vectors[n];
-+    if (level != vec->level) {
-+        vec->level = level;
-+        if (level) {
-+            armv7m_nvic_set_pending(s, n);
-+        }
-+    }
- }
- static uint32_t nvic_readl(NVICState *s, uint32_t offset)
- {
-     ARMCPU *cpu = s->cpu;
-     uint32_t val;
--    int irq;
-     switch (offset) {
-     case 4: /* Interrupt Control Type.  */
--        return (s->num_irq / 32) - 1;
-+        return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
-     case 0x10: /* SysTick Control and Status.  */
-         val = s->systick.control;
-         s->systick.control &= ~SYSTICK_COUNTFLAG;
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
-     case 0xd04: /* Interrupt Control State.  */
-         /* VECTACTIVE */
-         val = cpu->env.v7m.exception;
--        if (val == 1023) {
--            val = 0;
--        } else if (val >= 32) {
--            val -= 16;
--        }
-         /* VECTPENDING */
--        if (s->gic.current_pending[0] != 1023)
--            val |= (s->gic.current_pending[0] << 12);
--        /* ISRPENDING and RETTOBASE */
--        for (irq = 32; irq < s->num_irq; irq++) {
--            if (s->gic.irq_state[irq].pending) {
--                val |= (1 << 22);
--                break;
--            }
--            if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) {
--                val |= (1 << 11);
--            }
-+        val |= (s->vectpending & 0xff) << 12;
-+        /* ISRPENDING - set if any external IRQ is pending */
-+        if (nvic_isrpending(s)) {
-+            val |= (1 << 22);
-+        }
-+        /* RETTOBASE - set if only one handler is active */
-+        if (nvic_rettobase(s)) {
-+            val |= (1 << 11);
-         }
-         /* PENDSTSET */
--        if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending)
-+        if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
-             val |= (1 << 26);
-+        }
-         /* PENDSVSET */
--        if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending)
-+        if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
-             val |= (1 << 28);
-+        }
-         /* NMIPENDSET */
--        if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending)
-+        if (s->vectors[ARMV7M_EXCP_NMI].pending) {
-             val |= (1 << 31);
-+        }
-+        /* ISRPREEMPT not implemented */
-         return val;
-     case 0xd08: /* Vector Table Offset.  */
-         return cpu->env.v7m.vecbase;
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
-         return cpu->env.v7m.ccr;
-     case 0xd24: /* System Handler Status.  */
-         val = 0;
--        if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0);
--        if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1);
--        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3);
--        if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7);
--        if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8);
--        if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10);
--        if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11);
--        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12);
--        if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13);
--        if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14);
--        if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15);
--        if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16);
--        if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17);
--        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18);
-+        if (s->vectors[ARMV7M_EXCP_MEM].active) {
-+            val |= (1 << 0);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_BUS].active) {
-+            val |= (1 << 1);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_USAGE].active) {
-+            val |= (1 << 3);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_SVC].active) {
-+            val |= (1 << 7);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
-+            val |= (1 << 8);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
-+            val |= (1 << 10);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
-+            val |= (1 << 11);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
-+            val |= (1 << 12);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_MEM].pending) {
-+            val |= (1 << 13);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_BUS].pending) {
-+            val |= (1 << 14);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_SVC].pending) {
-+            val |= (1 << 15);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
-+            val |= (1 << 16);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
-+            val |= (1 << 17);
-+        }
-+        if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
-+            val |= (1 << 18);
-+        }
-         return val;
-     case 0xd28: /* Configurable Fault Status.  */
-         return cpu->env.v7m.cfsr;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-         if (value & (1 << 28)) {
-             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
-         } else if (value & (1 << 27)) {
--            s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0;
--            gic_update(&s->gic);
-+            armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV);
-         }
-         if (value & (1 << 26)) {
-             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
-         } else if (value & (1 << 25)) {
--            s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0;
--            gic_update(&s->gic);
-+            armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK);
-         }
-         break;
-     case 0xd08: /* Vector Table Offset.  */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-                 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
-             }
-             s->prigroup = extract32(value, 8, 3);
-+            nvic_irq_update(s);
-         }
-         break;
-     case 0xd10: /* System Control.  */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-     case 0xd24: /* System Handler Control.  */
-         /* TODO: Real hardware allows you to set/clear the active bits
-            under some circumstances.  We don't implement this.  */
--        s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
--        s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
--        s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
-+        s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
-+        s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
-+        s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
-+        nvic_irq_update(s);
-         break;
-     case 0xd28: /* Configurable Fault Status.  */
-         cpu->env.v7m.cfsr &= ~value; /* W1C */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-                       "NVIC: Aux fault status registers unimplemented\n");
-         break;
-     case 0xf00: /* Software Triggered Interrupt Register */
-+    {
-         /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
--        if ((value & 0x1ff) < s->num_irq &&
-+        int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
-+        if (excnum < s->num_irq &&
-             (arm_current_el(&cpu->env) ||
-              (cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK))) {
--            gic_set_pending_private(&s->gic, 0, value & 0x1ff);
-+            armv7m_nvic_set_pending(s, excnum);
-         }
-         break;
-+    }
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "NVIC: Bad write offset 0x%x\n", offset);
-@@ -XXX,XX +XXX,XX @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
- {
-     NVICState *s = (NVICState *)opaque;
-     uint32_t offset = addr;
--    int i;
-+    unsigned i, startvec, end;
-     uint32_t val;
-     switch (offset) {
-+    /* reads of set and clear both return the status */
-+    case 0x100 ... 0x13f: /* NVIC Set enable */
-+        offset += 0x80;
-+        /* fall through */
-+    case 0x180 ... 0x1bf: /* NVIC Clear enable */
-+        val = 0;
-+        startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
-+
-+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-+            if (s->vectors[startvec + i].enabled) {
-+                val |= (1 << i);
-+            }
-+        }
-+        break;
-+    case 0x200 ... 0x23f: /* NVIC Set pend */
-+        offset += 0x80;
-+        /* fall through */
-+    case 0x280 ... 0x2bf: /* NVIC Clear pend */
-+        val = 0;
-+        startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
-+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-+            if (s->vectors[startvec + i].pending) {
-+                val |= (1 << i);
-+            }
-+        }
-+        break;
-+    case 0x300 ... 0x33f: /* NVIC Active */
-+        val = 0;
-+        startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
-+
-+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-+            if (s->vectors[startvec + i].active) {
-+                val |= (1 << i);
-+            }
-+        }
-+        break;
-+    case 0x400 ... 0x5ef: /* NVIC Priority */
-+        val = 0;
-+        startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
-+
-+        for (i = 0; i < size && startvec + i < s->num_irq; i++) {
-+            val |= s->vectors[startvec + i].prio << (8 * i);
-+        }
-+        break;
-     case 0xd18 ... 0xd23: /* System Handler Priority.  */
-         val = 0;
-         for (i = 0; i < size; i++) {
--            val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8);
-+            val |= s->vectors[(offset - 0xd14) + i].prio << (i * 8);
-         }
--        return val;
-+        break;
-     case 0xfe0 ... 0xfff: /* ID.  */
-         if (offset & 3) {
--            return 0;
-+            val = 0;
-+        } else {
-+            val = nvic_id[(offset - 0xfe0) >> 2];
-+        }
-+        break;
-+    default:
-+        if (size == 4) {
-+            val = nvic_readl(s, offset);
-+        } else {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "NVIC: Bad read of size %d at offset 0x%x\n",
-+                          size, offset);
-+            val = 0;
-         }
--        return nvic_id[(offset - 0xfe0) >> 2];
--    }
--    if (size == 4) {
--        return nvic_readl(s, offset);
-     }
--    qemu_log_mask(LOG_GUEST_ERROR,
--                  "NVIC: Bad read of size %d at offset 0x%x\n", size, offset);
--    return 0;
-+
-+    trace_nvic_sysreg_read(addr, val, size);
-+    return val;
- }
- static void nvic_sysreg_write(void *opaque, hwaddr addr,
-@@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr,
- {
-     NVICState *s = (NVICState *)opaque;
-     uint32_t offset = addr;
--    int i;
-+    unsigned i, startvec, end;
-+    unsigned setval = 0;
-+
-+    trace_nvic_sysreg_write(addr, value, size);
-     switch (offset) {
-+    case 0x100 ... 0x13f: /* NVIC Set enable */
-+        offset += 0x80;
-+        setval = 1;
-+        /* fall through */
-+    case 0x180 ... 0x1bf: /* NVIC Clear enable */
-+        startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
-+
-+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-+            if (value & (1 << i)) {
-+                s->vectors[startvec + i].enabled = setval;
-+            }
-+        }
-+        nvic_irq_update(s);
-+        return;
-+    case 0x200 ... 0x23f: /* NVIC Set pend */
-+        /* the special logic in armv7m_nvic_set_pending()
-+         * is not needed since IRQs are never escalated
-+         */
-+        offset += 0x80;
-+        setval = 1;
-+        /* fall through */
-+    case 0x280 ... 0x2bf: /* NVIC Clear pend */
-+        startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
-+
-+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-+            if (value & (1 << i)) {
-+                s->vectors[startvec + i].pending = setval;
-+            }
-+        }
-+        nvic_irq_update(s);
-+        return;
-+    case 0x300 ... 0x33f: /* NVIC Active */
-+        return; /* R/O */
-+    case 0x400 ... 0x5ef: /* NVIC Priority */
-+        startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
-+
-+        for (i = 0; i < size && startvec + i < s->num_irq; i++) {
-+            set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);
-+        }
-+        nvic_irq_update(s);
-+        return;
-     case 0xd18 ... 0xd23: /* System Handler Priority.  */
-         for (i = 0; i < size; i++) {
--            s->gic.priority1[(offset - 0xd14) + i][0] =
--                (value >> (i * 8)) & 0xff;
-+            unsigned hdlidx = (offset - 0xd14) + i;
-+            set_prio(s, hdlidx, (value >> (i * 8)) & 0xff);
-         }
--        gic_update(&s->gic);
-+        nvic_irq_update(s);
-         return;
-     }
-     if (size == 4) {
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_sysreg_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
-+static int nvic_post_load(void *opaque, int version_id)
-+{
-+    NVICState *s = opaque;
-+    unsigned i;
-+
-+    /* Check for out of range priority settings */
-+    if (s->vectors[ARMV7M_EXCP_RESET].prio != -3 ||
-+        s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
-+        s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
-+        return 1;
-+    }
-+    for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
-+        if (s->vectors[i].prio & ~0xff) {
-+            return 1;
-+        }
-+    }
-+
-+    nvic_recompute_state(s);
-+
-+    return 0;
-+}
-+
-+static const VMStateDescription vmstate_VecInfo = {
-+    .name = "armv7m_nvic_info",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_INT16(prio, VecInfo),
-+        VMSTATE_UINT8(enabled, VecInfo),
-+        VMSTATE_UINT8(pending, VecInfo),
-+        VMSTATE_UINT8(active, VecInfo),
-+        VMSTATE_UINT8(level, VecInfo),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static const VMStateDescription vmstate_nvic = {
-     .name = "armv7m_nvic",
--    .version_id = 2,
--    .minimum_version_id = 2,
-+    .version_id = 3,
-+    .minimum_version_id = 3,
-+    .post_load = &nvic_post_load,
-     .fields = (VMStateField[]) {
-+        VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
-+                             vmstate_VecInfo, VecInfo),
-         VMSTATE_UINT32(systick.control, NVICState),
-         VMSTATE_UINT32(systick.reload, NVICState),
-         VMSTATE_INT64(systick.tick, NVICState),
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {
-     }
- };
-+static Property props_nvic[] = {
-+    /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
-+    DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
-+    DEFINE_PROP_END_OF_LIST()
-+};
-+
- static void armv7m_nvic_reset(DeviceState *dev)
- {
-     NVICState *s = NVIC(dev);
--    NVICClass *nc = NVIC_GET_CLASS(s);
--    nc->parent_reset(dev);
--    /* Common GIC reset resets to disabled; the NVIC doesn't have
--     * per-CPU interfaces so mark our non-existent CPU interface
--     * as enabled by default, and with a priority mask which allows
--     * all interrupts through.
-+
-+    s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
-+    s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
-+    /* MEM, BUS, and USAGE are enabled through
-+     * the System Handler Control register
-      */
--    s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0;
--    s->gic.priority_mask[0] = 0x100;
--    /* The NVIC as a whole is always enabled. */
--    s->gic.ctlr = 1;
-+    s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
-+    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
-+    s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
-+    s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
-+
-+    s->vectors[ARMV7M_EXCP_RESET].prio = -3;
-+    s->vectors[ARMV7M_EXCP_NMI].prio = -2;
-+    s->vectors[ARMV7M_EXCP_HARD].prio = -1;
-+
-+    /* Strictly speaking the reset handler should be enabled.
-+     * However, we don't simulate soft resets through the NVIC,
-+     * and the reset vector should never be pended.
-+     * So we leave it disabled to catch logic errors.
-+     */
-+
-+    s->exception_prio = NVIC_NOEXC_PRIO;
-+    s->vectpending = 0;
-+
-     systick_reset(s);
- }
- static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
- {
-     NVICState *s = NVIC(dev);
--    NVICClass *nc = NVIC_GET_CLASS(s);
--    Error *local_err = NULL;
-     s->cpu = ARM_CPU(qemu_get_cpu(0));
-     assert(s->cpu);
--    /* The NVIC always has only one CPU */
--    s->gic.num_cpu = 1;
--    /* Tell the common code we're an NVIC */
--    s->gic.revision = 0xffffffff;
--    s->num_irq = s->gic.num_irq;
--    nc->parent_realize(dev, &local_err);
--    if (local_err) {
--        error_propagate(errp, local_err);
-+
-+    if (s->num_irq > NVIC_MAX_IRQ) {
-+        error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
-         return;
-     }
--    gic_init_irqs_and_distributor(&s->gic);
--    /* The NVIC and system controller register area looks like this:
--     *  0..0xff : system control registers, including systick
--     *  0x100..0xcff : GIC-like registers
--     *  0xd00..0xfff : system control registers
--     * We use overlaying to put the GIC like registers
--     * over the top of the system control register region.
-+
-+    qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
-+
-+    /* include space for internal exception vectors */
-+    s->num_irq += NVIC_FIRST_IRQ;
-+
-+    /* The NVIC and System Control Space (SCS) starts at 0xe000e000
-+     * and looks like this:
-+     *  0x004 - ICTR
-+     *  0x010 - 0x1c - systick
-+     *  0x100..0x7ec - NVIC
-+     *  0x7f0..0xcff - Reserved
-+     *  0xd00..0xd3c - SCS registers
-+     *  0xd40..0xeff - Reserved or Not implemented
-+     *  0xf00 - STIR
-+     *
-+     * At the moment there is only one thing in the container region,
-+     * but we leave it in place to allow us to pull systick out into
-+     * its own device object later.
-      */
-     memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000);
-     /* The system register region goes at the bottom of the priority
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
-     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
-                           "nvic_sysregs", 0x1000);
-     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
--    /* Alias the GIC region so we can get only the section of it
--     * we need, and layer it on top of the system register region.
--     */
--    memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s),
--                             "nvic-gic", &s->gic.iomem,
--                             0x100, 0xc00);
--    memory_region_add_subregion_overlap(&s->container, 0x100,
--                                        &s->gic_iomem_alias, 1);
-+
-     /* Map the whole thing into system memory at the location required
-      * by the v7M architecture.
-      */
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
-      * any user-specified property setting, so just modify the
-      * value in the GICState struct.
-      */
--    GICState *s = ARM_GIC_COMMON(obj);
-     DeviceState *dev = DEVICE(obj);
-     NVICState *nvic = NVIC(obj);
--    /* The ARM v7m may have anything from 0 to 496 external interrupt
--     * IRQ lines. We default to 64. Other boards may differ and should
--     * set the num-irq property appropriately.
--     */
--    s->num_irq = 64;
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+
-+    sysbus_init_irq(sbd, &nvic->excpout);
-     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
- }
- static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
- {
--    NVICClass *nc = NVIC_CLASS(klass);
-     DeviceClass *dc = DEVICE_CLASS(klass);
--    nc->parent_reset = dc->reset;
--    nc->parent_realize = dc->realize;
-     dc->vmsd  = &vmstate_nvic;
-+    dc->props = props_nvic;
-     dc->reset = armv7m_nvic_reset;
-     dc->realize = armv7m_nvic_realize;
- }
- static const TypeInfo armv7m_nvic_info = {
-     .name          = TYPE_NVIC,
--    .parent        = TYPE_ARM_GIC_COMMON,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-     .instance_init = armv7m_nvic_instance_init,
-     .instance_size = sizeof(NVICState),
-     .class_init    = armv7m_nvic_class_init,
--    .class_size    = sizeof(NVICClass),
-+    .class_size    = sizeof(SysBusDeviceClass),
- };
- static void armv7m_nvic_register_types(void)
-diff --git a/hw/intc/trace-events b/hw/intc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/trace-events
-+++ b/hw/intc/trace-events
-@@ -XXX,XX +XXX,XX @@ gicv3_redist_write(uint32_t cpu, uint64_t offset, uint64_t data, unsigned size,
- gicv3_redist_badwrite(uint32_t cpu, uint64_t offset, uint64_t data, unsigned size, bool secure) "GICv3 redistributor %x write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u secure %d: error"
- gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor %x interrupt %d level changed to %d"
- gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor %x pending SGI %d"
-+
-+# hw/intc/armv7m_nvic.c
-+nvic_recompute_state(int vectpending, int exception_prio) "NVIC state recomputed: vectpending %d exception_prio %d"
-+nvic_set_prio(int irq, uint8_t prio) "NVIC set irq %d priority %d"
-+nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"
-+nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"
-+nvic_escalate_disabled(int irq) "NVIC escalating irq %d to HardFault: disabled"
-+nvic_set_pending(int irq, int en, int prio) "NVIC set pending irq %d (enabled: %d priority %d)"
-+nvic_clear_pending(int irq, int en, int prio) "NVIC clear pending irq %d (enabled: %d priority %d)"
-+nvic_set_pending_level(int irq) "NVIC set pending: irq %d higher prio than vectpending: setting irq line to 1"
-+nvic_acknowledge_irq(int irq, int prio) "NVIC acknowledge IRQ: %d now active (prio %d)"
-+nvic_complete_irq(int irq) "NVIC complete IRQ %d"
-+nvic_set_irq_level(int irq, int level) "NVIC external irq %d level set to %d"
-+nvic_sysreg_read(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
-+nvic_sysreg_write(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
---
-.7.4

-[Qemu-devel] [PULL 15/30] armv7m: Fix condition check for taking exceptions
+Deleted patch
-The M profile condition for when we can take a pending exception or
-interrupt is not the same as that for A/R profile.  The code
-originally copied from the A/R profile version of the
-cpu_exec_interrupt function only worked by chance for the
-very simple case of exceptions being masked by PRIMASK.
-Replace it with a call to a function in the NVIC code that
-correctly compares the priority of the pending exception
-against the current execution priority of the CPU.
-[Michael Davidsaver's patchset had a patch to do something
-similar but the implementation ended up being a rewrite.]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- target/arm/cpu.h      |  8 ++++++++
- hw/intc/armv7m_nvic.c |  7 +++++++
- target/arm/cpu.c      | 16 ++++++++--------
-files changed, 23 insertions(+), 8 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
-                                  uint32_t cur_el, bool secure);
- /* Interface between CPU and Interrupt controller.  */
-+#ifndef CONFIG_USER_ONLY
-+bool armv7m_nvic_can_take_pending_exception(void *opaque);
-+#else
-+static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
-+{
-+    return true;
-+}
-+#endif
- void armv7m_nvic_set_pending(void *opaque, int irq);
- int armv7m_nvic_acknowledge_irq(void *opaque);
- void armv7m_nvic_complete_irq(void *opaque, int irq);
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s)
-     return MIN(running, s->exception_prio);
- }
-+bool armv7m_nvic_can_take_pending_exception(void *opaque)
-+{
-+    NVICState *s = opaque;
-+
-+    return nvic_exec_prio(s) > nvic_pending_prio(s);
-+}
-+
- /* caller must call nvic_irq_update() after this */
- static void set_prio(NVICState *s, unsigned irq, uint8_t prio)
- {
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-     CPUARMState *env = &cpu->env;
-     bool ret = false;
--
--    if (interrupt_request & CPU_INTERRUPT_FIQ
--        && !(env->daif & PSTATE_F)) {
--        cs->exception_index = EXCP_FIQ;
--        cc->do_interrupt(cs);
--        ret = true;
--    }
-     /* ARMv7-M interrupt return works by loading a magic value
-      * into the PC.  On real hardware the load causes the
-      * return to occur.  The qemu implementation performs the
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-      * the stack if an interrupt occurred at the wrong time.
-      * We avoid this by disabling interrupts when
-      * pc contains a magic address.
-+     *
-+     * ARMv7-M interrupt masking works differently than -A or -R.
-+     * There is no FIQ/IRQ distinction. Instead of I and F bits
-+     * masking FIQ and IRQ interrupts, an exception is taken only
-+     * if it is higher priority than the current execution priority
-+     * (which depends on state like BASEPRI, FAULTMASK and the
-+     * currently active exception).
-      */
-     if (interrupt_request & CPU_INTERRUPT_HARD
--        && !(env->daif & PSTATE_I)
-+        && (armv7m_nvic_can_take_pending_exception(env->nvic))
-         && (env->regs[15] < 0xfffffff0)) {
-         cs->exception_index = EXCP_IRQ;
-         cc->do_interrupt(cs);
---
-.7.4

-[Qemu-devel] [PULL 16/30] arm: gic: Remove references to NVIC
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-Now that the NVIC is its own separate implementation, we can
-clean up the GIC code by removing REV_NVIC and conditionals
-which use it.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/gic_internal.h   |  7 ++-----
- hw/intc/arm_gic.c        | 31 +++++--------------------------
- hw/intc/arm_gic_common.c | 23 ++++++++---------------
-files changed, 15 insertions(+), 46 deletions(-)
-diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gic_internal.h
-+++ b/hw/intc/gic_internal.h
-@@ -XXX,XX +XXX,XX @@
- #define ALL_CPU_MASK ((unsigned)(((1 << GIC_NCPU) - 1)))
--/* The NVIC has 16 internal vectors.  However these are not exposed
--   through the normal GIC interface.  */
--#define GIC_BASE_IRQ ((s->revision == REV_NVIC) ? 32 : 0)
-+#define GIC_BASE_IRQ 0
- #define GIC_SET_ENABLED(irq, cm) s->irq_state[irq].enabled |= (cm)
- #define GIC_CLEAR_ENABLED(irq, cm) s->irq_state[irq].enabled &= ~(cm)
-@@ -XXX,XX +XXX,XX @@
- /* The special cases for the revision property: */
- #define REV_11MPCORE 0
--#define REV_NVIC 0xffffffff
- void gic_set_pending_private(GICState *s, int cpu, int irq);
- uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs);
-@@ -XXX,XX +XXX,XX @@ void gic_set_priority(GICState *s, int cpu, int irq, uint8_t val,
- static inline bool gic_test_pending(GICState *s, int irq, int cm)
- {
--    if (s->revision == REV_NVIC || s->revision == REV_11MPCORE) {
-+    if (s->revision == REV_11MPCORE) {
-         return s->irq_state[irq].pending & cm;
-     } else {
-         /* Edge-triggered interrupts are marked pending on a rising edge, but
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
-+++ b/hw/intc/arm_gic.c
-@@ -XXX,XX +XXX,XX @@ static void gic_set_irq_11mpcore(GICState *s, int irq, int level,
-     }
- }
--static void gic_set_irq_nvic(GICState *s, int irq, int level,
--                                 int cm, int target)
--{
--    if (level) {
--        GIC_SET_LEVEL(irq, cm);
--        GIC_SET_PENDING(irq, target);
--    } else {
--        GIC_CLEAR_LEVEL(irq, cm);
--    }
--}
--
- static void gic_set_irq_generic(GICState *s, int irq, int level,
-                                 int cm, int target)
- {
-@@ -XXX,XX +XXX,XX @@ static void gic_set_irq(void *opaque, int irq, int level)
-     if (s->revision == REV_11MPCORE) {
-         gic_set_irq_11mpcore(s, irq, level, cm, target);
--    } else if (s->revision == REV_NVIC) {
--        gic_set_irq_nvic(s, irq, level, cm, target);
-     } else {
-         gic_set_irq_generic(s, irq, level, cm, target);
-     }
-@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
-         return 1023;
-     }
--    if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
-+    if (s->revision == REV_11MPCORE) {
-         /* Clear pending flags for both level and edge triggered interrupts.
-          * Level triggered IRQs will be reasserted once they become inactive.
-          */
-@@ -XXX,XX +XXX,XX @@ void gic_complete_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
-             DPRINTF("Set %d pending mask %x\n", irq, cm);
-             GIC_SET_PENDING(irq, cm);
-         }
--    } else if (s->revision == REV_NVIC) {
--        if (GIC_TEST_LEVEL(irq, cm)) {
--            DPRINTF("Set nvic %d pending mask %x\n", irq, cm);
--            GIC_SET_PENDING(irq, cm);
--        }
-     }
-     group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
-     } else if (offset < 0xf10) {
-         goto bad_reg;
-     } else if (offset < 0xf30) {
--        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
-+        if (s->revision == REV_11MPCORE) {
-             goto bad_reg;
-         }
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
-             case 2:
-                 res = gic_id_gicv2[(offset - 0xfd0) >> 2];
-                 break;
--            case REV_NVIC:
--                /* Shouldn't be able to get here */
--                abort();
-             default:
-                 res = 0;
-             }
-@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
-                 continue; /* Ignore Non-secure access of Group0 IRQ */
-             }
--            if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
-+            if (s->revision == REV_11MPCORE) {
-                 if (value & (1 << (i * 2))) {
-                     GIC_SET_MODEL(irq + i);
-                 } else {
-@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
-         goto bad_reg;
-     } else if (offset < 0xf20) {
-         /* GICD_CPENDSGIRn */
--        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
-+        if (s->revision == REV_11MPCORE) {
-             goto bad_reg;
-         }
-         irq = (offset - 0xf10);
-@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
-         }
-     } else if (offset < 0xf30) {
-         /* GICD_SPENDSGIRn */
--        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
-+        if (s->revision == REV_11MPCORE) {
-             goto bad_reg;
-         }
-         irq = (offset - 0xf20);
-diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic_common.c
-+++ b/hw/intc/arm_gic_common.c
-@@ -XXX,XX +XXX,XX @@ void gic_init_irqs_and_mmio(GICState *s, qemu_irq_handler handler,
-      *  [N+32..N+63] PPIs for CPU 1
-      *   ...
-      */
--    if (s->revision != REV_NVIC) {
--        i += (GIC_INTERNAL * s->num_cpu);
--    }
-+    i += (GIC_INTERNAL * s->num_cpu);
-     qdev_init_gpio_in(DEVICE(s), handler, i);
-     for (i = 0; i < s->num_cpu; i++) {
-@@ -XXX,XX +XXX,XX @@ void gic_init_irqs_and_mmio(GICState *s, qemu_irq_handler handler,
-     memory_region_init_io(&s->iomem, OBJECT(s), ops, s, "gic_dist", 0x1000);
-     sysbus_init_mmio(sbd, &s->iomem);
--    if (s->revision != REV_NVIC) {
--        /* This is the main CPU interface "for this core". It is always
--         * present because it is required by both software emulation and KVM.
--         * NVIC is not handled here because its CPU interface is different,
--         * neither it can use KVM.
--         */
--        memory_region_init_io(&s->cpuiomem[0], OBJECT(s), ops ? &ops[1] : NULL,
--                              s, "gic_cpu", s->revision == 2 ? 0x2000 : 0x100);
--        sysbus_init_mmio(sbd, &s->cpuiomem[0]);
--    }
-+    /* This is the main CPU interface "for this core". It is always
-+     * present because it is required by both software emulation and KVM.
-+     */
-+    memory_region_init_io(&s->cpuiomem[0], OBJECT(s), ops ? &ops[1] : NULL,
-+                          s, "gic_cpu", s->revision == 2 ? 0x2000 : 0x100);
-+    sysbus_init_mmio(sbd, &s->cpuiomem[0]);
- }
- static void arm_gic_common_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
-     }
-     if (s->security_extn &&
--        (s->revision == REV_11MPCORE || s->revision == REV_NVIC)) {
-+        (s->revision == REV_11MPCORE)) {
-         error_setg(errp, "this GIC revision does not implement "
-                    "the security extensions");
-         return;
-@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
-     DEFINE_PROP_UINT32("num-irq", GICState, num_irq, 32),
-     /* Revision can be 1 or 2 for GIC architecture specification
-      * versions 1 or 2, or 0 to indicate the legacy 11MPCore GIC.
--     * (Internally, 0xffffffff also indicates "not a GIC but an NVIC".)
-      */
-     DEFINE_PROP_UINT32("revision", GICState, revision, 1),
-     /* True if the GIC should implement the security extensions */
---
-.7.4

-[Qemu-devel] [PULL 17/30] armv7m: Escalate exceptions to HardFault if necessary
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-The v7M exception architecture requires that if a synchronous
-exception cannot be taken immediately (because it is disabled
-or at too low a priority) then it should be escalated to
-HardFault (and the HardFault exception is then taken).
-Implement this escalation logic.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-[PMM: extracted from another patch]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++
- target/arm/helper.c   |  2 --
-files changed, 53 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq)
-     vec = &s->vectors[irq];
-     trace_nvic_set_pending(irq, vec->enabled, vec->prio);
-+
-+
-+    if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
-+        /* If a synchronous exception is pending then it may be
-+         * escalated to HardFault if:
-+         *  * it is equal or lower priority to current execution
-+         *  * it is disabled
-+         * (ie we need to take it immediately but we can't do so).
-+         * Asynchronous exceptions (and interrupts) simply remain pending.
-+         *
-+         * For QEMU, we don't have any imprecise (asynchronous) faults,
-+         * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
-+         * synchronous.
-+         * Debug exceptions are awkward because only Debug exceptions
-+         * resulting from the BKPT instruction should be escalated,
-+         * but we don't currently implement any Debug exceptions other
-+         * than those that result from BKPT, so we treat all debug exceptions
-+         * as needing escalation.
-+         *
-+         * This all means we can identify whether to escalate based only on
-+         * the exception number and don't (yet) need the caller to explicitly
-+         * tell us whether this exception is synchronous or not.
-+         */
-+        int running = nvic_exec_prio(s);
-+        bool escalate = false;
-+
-+        if (vec->prio >= running) {
-+            trace_nvic_escalate_prio(irq, vec->prio, running);
-+            escalate = true;
-+        } else if (!vec->enabled) {
-+            trace_nvic_escalate_disabled(irq);
-+            escalate = true;
-+        }
-+
-+        if (escalate) {
-+            if (running < 0) {
-+                /* We want to escalate to HardFault but we can't take a
-+                 * synchronous HardFault at this point either. This is a
-+                 * Lockup condition due to a guest bug. We don't model
-+                 * Lockup, so report via cpu_abort() instead.
-+                 */
-+                cpu_abort(&s->cpu->parent_obj,
-+                          "Lockup: can't escalate %d to HardFault "
-+                          "(current priority %d)\n", irq, running);
-+            }
-+
-+            /* We can do the escalation, so we take HardFault instead */
-+            irq = ARMV7M_EXCP_HARD;
-+            vec = &s->vectors[irq];
-+            s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
-+        }
-+    }
-+
-     if (!vec->pending) {
-         vec->pending = 1;
-         nvic_irq_update(s);
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-     /* For exceptions we just mark as pending on the NVIC, and let that
-        handle it.  */
--    /* TODO: Need to escalate if the current priority is higher than the
--       one we're raising.  */
-     switch (cs->exception_index) {
-     case EXCP_UDEF:
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
---
-.7.4

-[Qemu-devel] [PULL 18/30] armv7m: Remove unused armv7m_nvic_acknowledge_irq() return value
+Deleted patch
-Having armv7m_nvic_acknowledge_irq() return the new value of
-env->v7m.exception and its one caller assign the return value
-back to env->v7m.exception is pointless. Just make the return
-type void instead.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- target/arm/cpu.h      | 2 +-
- hw/intc/armv7m_nvic.c | 4 +---
- target/arm/helper.c   | 2 +-
-files changed, 3 insertions(+), 5 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
- }
- #endif
- void armv7m_nvic_set_pending(void *opaque, int irq);
--int armv7m_nvic_acknowledge_irq(void *opaque);
-+void armv7m_nvic_acknowledge_irq(void *opaque);
- void armv7m_nvic_complete_irq(void *opaque, int irq);
- /* Interface for defining coprocessor registers.
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq)
- }
- /* Make pending IRQ active.  */
--int armv7m_nvic_acknowledge_irq(void *opaque)
-+void armv7m_nvic_acknowledge_irq(void *opaque)
- {
-     NVICState *s = (NVICState *)opaque;
-     CPUARMState *env = &s->cpu->env;
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_acknowledge_irq(void *opaque)
-     env->v7m.exception = s->vectpending;
-     nvic_irq_update(s);
--
--    return env->v7m.exception;
- }
- void armv7m_nvic_complete_irq(void *opaque, int irq)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
-         return;
-     case EXCP_IRQ:
--        env->v7m.exception = armv7m_nvic_acknowledge_irq(env->nvic);
-+        armv7m_nvic_acknowledge_irq(env->nvic);
-         break;
-     case EXCP_EXCEPTION_EXIT:
-         do_v7m_exception_exit(env);
---
-.7.4

-[Qemu-devel] [PULL 19/30] armv7m: Simpler and faster exception start
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-All the places in armv7m_cpu_do_interrupt() which pend an
-exception in the NVIC are doing so for synchronous
-exceptions. We know that we will always take some
-exception in this case, so we can just acknowledge it
-immediately, rather than returning and then immediately
-being called again because the NVIC has raised its outbound
-IRQ line.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-[PMM: tweaked commit message; added DEBUG to the set of
-exceptions we handle immediately, since it is synchronous
-when it results from the BKPT instruction]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- target/arm/helper.c | 15 +++++++++------
-file changed, 9 insertions(+), 6 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-     case EXCP_UDEF:
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr |= R_V7M_CFSR_UNDEFINSTR_MASK;
--        return;
-+        break;
-     case EXCP_NOCP:
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr |= R_V7M_CFSR_NOCP_MASK;
--        return;
-+        break;
-     case EXCP_SWI:
-         /* The PC already points to the next instruction.  */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
--        return;
-+        break;
-     case EXCP_PREFETCH_ABORT:
-     case EXCP_DATA_ABORT:
-         /* TODO: if we implemented the MPU registers, this is where we
-          * should set the MMFAR, etc from exception.fsr and exception.vaddress.
-          */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
--        return;
-+        break;
-     case EXCP_BKPT:
-         if (semihosting_enabled()) {
-             int nr;
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-             }
-         }
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
--        return;
-+        break;
-     case EXCP_IRQ:
--        armv7m_nvic_acknowledge_irq(env->nvic);
-         break;
-     case EXCP_EXCEPTION_EXIT:
-         do_v7m_exception_exit(env);
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         return; /* Never happens.  Keep compiler happy.  */
-     }
-+    armv7m_nvic_acknowledge_irq(env->nvic);
-+
-+    qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
-+
-     /* Align stack pointer if the guest wants that */
-     if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
-         env->regs[13] -= 4;
---
-.7.4

-[Qemu-devel] [PULL 20/30] armv7m: VECTCLRACTIVE and VECTRESET are UNPREDICTABLE
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-The VECTCLRACTIVE and VECTRESET bits in the AIRCR are both
-documented as UNPREDICTABLE if you write a 1 to them when
-the processor is not halted in Debug state (ie stopped
-and under the control of an external JTAG debugger).
-Since we don't implement Debug state or emulated JTAG
-these bits are always UNPREDICTABLE for us. Instead of
-logging them as unimplemented we can simply log writes
-as guest errors and ignore them.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-[PMM: change extracted from another patch; commit message
- constructed from scratch]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 8 ++++++--
-file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-                 qemu_irq_pulse(s->sysresetreq);
-             }
-             if (value & 2) {
--                qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n");
-+                qemu_log_mask(LOG_GUEST_ERROR,
-+                              "Setting VECTCLRACTIVE when not in DEBUG mode "
-+                              "is UNPREDICTABLE\n");
-             }
-             if (value & 1) {
--                qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
-+                qemu_log_mask(LOG_GUEST_ERROR,
-+                              "Setting VECTRESET when not in DEBUG mode "
-+                              "is UNPREDICTABLE\n");
-             }
-             s->prigroup = extract32(value, 8, 3);
-             nvic_irq_update(s);
---
-.7.4

-[Qemu-devel] [PULL 21/30] armv7m: Extract "exception taken" code into functions
+Deleted patch
-Extract the code from the tail end of arm_v7m_do_interrupt() which
-enters the exception handler into a pair of utility functions
-v7m_exception_taken() and v7m_push_stack(), which correspond roughly
-to the pseudocode PushStack() and ExceptionTaken().
-This also requires us to move the arm_v7m_load_vector() utility
-routine up so we can call it.
-Handling illegal exception returns has some cases where we want to
-take a UsageFault either on an existing stack frame or with a new
-stack frame but with a specific LR value, so we want to be able to
-call these without having to go via arm_v7m_cpu_do_interrupt().
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- target/arm/helper.c | 118 ++++++++++++++++++++++++++++++----------------------
-file changed, 68 insertions(+), 50 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
-     }
- }
-+static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
-+{
-+    CPUState *cs = CPU(cpu);
-+    CPUARMState *env = &cpu->env;
-+    MemTxResult result;
-+    hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;
-+    uint32_t addr;
-+
-+    addr = address_space_ldl(cs->as, vec,
-+                             MEMTXATTRS_UNSPECIFIED, &result);
-+    if (result != MEMTX_OK) {
-+        /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,
-+         * which would then be immediately followed by our failing to load
-+         * the entry vector for that HardFault, which is a Lockup case.
-+         * Since we don't model Lockup, we just report this guest error
-+         * via cpu_abort().
-+         */
-+        cpu_abort(cs, "Failed to read from exception vector table "
-+                  "entry %08x\n", (unsigned)vec);
-+    }
-+    return addr;
-+}
-+
-+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
-+{
-+    /* Do the "take the exception" parts of exception entry,
-+     * but not the pushing of state to the stack. This is
-+     * similar to the pseudocode ExceptionTaken() function.
-+     */
-+    CPUARMState *env = &cpu->env;
-+    uint32_t addr;
-+
-+    armv7m_nvic_acknowledge_irq(env->nvic);
-+    switch_v7m_sp(env, 0);
-+    /* Clear IT bits */
-+    env->condexec_bits = 0;
-+    env->regs[14] = lr;
-+    addr = arm_v7m_load_vector(cpu);
-+    env->regs[15] = addr & 0xfffffffe;
-+    env->thumb = addr & 1;
-+}
-+
-+static void v7m_push_stack(ARMCPU *cpu)
-+{
-+    /* Do the "set up stack frame" part of exception entry,
-+     * similar to pseudocode PushStack().
-+     */
-+    CPUARMState *env = &cpu->env;
-+    uint32_t xpsr = xpsr_read(env);
-+
-+    /* Align stack pointer if the guest wants that */
-+    if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
-+        env->regs[13] -= 4;
-+        xpsr |= 0x200;
-+    }
-+    /* Switch to the handler mode.  */
-+    v7m_push(env, xpsr);
-+    v7m_push(env, env->regs[15]);
-+    v7m_push(env, env->regs[14]);
-+    v7m_push(env, env->regs[12]);
-+    v7m_push(env, env->regs[3]);
-+    v7m_push(env, env->regs[2]);
-+    v7m_push(env, env->regs[1]);
-+    v7m_push(env, env->regs[0]);
-+}
-+
- static void do_v7m_exception_exit(CPUARMState *env)
- {
-     uint32_t type;
-@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)
-     }
- }
--static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
--
--{
--    CPUState *cs = CPU(cpu);
--    CPUARMState *env = &cpu->env;
--    MemTxResult result;
--    hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;
--    uint32_t addr;
--
--    addr = address_space_ldl(cs->as, vec,
--                             MEMTXATTRS_UNSPECIFIED, &result);
--    if (result != MEMTX_OK) {
--        /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,
--         * which would then be immediately followed by our failing to load
--         * the entry vector for that HardFault, which is a Lockup case.
--         * Since we don't model Lockup, we just report this guest error
--         * via cpu_abort().
--         */
--        cpu_abort(cs, "Failed to read from exception vector table "
--                  "entry %08x\n", (unsigned)vec);
--    }
--    return addr;
--}
--
- void arm_v7m_cpu_do_interrupt(CPUState *cs)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
--    uint32_t xpsr = xpsr_read(env);
-     uint32_t lr;
--    uint32_t addr;
-     arm_log_exception(cs->exception_index);
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         return; /* Never happens.  Keep compiler happy.  */
-     }
--    armv7m_nvic_acknowledge_irq(env->nvic);
--
-+    v7m_push_stack(cpu);
-+    v7m_exception_taken(cpu, lr);
-     qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
--
--    /* Align stack pointer if the guest wants that */
--    if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
--        env->regs[13] -= 4;
--        xpsr |= 0x200;
--    }
--    /* Switch to the handler mode.  */
--    v7m_push(env, xpsr);
--    v7m_push(env, env->regs[15]);
--    v7m_push(env, env->regs[14]);
--    v7m_push(env, env->regs[12]);
--    v7m_push(env, env->regs[3]);
--    v7m_push(env, env->regs[2]);
--    v7m_push(env, env->regs[1]);
--    v7m_push(env, env->regs[0]);
--    switch_v7m_sp(env, 0);
--    /* Clear IT bits */
--    env->condexec_bits = 0;
--    env->regs[14] = lr;
--    addr = arm_v7m_load_vector(cpu);
--    env->regs[15] = addr & 0xfffffffe;
--    env->thumb = addr & 1;
- }
- /* Function used to synchronize QEMU's AArch64 register set with AArch32
---
-.7.4

-[Qemu-devel] [PULL 23/30] armv7m: Raise correct kind of UsageFault for attempts to execute ARM code
+Deleted patch
-M profile doesn't implement ARM, and the architecturally required
-behaviour for attempts to execute with the Thumb bit clear is to
-generate a UsageFault with the CFSR INVSTATE bit set.  We were
-incorrectly implementing this as generating an UNDEFINSTR UsageFault;
-fix this.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- target/arm/cpu.h       | 1 +
- linux-user/main.c      | 1 +
- target/arm/helper.c    | 4 ++++
- target/arm/translate.c | 8 ++++++--
-files changed, 12 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #define EXCP_VFIQ           15
- #define EXCP_SEMIHOST       16   /* semihosting call */
- #define EXCP_NOCP           17   /* v7M NOCP UsageFault */
-+#define EXCP_INVSTATE       18   /* v7M INVSTATE UsageFault */
- #define ARMV7M_EXCP_RESET   1
- #define ARMV7M_EXCP_NMI     2
-diff --git a/linux-user/main.c b/linux-user/main.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/main.c
-+++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
-         switch(trapnr) {
-         case EXCP_UDEF:
-         case EXCP_NOCP:
-+        case EXCP_INVSTATE:
-             {
-                 TaskState *ts = cs->opaque;
-                 uint32_t opcode;
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr |= R_V7M_CFSR_NOCP_MASK;
-         break;
-+    case EXCP_INVSTATE:
-+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-+        env->v7m.cfsr |= R_V7M_CFSR_INVSTATE_MASK;
-+        break;
-     case EXCP_SWI:
-         /* The PC already points to the next instruction.  */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     TCGv_i32 addr;
-     TCGv_i64 tmp64;
--    /* M variants do not implement ARM mode.  */
-+    /* M variants do not implement ARM mode; this must raise the INVSTATE
-+     * UsageFault exception.
-+     */
-     if (arm_dc_feature(s, ARM_FEATURE_M)) {
--        goto illegal_op;
-+        gen_exception_insn(s, 4, EXCP_INVSTATE, syn_uncategorized(),
-+                           default_exception_el(s));
-+        return;
-     }
-     cond = insn >> 28;
-     if (cond == 0xf){
---
-.7.4

-[Qemu-devel] [PULL 24/30] armv7m: Allow SHCSR writes to change pending and active bits
+Deleted patch
-Implement the NVIC SHCSR write behaviour which allows pending and
-active status of some exceptions to be changed.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
----
- hw/intc/armv7m_nvic.c | 13 +++++++++++--
-file changed, 11 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
-         cpu->env.v7m.ccr = value;
-         break;
-     case 0xd24: /* System Handler Control.  */
--        /* TODO: Real hardware allows you to set/clear the active bits
--           under some circumstances.  We don't implement this.  */
-+        s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
-+        s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
-+        s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
-+        s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
-+        s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
-+        s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
-+        s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
-+        s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
-+        s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
-+        s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
-+        s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
-         s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
-         s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
-         s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
---
-.7.4

-[Qemu-devel] [PULL 27/30] bcm2835_gpio: add bcm2835 gpio controller
+Deleted patch
-From: Clement Deschamps <clement.deschamps@antfield.fr>
-This adds the BCM2835 GPIO controller.
-It currently implements:
-- The 54 GPIOs as outputs (qemu_irq)
-- The SD controller selection via alternate function of GPIOs 48-53
-Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
-Message-id: 20170224164021.9066-4-clement.deschamps@antfield.fr
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/gpio/Makefile.objs          |   1 +
- include/hw/gpio/bcm2835_gpio.h |  39 +++++
- hw/gpio/bcm2835_gpio.c         | 353 +++++++++++++++++++++++++++++++++++++++++
-files changed, 393 insertions(+)
- create mode 100644 include/hw/gpio/bcm2835_gpio.h
- create mode 100644 hw/gpio/bcm2835_gpio.c
-diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/Makefile.objs
-+++ b/hw/gpio/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_GPIO_KEY) += gpio_key.o
- obj-$(CONFIG_OMAP) += omap_gpio.o
- obj-$(CONFIG_IMX) += imx_gpio.o
-+obj-$(CONFIG_RASPI) += bcm2835_gpio.o
-diff --git a/include/hw/gpio/bcm2835_gpio.h b/include/hw/gpio/bcm2835_gpio.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/gpio/bcm2835_gpio.h
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Raspberry Pi (BCM2835) GPIO Controller
-+ *
-+ * Copyright (c) 2017 Antfield SAS
-+ *
-+ * Authors:
-+ *  Clement Deschamps <clement.deschamps@antfield.fr>
-+ *  Luc Michel <luc.michel@antfield.fr>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef BCM2835_GPIO_H
-+#define BCM2835_GPIO_H
-+
-+#include "hw/sd/sd.h"
-+
-+typedef struct BCM2835GpioState {
-+    SysBusDevice parent_obj;
-+
-+    MemoryRegion iomem;
-+
-+    /* SDBus selector */
-+    SDBus sdbus;
-+    SDBus *sdbus_sdhci;
-+    SDBus *sdbus_sdhost;
-+
-+    uint8_t fsel[54];
-+    uint32_t lev0, lev1;
-+    uint8_t sd_fsel;
-+    qemu_irq out[54];
-+} BCM2835GpioState;
-+
-+#define TYPE_BCM2835_GPIO "bcm2835_gpio"
-+#define BCM2835_GPIO(obj) \
-+    OBJECT_CHECK(BCM2835GpioState, (obj), TYPE_BCM2835_GPIO)
-+
-+#endif
-diff --git a/hw/gpio/bcm2835_gpio.c b/hw/gpio/bcm2835_gpio.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/gpio/bcm2835_gpio.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Raspberry Pi (BCM2835) GPIO Controller
-+ *
-+ * Copyright (c) 2017 Antfield SAS
-+ *
-+ * Authors:
-+ *  Clement Deschamps <clement.deschamps@antfield.fr>
-+ *  Luc Michel <luc.michel@antfield.fr>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "qemu/timer.h"
-+#include "qapi/error.h"
-+#include "hw/sysbus.h"
-+#include "hw/sd/sd.h"
-+#include "hw/gpio/bcm2835_gpio.h"
-+
-+#define GPFSEL0   0x00
-+#define GPFSEL1   0x04
-+#define GPFSEL2   0x08
-+#define GPFSEL3   0x0C
-+#define GPFSEL4   0x10
-+#define GPFSEL5   0x14
-+#define GPSET0    0x1C
-+#define GPSET1    0x20
-+#define GPCLR0    0x28
-+#define GPCLR1    0x2C
-+#define GPLEV0    0x34
-+#define GPLEV1    0x38
-+#define GPEDS0    0x40
-+#define GPEDS1    0x44
-+#define GPREN0    0x4C
-+#define GPREN1    0x50
-+#define GPFEN0    0x58
-+#define GPFEN1    0x5C
-+#define GPHEN0    0x64
-+#define GPHEN1    0x68
-+#define GPLEN0    0x70
-+#define GPLEN1    0x74
-+#define GPAREN0   0x7C
-+#define GPAREN1   0x80
-+#define GPAFEN0   0x88
-+#define GPAFEN1   0x8C
-+#define GPPUD     0x94
-+#define GPPUDCLK0 0x98
-+#define GPPUDCLK1 0x9C
-+
-+static uint32_t gpfsel_get(BCM2835GpioState *s, uint8_t reg)
-+{
-+    int i;
-+    uint32_t value = 0;
-+    for (i = 0; i < 10; i++) {
-+        uint32_t index = 10 * reg + i;
-+        if (index < sizeof(s->fsel)) {
-+            value |= (s->fsel[index] & 0x7) << (3 * i);
-+        }
-+    }
-+    return value;
-+}
-+
-+static void gpfsel_set(BCM2835GpioState *s, uint8_t reg, uint32_t value)
-+{
-+    int i;
-+    for (i = 0; i < 10; i++) {
-+        uint32_t index = 10 * reg + i;
-+        if (index < sizeof(s->fsel)) {
-+            int fsel = (value >> (3 * i)) & 0x7;
-+            s->fsel[index] = fsel;
-+        }
-+    }
-+
-+    /* SD controller selection (48-53) */
-+    if (s->sd_fsel != 0
-+            && (s->fsel[48] == 0) /* SD_CLK_R */
-+            && (s->fsel[49] == 0) /* SD_CMD_R */
-+            && (s->fsel[50] == 0) /* SD_DATA0_R */
-+            && (s->fsel[51] == 0) /* SD_DATA1_R */
-+            && (s->fsel[52] == 0) /* SD_DATA2_R */
-+            && (s->fsel[53] == 0) /* SD_DATA3_R */
-+            ) {
-+        /* SDHCI controller selected */
-+        sdbus_reparent_card(s->sdbus_sdhost, s->sdbus_sdhci);
-+        s->sd_fsel = 0;
-+    } else if (s->sd_fsel != 4
-+            && (s->fsel[48] == 4) /* SD_CLK_R */
-+            && (s->fsel[49] == 4) /* SD_CMD_R */
-+            && (s->fsel[50] == 4) /* SD_DATA0_R */
-+            && (s->fsel[51] == 4) /* SD_DATA1_R */
-+            && (s->fsel[52] == 4) /* SD_DATA2_R */
-+            && (s->fsel[53] == 4) /* SD_DATA3_R */
-+            ) {
-+        /* SDHost controller selected */
-+        sdbus_reparent_card(s->sdbus_sdhci, s->sdbus_sdhost);
-+        s->sd_fsel = 4;
-+    }
-+}
-+
-+static int gpfsel_is_out(BCM2835GpioState *s, int index)
-+{
-+    if (index >= 0 && index < 54) {
-+        return s->fsel[index] == 1;
-+    }
-+    return 0;
-+}
-+
-+static void gpset(BCM2835GpioState *s,
-+        uint32_t val, uint8_t start, uint8_t count, uint32_t *lev)
-+{
-+    uint32_t changes = val & ~*lev;
-+    uint32_t cur = 1;
-+
-+    int i;
-+    for (i = 0; i < count; i++) {
-+        if ((changes & cur) && (gpfsel_is_out(s, start + i))) {
-+            qemu_set_irq(s->out[start + i], 1);
-+        }
-+        cur <<= 1;
-+    }
-+
-+    *lev |= val;
-+}
-+
-+static void gpclr(BCM2835GpioState *s,
-+        uint32_t val, uint8_t start, uint8_t count, uint32_t *lev)
-+{
-+    uint32_t changes = val & *lev;
-+    uint32_t cur = 1;
-+
-+    int i;
-+    for (i = 0; i < count; i++) {
-+        if ((changes & cur) && (gpfsel_is_out(s, start + i))) {
-+            qemu_set_irq(s->out[start + i], 0);
-+        }
-+        cur <<= 1;
-+    }
-+
-+    *lev &= ~val;
-+}
-+
-+static uint64_t bcm2835_gpio_read(void *opaque, hwaddr offset,
-+        unsigned size)
-+{
-+    BCM2835GpioState *s = (BCM2835GpioState *)opaque;
-+
-+    switch (offset) {
-+    case GPFSEL0:
-+    case GPFSEL1:
-+    case GPFSEL2:
-+    case GPFSEL3:
-+    case GPFSEL4:
-+    case GPFSEL5:
-+        return gpfsel_get(s, offset / 4);
-+    case GPSET0:
-+    case GPSET1:
-+        /* Write Only */
-+        return 0;
-+    case GPCLR0:
-+    case GPCLR1:
-+        /* Write Only */
-+        return 0;
-+    case GPLEV0:
-+        return s->lev0;
-+    case GPLEV1:
-+        return s->lev1;
-+    case GPEDS0:
-+    case GPEDS1:
-+    case GPREN0:
-+    case GPREN1:
-+    case GPFEN0:
-+    case GPFEN1:
-+    case GPHEN0:
-+    case GPHEN1:
-+    case GPLEN0:
-+    case GPLEN1:
-+    case GPAREN0:
-+    case GPAREN1:
-+    case GPAFEN0:
-+    case GPAFEN1:
-+    case GPPUD:
-+    case GPPUDCLK0:
-+    case GPPUDCLK1:
-+        /* Not implemented */
-+        return 0;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-+                __func__, offset);
-+        break;
-+    }
-+
-+    return 0;
-+}
-+
-+static void bcm2835_gpio_write(void *opaque, hwaddr offset,
-+        uint64_t value, unsigned size)
-+{
-+    BCM2835GpioState *s = (BCM2835GpioState *)opaque;
-+
-+    switch (offset) {
-+    case GPFSEL0:
-+    case GPFSEL1:
-+    case GPFSEL2:
-+    case GPFSEL3:
-+    case GPFSEL4:
-+    case GPFSEL5:
-+        gpfsel_set(s, offset / 4, value);
-+        break;
-+    case GPSET0:
-+        gpset(s, value, 0, 32, &s->lev0);
-+        break;
-+    case GPSET1:
-+        gpset(s, value, 32, 22, &s->lev1);
-+        break;
-+    case GPCLR0:
-+        gpclr(s, value, 0, 32, &s->lev0);
-+        break;
-+    case GPCLR1:
-+        gpclr(s, value, 32, 22, &s->lev1);
-+        break;
-+    case GPLEV0:
-+    case GPLEV1:
-+        /* Read Only */
-+        break;
-+    case GPEDS0:
-+    case GPEDS1:
-+    case GPREN0:
-+    case GPREN1:
-+    case GPFEN0:
-+    case GPFEN1:
-+    case GPHEN0:
-+    case GPHEN1:
-+    case GPLEN0:
-+    case GPLEN1:
-+    case GPAREN0:
-+    case GPAREN1:
-+    case GPAFEN0:
-+    case GPAFEN1:
-+    case GPPUD:
-+    case GPPUDCLK0:
-+    case GPPUDCLK1:
-+        /* Not implemented */
-+        break;
-+    default:
-+        goto err_out;
-+    }
-+    return;
-+
-+err_out:
-+    qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-+            __func__, offset);
-+}
-+
-+static void bcm2835_gpio_reset(DeviceState *dev)
-+{
-+    BCM2835GpioState *s = BCM2835_GPIO(dev);
-+
-+    int i;
-+    for (i = 0; i < 6; i++) {
-+        gpfsel_set(s, i, 0);
-+    }
-+
-+    s->sd_fsel = 0;
-+
-+    /* SDHCI is selected by default */
-+    sdbus_reparent_card(&s->sdbus, s->sdbus_sdhci);
-+
-+    s->lev0 = 0;
-+    s->lev1 = 0;
-+}
-+
-+static const MemoryRegionOps bcm2835_gpio_ops = {
-+    .read = bcm2835_gpio_read,
-+    .write = bcm2835_gpio_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+};
-+
-+static const VMStateDescription vmstate_bcm2835_gpio = {
-+    .name = "bcm2835_gpio",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT8_ARRAY(fsel, BCM2835GpioState, 54),
-+        VMSTATE_UINT32(lev0, BCM2835GpioState),
-+        VMSTATE_UINT32(lev1, BCM2835GpioState),
-+        VMSTATE_UINT8(sd_fsel, BCM2835GpioState),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void bcm2835_gpio_init(Object *obj)
-+{
-+    BCM2835GpioState *s = BCM2835_GPIO(obj);
-+    DeviceState *dev = DEVICE(obj);
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+
-+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
-+                        TYPE_SD_BUS, DEVICE(s), "sd-bus");
-+
-+    memory_region_init_io(&s->iomem, obj,
-+            &bcm2835_gpio_ops, s, "bcm2835_gpio", 0x1000);
-+    sysbus_init_mmio(sbd, &s->iomem);
-+    qdev_init_gpio_out(dev, s->out, 54);
-+}
-+
-+static void bcm2835_gpio_realize(DeviceState *dev, Error **errp)
-+{
-+    BCM2835GpioState *s = BCM2835_GPIO(dev);
-+    Object *obj;
-+    Error *err = NULL;
-+
-+    obj = object_property_get_link(OBJECT(dev), "sdbus-sdhci", &err);
-+    if (obj == NULL) {
-+        error_setg(errp, "%s: required sdhci link not found: %s",
-+                __func__, error_get_pretty(err));
-+        return;
-+    }
-+    s->sdbus_sdhci = SD_BUS(obj);
-+
-+    obj = object_property_get_link(OBJECT(dev), "sdbus-sdhost", &err);
-+    if (obj == NULL) {
-+        error_setg(errp, "%s: required sdhost link not found: %s",
-+                __func__, error_get_pretty(err));
-+        return;
-+    }
-+    s->sdbus_sdhost = SD_BUS(obj);
-+}
-+
-+static void bcm2835_gpio_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->vmsd = &vmstate_bcm2835_gpio;
-+    dc->realize = &bcm2835_gpio_realize;
-+    dc->reset = &bcm2835_gpio_reset;
-+}
-+
-+static const TypeInfo bcm2835_gpio_info = {
-+    .name          = TYPE_BCM2835_GPIO,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(BCM2835GpioState),
-+    .instance_init = bcm2835_gpio_init,
-+    .class_init    = bcm2835_gpio_class_init,
-+};
-+
-+static void bcm2835_gpio_register_types(void)
-+{
-+    type_register_static(&bcm2835_gpio_info);
-+}
-+
-+type_init(bcm2835_gpio_register_types)
---
-.7.4

-[Qemu-devel] [PULL 29/30] hw/arm/exynos: Fix Linux kernel division by zero for PLLs
+Deleted patch
-From: Krzysztof Kozlowski <krzk@kernel.org>
-Without any clock controller, the Linux kernel was hitting division by
-zero during boot or with clk_summary:
-[    0.000000] [<c031054c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
-[    0.000000] [<c030ba6c>] (show_stack) from [<c05b2660>] (dump_stack+0x88/0x9c)
-[    0.000000] [<c05b2660>] (dump_stack) from [<c05b11a4>] (Ldiv0+0x8/0x10)
-[    0.000000] [<c05b11a4>] (Ldiv0) from [<c06ad1e0>] (samsung_pll45xx_recalc_rate+0x58/0x74)
-[    0.000000] [<c06ad1e0>] (samsung_pll45xx_recalc_rate) from [<c0692ec0>] (clk_register+0x39c/0x63c)
-[    0.000000] [<c0692ec0>] (clk_register) from [<c125d360>] (samsung_clk_register_pll+0x2e0/0x3d4)
-[    0.000000] [<c125d360>] (samsung_clk_register_pll) from [<c125d7e8>] (exynos4_clk_init+0x1b0/0x5e4)
-[    0.000000] [<c125d7e8>] (exynos4_clk_init) from [<c12335f4>] (of_clk_init+0x17c/0x210)
-[    0.000000] [<c12335f4>] (of_clk_init) from [<c1204700>] (time_init+0x24/0x2c)
-[    0.000000] [<c1204700>] (time_init) from [<c1200b2c>] (start_kernel+0x24c/0x38c)
-[    0.000000] [<c1200b2c>] (start_kernel) from [<4020807c>] (0x4020807c)
-Provide stub for clock controller returning reset values for PLLs.
-Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
-Message-id: 20170226200142.31169-1-krzk@kernel.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/Makefile.objs    |   2 +-
- hw/arm/exynos4210.c      |   6 ++
- hw/misc/exynos4210_clk.c | 164 +++++++++++++++++++++++++++++++++++++++++++++++
-files changed, 171 insertions(+), 1 deletion(-)
- create mode 100644 hw/misc/exynos4210_clk.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
- obj-$(CONFIG_REALVIEW) += arm_sysctl.o
- obj-$(CONFIG_NSERIES) += cbus.o
- obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
--obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o
-+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
- obj-$(CONFIG_IMX) += imx_ccm.o
- obj-$(CONFIG_IMX) += imx31_ccm.o
- obj-$(CONFIG_IMX) += imx25_ccm.o
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qapi/error.h"
- #include "qemu-common.h"
-+#include "qemu/log.h"
- #include "cpu.h"
- #include "hw/boards.h"
- #include "sysemu/sysemu.h"
-@@ -XXX,XX +XXX,XX @@
- /* PMU SFR base address */
- #define EXYNOS4210_PMU_BASE_ADDR            0x10020000
-+/* Clock controller SFR base address */
-+#define EXYNOS4210_CLK_BASE_ADDR            0x10030000
-+
- /* Display controllers (FIMD) */
- #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
-     */
-     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
-+    sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
-+
-     /* PWM */
-     sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
-                           s->irq_table[exynos4210_get_irq(22, 0)],
-diff --git a/hw/misc/exynos4210_clk.c b/hw/misc/exynos4210_clk.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/exynos4210_clk.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ *  Exynos4210 Clock Controller Emulation
-+ *
-+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
-+ *
-+ *  This program is free software; you can redistribute it and/or modify it
-+ *  under the terms of the GNU General Public License as published by the
-+ *  Free Software Foundation; either version 2 of the License, or
-+ *  (at your option) any later version.
-+ *
-+ *  This program is distributed in the hope that it will be useful, but WITHOUT
-+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ *  for more details.
-+ *
-+ *  You should have received a copy of the GNU General Public License along
-+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/sysbus.h"
-+#include "qemu/log.h"
-+
-+#define TYPE_EXYNOS4210_CLK             "exynos4210.clk"
-+#define EXYNOS4210_CLK(obj) \
-+    OBJECT_CHECK(Exynos4210ClkState, (obj), TYPE_EXYNOS4210_CLK)
-+
-+#define CLK_PLL_LOCKED                  BIT(29)
-+
-+#define EXYNOS4210_CLK_REGS_MEM_SIZE    0x15104
-+
-+typedef struct Exynos4210Reg {
-+    const char   *name; /* for debug only */
-+    uint32_t     offset;
-+    uint32_t     reset_value;
-+} Exynos4210Reg;
-+
-+/* Clock controller register base: 0x10030000 */
-+static const Exynos4210Reg exynos4210_clk_regs[] = {
-+    {"EPLL_LOCK",                     0xc010, 0x00000fff},
-+    {"VPLL_LOCK",                     0xc020, 0x00000fff},
-+    {"EPLL_CON0",                     0xc110, 0x00300301 | CLK_PLL_LOCKED},
-+    {"EPLL_CON1",                     0xc114, 0x00000000},
-+    {"VPLL_CON0",                     0xc120, 0x00240201 | CLK_PLL_LOCKED},
-+    {"VPLL_CON1",                     0xc124, 0x66010464},
-+    {"APLL_LOCK",                    0x14000, 0x00000fff},
-+    {"MPLL_LOCK",                    0x14004, 0x00000fff},
-+    {"APLL_CON0",                    0x14100, 0x00c80601 | CLK_PLL_LOCKED},
-+    {"APLL_CON1",                    0x14104, 0x0000001c},
-+    {"MPLL_CON0",                    0x14108, 0x00c80601 | CLK_PLL_LOCKED},
-+    {"MPLL_CON1",                    0x1410c, 0x0000001c},
-+};
-+
-+#define EXYNOS4210_REGS_NUM       ARRAY_SIZE(exynos4210_clk_regs)
-+
-+typedef struct Exynos4210ClkState {
-+    SysBusDevice parent_obj;
-+
-+    MemoryRegion iomem;
-+    uint32_t reg[EXYNOS4210_REGS_NUM];
-+} Exynos4210ClkState;
-+
-+static uint64_t exynos4210_clk_read(void *opaque, hwaddr offset,
-+                                    unsigned size)
-+{
-+    const Exynos4210ClkState *s = (Exynos4210ClkState *)opaque;
-+    const Exynos4210Reg *regs = exynos4210_clk_regs;
-+    unsigned int i;
-+
-+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
-+        if (regs->offset == offset) {
-+            return s->reg[i];
-+        }
-+        regs++;
-+    }
-+    qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read offset 0x%04x\n",
-+                  __func__, (uint32_t)offset);
-+    return 0;
-+}
-+
-+static void exynos4210_clk_write(void *opaque, hwaddr offset,
-+                                 uint64_t val, unsigned size)
-+{
-+    Exynos4210ClkState *s = (Exynos4210ClkState *)opaque;
-+    const Exynos4210Reg *regs = exynos4210_clk_regs;
-+    unsigned int i;
-+
-+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
-+        if (regs->offset == offset) {
-+            s->reg[i] = val;
-+            return;
-+        }
-+        regs++;
-+    }
-+    qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write offset 0x%04x\n",
-+                  __func__, (uint32_t)offset);
-+}
-+
-+static const MemoryRegionOps exynos4210_clk_ops = {
-+    .read = exynos4210_clk_read,
-+    .write = exynos4210_clk_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+    .valid = {
-+        .min_access_size = 4,
-+        .max_access_size = 4,
-+        .unaligned = false
-+    }
-+};
-+
-+static void exynos4210_clk_reset(DeviceState *dev)
-+{
-+    Exynos4210ClkState *s = EXYNOS4210_CLK(dev);
-+    unsigned int i;
-+
-+    /* Set default values for registers */
-+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
-+        s->reg[i] = exynos4210_clk_regs[i].reset_value;
-+    }
-+}
-+
-+static void exynos4210_clk_init(Object *obj)
-+{
-+    Exynos4210ClkState *s = EXYNOS4210_CLK(obj);
-+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-+
-+    /* memory mapping */
-+    memory_region_init_io(&s->iomem, obj, &exynos4210_clk_ops, s,
-+                          TYPE_EXYNOS4210_CLK, EXYNOS4210_CLK_REGS_MEM_SIZE);
-+    sysbus_init_mmio(dev, &s->iomem);
-+}
-+
-+static const VMStateDescription exynos4210_clk_vmstate = {
-+    .name = TYPE_EXYNOS4210_CLK,
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32_ARRAY(reg, Exynos4210ClkState, EXYNOS4210_REGS_NUM),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void exynos4210_clk_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->reset = exynos4210_clk_reset;
-+    dc->vmsd = &exynos4210_clk_vmstate;
-+}
-+
-+static const TypeInfo exynos4210_clk_info = {
-+    .name          = TYPE_EXYNOS4210_CLK,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(Exynos4210ClkState),
-+    .instance_init = exynos4210_clk_init,
-+    .class_init    = exynos4210_clk_class_init,
-+};
-+
-+static void exynos4210_clk_register(void)
-+{
-+    qemu_log_mask(LOG_GUEST_ERROR, "Clock init\n");
-+    type_register_static(&exynos4210_clk_info);
-+}
-+
-+type_init(exynos4210_clk_register)
---
-.7.4

ARM queu; includes all the NVIC rewrite patches.
The QOMify-armv7m patchset hasn't got enough review just
yet but I may be able to sneak it in before freeze
tomorrow if it gets review. Didn't want to hold this lot
up waiting, anyway.

thanks
-- PMM

The following changes since commit 8f2d7c341184a95d05476ea3c45dbae2b9ddbe51:

Merge remote-tracking branch 'remotes/berrange/tags/pull-qcrypto-2017-02-27-1' into staging (2017-02-27 15:33:21 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170227

for you to fetch changes up to 94d5bcf5a7f3799660b62098a5183f161aad0601:

hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID (2017-02-27 17:23:16 +0000)

----------------------------------------------------------------
target-arm queue:
 * raspi2: implement RNG module, GPIO and new SD card controller
   (sufficient to boot new raspbian kernels)
 * sdhci: bugfixes for block transfers
 * virt: fix cpu object reference leak
 * Add missing fp_access_check() to aarch64 crypto instructions
 * cputlb: Don't assume do_unassigned_access() never returns
 * virt: Add a user option to disallow ITS instantiation
 * i.MX timers: fix reset handling
 * ARMv7M NVIC: rewrite to fix broken priority handling and masking
 * exynos: Fix proper mapping of CPUs by providing real cluster ID
 * exynos: Fix Linux kernel division by zero for PLLs

----------------------------------------------------------------
Clement Deschamps (4):
      bcm2835_sdhost: add bcm2835 sdhost controller
      hw/sd: add card-reparenting function
      bcm2835_gpio: add bcm2835 gpio controller
      bcm2835: add sdhost and gpio controllers

Eric Auger (1):
      hw/arm/virt: Add a user option to disallow ITS instantiation

Igor Mammedov (1):
      hw/arm/virt: fix cpu object reference leak

Krzysztof Kozlowski (2):
      hw/arm/exynos: Fix Linux kernel division by zero for PLLs
      hw/arm/exynos: Fix proper mapping of CPUs by providing real cluster ID

Kurban Mallachiev (1):
      ARM i.MX timers: fix reset handling

Marcin Chojnacki (1):
      target-arm: Implement BCM2835 hardware RNG

Michael Davidsaver (5):
      armv7m: Rewrite NVIC to not use any GIC code
      arm: gic: Remove references to NVIC
      armv7m: Escalate exceptions to HardFault if necessary
      armv7m: Simpler and faster exception start
      armv7m: VECTCLRACTIVE and VECTRESET are UNPREDICTABLE

Nick Reilly (1):
      Add missing fp_access_check() to aarch64 crypto instructions

Peter Maydell (10):
      bcm2835_rng: Use qcrypto_random_bytes() rather than rand()
      cputlb: Don't assume do_unassigned_access() never returns
      armv7m: Rename nvic_state to NVICState
      armv7m: Implement reading and writing of PRIGROUP
      armv7m: Fix condition check for taking exceptions
      armv7m: Remove unused armv7m_nvic_acknowledge_irq() return value
      armv7m: Extract "exception taken" code into functions
      armv7m: Check exception return consistency
      armv7m: Raise correct kind of UsageFault for attempts to execute ARM code
      armv7m: Allow SHCSR writes to change pending and active bits

Prasad J Pandit (4):
      sd: sdhci: mask transfer mode register value
      sd: sdhci: check transfer mode register in multi block transfer
      sd: sdhci: conditionally invoke multi block transfer
      sd: sdhci: Remove block count enable check in single block transfers

From: Marcin Chojnacki <marcinch7@gmail.com>

Recent vanilla Raspberry Pi kernels started to make use of
the hardware random number generator in BCM2835 SoC. As a
result, those kernels wouldn't work anymore under QEMU
but rather just freeze during the boot process.

This patch implements a trivial BCM2835 compatible RNG,
and adds it as a peripheral to BCM2835 platform, which
allows to boot a vanilla Raspberry Pi kernel under Qemu.

Changes since v1:
 * Prevented guest from writing [31..20] bits in rng_status
 * Removed redundant minimum_version_id_old
 * Added field entries for the state
 * Changed realize function to reset

Signed-off-by: Marcin Chojnacki <marcinch7@gmail.com>
Message-id: 20170210210857.47893-1-marcinch7@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs                |   1 +
 include/hw/arm/bcm2835_peripherals.h |   2 +
 include/hw/misc/bcm2835_rng.h        |  27 ++++++++
 hw/arm/bcm2835_peripherals.c         |  15 +++++
 hw/misc/bcm2835_rng.c                | 124 +++++++++++++++++++++++++++++++++++
 5 files changed, 169 insertions(+)
 create mode 100644 include/hw/misc/bcm2835_rng.h
 create mode 100644 hw/misc/bcm2835_rng.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_sdrc.o
 obj-$(CONFIG_OMAP) += omap_tap.o
 obj-$(CONFIG_RASPI) += bcm2835_mbox.o
 obj-$(CONFIG_RASPI) += bcm2835_property.o
+obj-$(CONFIG_RASPI) += bcm2835_rng.o
 obj-$(CONFIG_SLAVIO) += slavio_misc.o
 obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 obj-$(CONFIG_ZYNQ) += zynq-xadc.o
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/dma/bcm2835_dma.h"
 #include "hw/intc/bcm2835_ic.h"
 #include "hw/misc/bcm2835_property.h"
+#include "hw/misc/bcm2835_rng.h"
 #include "hw/misc/bcm2835_mbox.h"
 #include "hw/sd/sdhci.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
     BCM2835DMAState dma;
     BCM2835ICState ic;
     BCM2835PropertyState property;
+    BCM2835RngState rng;
     BCM2835MboxState mboxes;
     SDHCIState sdhci;
 } BCM2835PeripheralState;
diff --git a/include/hw/misc/bcm2835_rng.h b/include/hw/misc/bcm2835_rng.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/bcm2835_rng.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * BCM2835 Random Number Generator emulation
+ *
+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef BCM2835_RNG_H
+#define BCM2835_RNG_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_BCM2835_RNG "bcm2835-rng"
+#define BCM2835_RNG(obj) \
+        OBJECT_CHECK(BCM2835RngState, (obj), TYPE_BCM2835_RNG)
+
+typedef struct {
+    SysBusDevice busdev;
+    MemoryRegion iomem;
+
+    uint32_t rng_ctrl;
+    uint32_t rng_status;
+} BCM2835RngState;
+
+#endif
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
     object_property_add_const_link(OBJECT(&s->property), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr), &error_abort);
 
+    /* Random Number Generator */
+    object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
+    object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
+    qdev_set_parent_bus(DEVICE(&s->rng), sysbus_get_default());
+
     /* Extended Mass Media Controller */
     object_initialize(&s->sdhci, sizeof(s->sdhci), TYPE_SYSBUS_SDHCI);
     object_property_add_child(obj, "sdhci", OBJECT(&s->sdhci), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
                       qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
 
+    /* Random Number Generator */
+    object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
+
     /* Extended Mass Media Controller */
     object_property_set_int(OBJECT(&s->sdhci), BCM2835_SDHC_CAPAREG, "capareg",
                             &err);
diff --git a/hw/misc/bcm2835_rng.c b/hw/misc/bcm2835_rng.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/bcm2835_rng.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * BCM2835 Random Number Generator emulation
+ *
+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/misc/bcm2835_rng.h"
+
+static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
+                                 unsigned size)
+{
+    BCM2835RngState *s = (BCM2835RngState *)opaque;
+    uint32_t res = 0;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case 0x0:    /* rng_ctrl */
+        res = s->rng_ctrl;
+        break;
+    case 0x4:    /* rng_status */
+        res = s->rng_status | (1 << 24);
+        break;
+    case 0x8:    /* rng_data */
+        res = rand();
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "bcm2835_rng_read: Bad offset %x\n",
+                      (int)offset);
+        res = 0;
+        break;
+    }
+
+    return res;
+}
+
+static void bcm2835_rng_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size)
+{
+    BCM2835RngState *s = (BCM2835RngState *)opaque;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case 0x0:    /* rng_ctrl */
+        s->rng_ctrl = value;
+        break;
+    case 0x4:    /* rng_status */
+        /* we shouldn't let the guest write to bits [31..20] */
+        s->rng_status &= ~0xFFFFF;        /* clear 20 lower bits */
+        s->rng_status |= value & 0xFFFFF; /* set them to new value */
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "bcm2835_rng_write: Bad offset %x\n",
+                      (int)offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps bcm2835_rng_ops = {
+    .read = bcm2835_rng_read,
+    .write = bcm2835_rng_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_bcm2835_rng = {
+    .name = TYPE_BCM2835_RNG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(rng_ctrl, BCM2835RngState),
+        VMSTATE_UINT32(rng_status, BCM2835RngState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_rng_init(Object *obj)
+{
+    BCM2835RngState *s = BCM2835_RNG(obj);
+
+    memory_region_init_io(&s->iomem, obj, &bcm2835_rng_ops, s,
+                          TYPE_BCM2835_RNG, 0x10);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static void bcm2835_rng_reset(DeviceState *dev)
+{
+    BCM2835RngState *s = BCM2835_RNG(dev);
+
+    s->rng_ctrl = 0;
+    s->rng_status = 0;
+}
+
+static void bcm2835_rng_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = bcm2835_rng_reset;
+    dc->vmsd = &vmstate_bcm2835_rng;
+}
+
+static TypeInfo bcm2835_rng_info = {
+    .name          = TYPE_BCM2835_RNG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835RngState),
+    .class_init    = bcm2835_rng_class_init,
+    .instance_init = bcm2835_rng_init,
+};
+
+static void bcm2835_rng_register_types(void)
+{
+    type_register_static(&bcm2835_rng_info);
+}
+
+type_init(bcm2835_rng_register_types)
-- 
2.7.4

Switch to using qcrypto_random_bytes() rather than rand() as
our source of randomness for the BCM2835 RNG.

If qcrypto_random_bytes() fails, we don't want to return the guest a
non-random value in case they're really using it for cryptographic
purposes, so the best we can do is a fatal error.  This shouldn't
happen unless something's broken, though.

In theory we could implement this device's full FIFO and interrupt
semantics and then just stop filling the FIFO.  That's a lot of work,
though, and doesn't really give a very nice diagnostic to the user
since the guest will just seem to hang.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
---
 hw/misc/bcm2835_rng.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/hw/misc/bcm2835_rng.c b/hw/misc/bcm2835_rng.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_rng.c
+++ b/hw/misc/bcm2835_rng.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "qapi/error.h"
+#include "crypto/random.h"
 #include "hw/misc/bcm2835_rng.h"
 
+static uint32_t get_random_bytes(void)
+{
+    uint32_t res;
+    Error *err = NULL;
+
+    if (qcrypto_random_bytes((uint8_t *)&res, sizeof(res), &err) < 0) {
+        /* On failure we don't want to return the guest a non-random
+         * value in case they're really using it for cryptographic
+         * purposes, so the best we can do is die here.
+         * This shouldn't happen unless something's broken.
+         * In theory we could implement this device's full FIFO
+         * and interrupt semantics and then just stop filling the
+         * FIFO. That's a lot of work, though, so we assume any
+         * errors are systematic problems and trust that if we didn't
+         * fail as the guest inited then we won't fail later on
+         * mid-run.
+         */
+        error_report_err(err);
+        exit(1);
+    }
+    return res;
+}
+
 static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
                                  unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_rng_read(void *opaque, hwaddr offset,
         res = s->rng_status | (1 << 24);
         break;
     case 0x8:    /* rng_data */
-        res = rand();
+        res = get_random_bytes();
         break;
 
     default:
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

In SDHCI protocol, the transfer mode register is defined
to be of 6 bits. Mask its value with '0x0037' so that an
invalid value could not be assigned.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170214185225.7994-2-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
     (SDHC_CAPAB_TOCLKFREQ))
 
+#define MASK_TRNMOD     0x0037
 #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
 
 static uint8_t sdhci_slotint(SDHCIState *s)
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
             value &= ~SDHC_TRNS_DMA;
         }
-        MASKED_WRITE(s->trnmod, mask, value);
+        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
 
         /* Writing to the upper byte of CMDREG triggers SD command generation */
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

In the SDHCI protocol, the transfer mode register value
is used during multi block transfer to check if block count
register is enabled and should be updated. Transfer mode
register could be set such that, block count register would
not be updated, thus leading to an infinite loop. Add check
to avoid it.

Reported-by: Wjjzhang <wjjzhang@tencent.com>
Reported-by: Jiang Xin <jiangxin1@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170214185225.7994-3-ppandit@redhat.com
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
     uint32_t boundary_chk = 1 << (((s->blksize & 0xf000) >> 12) + 12);
     uint32_t boundary_count = boundary_chk - (s->sdmasysad % boundary_chk);
 
+    if (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || !s->blkcnt) {
+        qemu_log_mask(LOG_UNIMP, "infinite transfer is not supported\n");
+        return;
+    }
+
     /* XXX: Some sd/mmc drivers (for example, u-boot-slp) do not account for
      * possible stop at page boundary if initial address is not page aligned,
      * allow them to work properly */
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
     if (s->trnmod & SDHC_TRNS_DMA) {
         switch (SDHC_DMA_TYPE(s->hostctl)) {
         case SDHC_CTRL_SDMA:
-            if ((s->trnmod & SDHC_TRNS_MULTI) &&
-                    (!(s->trnmod & SDHC_TRNS_BLK_CNT_EN) || s->blkcnt == 0)) {
-                break;
-            }
-
             if ((s->blkcnt == 1) || !(s->trnmod & SDHC_TRNS_MULTI)) {
                 sdhci_sdma_transfer_single_block(s);
             } else {
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

In sdhci_write invoke multi block transfer if it is enabled
in the transfer mode register 's->trnmod'.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170214185225.7994-4-ppandit@redhat.com
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         /* Writing to last byte of sdmasysad might trigger transfer */
         if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt &&
                 s->blksize && SDHC_DMA_TYPE(s->hostctl) == SDHC_CTRL_SDMA) {
-            sdhci_sdma_transfer_multi_blocks(s);
+            if (s->trnmod & SDHC_TRNS_MULTI) {
+                sdhci_sdma_transfer_multi_blocks(s);
+            } else {
+                sdhci_sdma_transfer_single_block(s);
+            }
         }
         break;
     case SDHC_BLKSIZE:
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

In SDHCI protocol, the 'Block count enable' bit of the Transfer
Mode register is relevant only in multi block transfers. We need
not check it in single block transfers.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20170214185225.7994-5-ppandit@redhat.com
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
 }
 
 /* single block SDMA transfer */
-
 static void sdhci_sdma_transfer_single_block(SDHCIState *s)
 {
     int n;
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
         }
     }
-
-    if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) {
-        s->blkcnt--;
-    }
+    s->blkcnt--;
 
     sdhci_end_transfer(s);
 }
-- 
2.7.4

From: Igor Mammedov <imammedo@redhat.com>

object_new(FOO) returns an object with ref_cnt == 1
and following
  object_property_set_bool(cpuobj, true, "realized", NULL)
set parent of cpuobj to '/machine/unattached' which makes
ref_cnt == 2.

Since machvirt_init() doesn't take ownership of cpuobj
returned by object_new() it should explicitly drop
reference to cpuobj when dangling pointer is about to
go out of scope like it's done pc_new_cpu() to avoid
object leak.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 1487253461-269218-1-git-send-email-imammedo@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         }
 
         object_property_set_bool(cpuobj, true, "realized", NULL);
+        object_unref(cpuobj);
     }
     fdt_add_timer_nodes(vms);
     fdt_add_cpu_nodes(vms);
-- 
2.7.4

From: Nick Reilly <nreilly@blackberry.com>

The aarch64 crypto instructions for AES and SHA are missing the
check for if the FPU is enabled.

Signed-off-by: Nick Reilly <nreilly@blackberry.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
         return;
     }
 
+    if (!fp_access_check(s)) {
+        return;
+    }
+
     /* Note that we convert the Vx register indexes into the
      * index within the vfp.regs[] array, so we can share the
      * helper with the AArch32 instructions.
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
+    if (!fp_access_check(s)) {
+        return;
+    }
+
     tcg_rd_regno = tcg_const_i32(rd << 1);
     tcg_rn_regno = tcg_const_i32(rn << 1);
     tcg_rm_regno = tcg_const_i32(rm << 1);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
+    if (!fp_access_check(s)) {
+        return;
+    }
+
     tcg_rd_regno = tcg_const_i32(rd << 1);
     tcg_rn_regno = tcg_const_i32(rn << 1);
 
-- 
2.7.4

In get_page_addr_code(), if the guest PC doesn't correspond to RAM
then we currently run the CPU's do_unassigned_access() hook if it has
one, and otherwise we give up and exit QEMU with a more-or-less
useful message.  This code assumes that the do_unassigned_access hook
will never return, because if it does then we'll plough on attempting
to use a non-RAM TLB entry to get a RAM address and will abort() in
qemu_ram_addr_from_host_nofail().  Unfortunately some CPU
implementations of this hook do return: Microblaze, SPARC and the ARM
v7M.

Change the code to call report_bad_exec() if the hook returns, as
well as if it didn't have one.  This means we can tidy it up to use
the cpu_unassigned_access() function which wraps the "get the CPU
class and call the hook if it has one" work, since we aren't trying
to distinguish "no hook" from "hook existed and returned" any more.

This brings the handling of this hook into line with the handling
used for data accesses, where "hook returned" is treated the
same as "no hook existed" and gets you the default behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
---
 cputlb.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/cputlb.c b/cputlb.c
index XXXXXXX..XXXXXXX 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
     pd = iotlbentry->addr & ~TARGET_PAGE_MASK;
     mr = iotlb_to_region(cpu, pd, iotlbentry->attrs);
     if (memory_region_is_unassigned(mr)) {
-        CPUClass *cc = CPU_GET_CLASS(cpu);
-
-        if (cc->do_unassigned_access) {
-            cc->do_unassigned_access(cpu, addr, false, true, 0, 4);
-        } else {
-            report_bad_exec(cpu, addr);
-            exit(1);
-        }
+        cpu_unassigned_access(cpu, addr, false, true, 0, 4);
+        /* The CPU's unassigned access hook might have longjumped out
+         * with an exception. If it didn't (or there was no hook) then
+         * we can't proceed further.
+         */
+        report_bad_exec(cpu, addr);
+        exit(1);
     }
     p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
     return qemu_ram_addr_from_host_nofail(p);
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

In 2.9 ITS will block save/restore and migration use cases. As such,
let's introduce a user option that allows to turn its instantiation
off, along with GICv3. With the "its" option turned false, migration
will be possible, obviously at the expense of MSI support (with GICv3).

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1487681108-14452-1-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |  1 +
 hw/arm/virt.c         | 31 +++++++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     FWCfgState *fw_cfg;
     bool secure;
     bool highmem;
+    bool its;
     bool virt;
     int32_t gic_version;
     struct arm_boot_info bootinfo;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms, qemu_irq *pic)
 static void create_gic(VirtMachineState *vms, qemu_irq *pic)
 {
     /* We create a standalone GIC */
-    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
     DeviceState *gicdev;
     SysBusDevice *gicbusdev;
     const char *gictype;
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, qemu_irq *pic)
 
     fdt_add_gic_node(vms);
 
-    if (type == 3 && !vmc->no_its) {
+    if (type == 3 && vms->its) {
         create_its(vms, gicdev);
     } else if (type == 2) {
         create_v2m(vms, pic);
@@ -XXX,XX +XXX,XX @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
     vms->highmem = value;
 }
 
+static bool virt_get_its(Object *obj, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    return vms->its;
+}
+
+static void virt_set_its(Object *obj, bool value, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    vms->its = value;
+}
+
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ type_init(machvirt_machine_init);
 static void virt_2_9_instance_init(Object *obj)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
+    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
 
     /* EL3 is disabled by default on virt: this makes us consistent
      * between KVM and TCG for this board, and it also allows us to
@@ -XXX,XX +XXX,XX @@ static void virt_2_9_instance_init(Object *obj)
                                     "Set GIC version. "
                                     "Valid values are 2, 3 and host", NULL);
 
+    if (vmc->no_its) {
+        vms->its = false;
+    } else {
+        /* Default allows ITS instantiation */
+        vms->its = true;
+        object_property_add_bool(obj, "its", virt_get_its,
+                                 virt_set_its, NULL);
+        object_property_set_description(obj, "its",
+                                        "Set on/off to enable/disable "
+                                        "ITS instantiation",
+                                        NULL);
+    }
+
     vms->memmap = a15memmap;
     vms->irqmap = a15irqmap;
 }
-- 
2.7.4

From: Kurban Mallachiev <mallachiev@ispras.ru>

The i.MX timer device can be reset by writing to the SWR bit
of the CR register. This has to behave differently from hard
(power-on) reset because it does not reset all of the bits
in the CR register.

We were incorrectly implementing soft reset and hard reset
the same way, and in addition had a logic error which meant
that we were clearing the bits that soft-reset is supposed
to preserve and not touching the bits that soft-reset clears.
This was not correct behaviour for either kind of reset.

Separate out the soft reset and hard reset code paths, and
correct the handling of reset of the CR register so that it
is correct in both cases.

Signed-off-by: Kurban Mallachiev <mallachiev@ispras.ru>
[PMM: rephrased commit message, spacing on operators;
 use bool rather than int for is_soft_reset]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/imx_gpt.c | 33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_gpt_read(void *opaque, hwaddr offset, unsigned size)
     return reg_value;
 }
 
-static void imx_gpt_reset(DeviceState *dev)
-{
-    IMXGPTState *s = IMX_GPT(dev);
 
+static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
+{
     /* stop timer */
     ptimer_stop(s->timer);
 
-    /*
-     * Soft reset doesn't touch some bits; hard reset clears them
+    /* Soft reset and hard reset differ only in their handling of the CR
+     * register -- soft reset preserves the values of some bits there.
      */
-    s->cr &= ~(GPT_CR_EN|GPT_CR_ENMOD|GPT_CR_STOPEN|GPT_CR_DOZEN|
-               GPT_CR_WAITEN|GPT_CR_DBGEN);
+    if (is_soft_reset) {
+        /* Clear all CR bits except those that are preserved by soft reset. */
+        s->cr &= GPT_CR_EN | GPT_CR_ENMOD | GPT_CR_STOPEN | GPT_CR_DOZEN |
+            GPT_CR_WAITEN | GPT_CR_DBGEN |
+            (GPT_CR_CLKSRC_MASK << GPT_CR_CLKSRC_SHIFT);
+    } else {
+        s->cr = 0;
+    }
     s->sr = 0;
     s->pr = 0;
     s->ir = 0;
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_reset(DeviceState *dev)
     }
 }
 
+static void imx_gpt_soft_reset(DeviceState *dev)
+{
+    IMXGPTState *s = IMX_GPT(dev);
+    imx_gpt_reset_common(s, true);
+}
+
+static void imx_gpt_reset(DeviceState *dev)
+{
+    IMXGPTState *s = IMX_GPT(dev);
+    imx_gpt_reset_common(s, false);
+}
+
 static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
                           unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
         s->cr = value & ~0x7c14;
         if (s->cr & GPT_CR_SWR) { /* force reset */
             /* handle the reset */
-            imx_gpt_reset(DEVICE(s));
+            imx_gpt_soft_reset(DEVICE(s));
         } else {
             /* set our freq, as the source might have changed */
             imx_gpt_set_freq(s);
-- 
2.7.4

Rename the nvic_state struct to NVICState, to match
our naming conventions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "gic_internal.h"
 #include "qemu/log.h"
 
-typedef struct {
+typedef struct NVICState {
     GICState gic;
     ARMCPU *cpu;
     struct {
@@ -XXX,XX +XXX,XX @@ typedef struct {
     MemoryRegion container;
     uint32_t num_irq;
     qemu_irq sysresetreq;
-} nvic_state;
+} NVICState;
 
 #define TYPE_NVIC "armv7m_nvic"
 /**
@@ -XXX,XX +XXX,XX @@ typedef struct NVICClass {
 #define NVIC_GET_CLASS(obj) \
     OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC)
 #define NVIC(obj) \
-    OBJECT_CHECK(nvic_state, (obj), TYPE_NVIC)
+    OBJECT_CHECK(NVICState, (obj), TYPE_NVIC)
 
 static const uint8_t nvic_id[] = {
     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
 int system_clock_scale;
 
 /* Conversion factor from qemu timer to SysTick frequencies.  */
-static inline int64_t systick_scale(nvic_state *s)
+static inline int64_t systick_scale(NVICState *s)
 {
     if (s->systick.control & SYSTICK_CLKSOURCE)
         return system_clock_scale;
@@ -XXX,XX +XXX,XX @@ static inline int64_t systick_scale(nvic_state *s)
         return 1000;
 }
 
-static void systick_reload(nvic_state *s, int reset)
+static void systick_reload(NVICState *s, int reset)
 {
     /* The Cortex-M3 Devices Generic User Guide says that "When the
      * ENABLE bit is set to 1, the counter loads the RELOAD value from the
@@ -XXX,XX +XXX,XX @@ static void systick_reload(nvic_state *s, int reset)
 
 static void systick_timer_tick(void * opaque)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     s->systick.control |= SYSTICK_COUNTFLAG;
     if (s->systick.control & SYSTICK_TICKINT) {
         /* Trigger the interrupt.  */
@@ -XXX,XX +XXX,XX @@ static void systick_timer_tick(void * opaque)
     }
 }
 
-static void systick_reset(nvic_state *s)
+static void systick_reset(NVICState *s)
 {
     s->systick.control = 0;
     s->systick.reload = 0;
@@ -XXX,XX +XXX,XX @@ static void systick_reset(nvic_state *s)
    IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
 void armv7m_nvic_set_pending(void *opaque, int irq)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     if (irq >= 16)
         irq += 16;
     gic_set_pending_private(&s->gic, 0, irq);
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq)
 /* Make pending IRQ active.  */
 int armv7m_nvic_acknowledge_irq(void *opaque)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     uint32_t irq;
 
     irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED);
@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_acknowledge_irq(void *opaque)
 
 void armv7m_nvic_complete_irq(void *opaque, int irq)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     if (irq >= 16)
         irq += 16;
     gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED);
 }
 
-static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
+static uint32_t nvic_readl(NVICState *s, uint32_t offset)
 {
     ARMCPU *cpu = s->cpu;
     uint32_t val;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(nvic_state *s, uint32_t offset)
     }
 }
 
-static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
+static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
 {
     ARMCPU *cpu = s->cpu;
     uint32_t oldval;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(nvic_state *s, uint32_t offset, uint32_t value)
 static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
                                  unsigned size)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     uint32_t offset = addr;
     int i;
     uint32_t val;
@@ -XXX,XX +XXX,XX @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
 static void nvic_sysreg_write(void *opaque, hwaddr addr,
                               uint64_t value, unsigned size)
 {
-    nvic_state *s = (nvic_state *)opaque;
+    NVICState *s = (NVICState *)opaque;
     uint32_t offset = addr;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32(systick.control, nvic_state),
-        VMSTATE_UINT32(systick.reload, nvic_state),
-        VMSTATE_INT64(systick.tick, nvic_state),
-        VMSTATE_TIMER_PTR(systick.timer, nvic_state),
+        VMSTATE_UINT32(systick.control, NVICState),
+        VMSTATE_UINT32(systick.reload, NVICState),
+        VMSTATE_INT64(systick.tick, NVICState),
+        VMSTATE_TIMER_PTR(systick.timer, NVICState),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static void armv7m_nvic_reset(DeviceState *dev)
 {
-    nvic_state *s = NVIC(dev);
+    NVICState *s = NVIC(dev);
     NVICClass *nc = NVIC_GET_CLASS(s);
     nc->parent_reset(dev);
     /* Common GIC reset resets to disabled; the NVIC doesn't have
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
 
 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
 {
-    nvic_state *s = NVIC(dev);
+    NVICState *s = NVIC(dev);
     NVICClass *nc = NVIC_GET_CLASS(s);
     Error *local_err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
      */
     GICState *s = ARM_GIC_COMMON(obj);
     DeviceState *dev = DEVICE(obj);
-    nvic_state *nvic = NVIC(obj);
+    NVICState *nvic = NVIC(obj);
     /* The ARM v7m may have anything from 0 to 496 external interrupt
      * IRQ lines. We default to 64. Other boards may differ and should
      * set the num-irq property appropriately.
@@ -XXX,XX +XXX,XX @@ static const TypeInfo armv7m_nvic_info = {
     .name          = TYPE_NVIC,
     .parent        = TYPE_ARM_GIC_COMMON,
     .instance_init = armv7m_nvic_instance_init,
-    .instance_size = sizeof(nvic_state),
+    .instance_size = sizeof(NVICState),
     .class_init    = armv7m_nvic_class_init,
     .class_size    = sizeof(NVICClass),
 };
-- 
2.7.4

Add a state field for the v7M PRIGROUP register and implent
reading and writing it. The current NVIC doesn't honour
the values written, but the new version will.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 typedef struct NVICState {
     GICState gic;
     ARMCPU *cpu;
+
+    uint32_t prigroup;
+
     struct {
         uint32_t control;
         uint32_t reload;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xd08: /* Vector Table Offset.  */
         return cpu->env.v7m.vecbase;
     case 0xd0c: /* Application Interrupt/Reset Control.  */
-        return 0xfa050000;
+        return 0xfa050000 | (s->prigroup << 8);
     case 0xd10: /* System Control.  */
         /* TODO: Implement SLEEPONEXIT.  */
         return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
             if (value & 1) {
                 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
             }
-            if (value & 0x700) {
-                qemu_log_mask(LOG_UNIMP, "PRIGROUP unimplemented\n");
-            }
+            s->prigroup = extract32(value, 8, 3);
         }
         break;
     case 0xd10: /* System Control.  */
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_sysreg_ops = {
 
 static const VMStateDescription vmstate_nvic = {
     .name = "armv7m_nvic",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(systick.control, NVICState),
         VMSTATE_UINT32(systick.reload, NVICState),
         VMSTATE_INT64(systick.tick, NVICState),
         VMSTATE_TIMER_PTR(systick.timer, NVICState),
+        VMSTATE_UINT32(prigroup, NVICState),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Despite some superficial similarities of register layout, the
M-profile NVIC is really very different from the A-profile GIC.
Our current attempt to reuse the GIC code means that we have
significant bugs in our NVIC.

Implement the NVIC as an entirely separate device, to give
us somewhere we can get the behaviour correct.

This initial commit does not attempt to implement exception
priority escalation, since the GIC-based code didn't either.
It does fix a few bugs in passing:
 * ICSR.RETTOBASE polarity was wrong and didn't account for
   internal exceptions
 * ICSR.VECTPENDING was 16 too high if the pending exception
   was for an external interrupt
 * UsageFault, BusFault and MemFault were not disabled on reset
   as they are supposed to be

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
[PMM: reworked, various bugs and stylistic cleanups]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 738 ++++++++++++++++++++++++++++++++++++++++----------
 hw/intc/trace-events  |  15 +
 2 files changed, 609 insertions(+), 144 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
 #include "hw/arm/arm.h"
+#include "target/arm/cpu.h"
 #include "exec/address-spaces.h"
-#include "gic_internal.h"
 #include "qemu/log.h"
+#include "trace.h"
+
+/* IRQ number counting:
+ *
+ * the num-irq property counts the number of external IRQ lines
+ *
+ * NVICState::num_irq counts the total number of exceptions
+ * (external IRQs, the 15 internal exceptions including reset,
+ * and one for the unused exception number 0).
+ *
+ * NVIC_MAX_IRQ is the highest permitted number of external IRQ lines.
+ *
+ * NVIC_MAX_VECTORS is the highest permitted number of exceptions.
+ *
+ * Iterating through all exceptions should typically be done with
+ * for (i = 1; i < s->num_irq; i++) to avoid the unused slot 0.
+ *
+ * The external qemu_irq lines are the NVIC's external IRQ lines,
+ * so line 0 is exception 16.
+ *
+ * In the terminology of the architecture manual, "interrupts" are
+ * a subcategory of exception referring to the external interrupts
+ * (which are exception numbers NVIC_FIRST_IRQ and upward).
+ * For historical reasons QEMU tends to use "interrupt" and
+ * "exception" more or less interchangeably.
+ */
+#define NVIC_FIRST_IRQ 16
+#define NVIC_MAX_VECTORS 512
+#define NVIC_MAX_IRQ (NVIC_MAX_VECTORS - NVIC_FIRST_IRQ)
+
+/* Effective running priority of the CPU when no exception is active
+ * (higher than the highest possible priority value)
+ */
+#define NVIC_NOEXC_PRIO 0x100
+
+typedef struct VecInfo {
+    /* Exception priorities can range from -3 to 255; only the unmodifiable
+     * priority values for RESET, NMI and HardFault can be negative.
+     */
+    int16_t prio;
+    uint8_t enabled;
+    uint8_t pending;
+    uint8_t active;
+    uint8_t level; /* exceptions <=15 never set level */
+} VecInfo;
 
 typedef struct NVICState {
-    GICState gic;
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
     ARMCPU *cpu;
 
+    VecInfo vectors[NVIC_MAX_VECTORS];
     uint32_t prigroup;
 
+    /* vectpending and exception_prio are both cached state that can
+     * be recalculated from the vectors[] array and the prigroup field.
+     */
+    unsigned int vectpending; /* highest prio pending enabled exception */
+    int exception_prio; /* group prio of the highest prio active exception */
+
     struct {
         uint32_t control;
         uint32_t reload;
         int64_t tick;
         QEMUTimer *timer;
     } systick;
+
     MemoryRegion sysregmem;
-    MemoryRegion gic_iomem_alias;
     MemoryRegion container;
+
     uint32_t num_irq;
+    qemu_irq excpout;
     qemu_irq sysresetreq;
 } NVICState;
 
 #define TYPE_NVIC "armv7m_nvic"
-/**
- * NVICClass:
- * @parent_reset: the parent class' reset handler.
- *
- * A model of the v7M NVIC and System Controller
- */
-typedef struct NVICClass {
-    /*< private >*/
-    ARMGICClass parent_class;
-    /*< public >*/
-    DeviceRealize parent_realize;
-    void (*parent_reset)(DeviceState *dev);
-} NVICClass;
-
-#define NVIC_CLASS(klass) \
-    OBJECT_CLASS_CHECK(NVICClass, (klass), TYPE_NVIC)
-#define NVIC_GET_CLASS(obj) \
-    OBJECT_GET_CLASS(NVICClass, (obj), TYPE_NVIC)
+
 #define NVIC(obj) \
     OBJECT_CHECK(NVICState, (obj), TYPE_NVIC)
 
@@ -XXX,XX +XXX,XX @@ static void systick_reset(NVICState *s)
     timer_del(s->systick.timer);
 }
 
-/* The external routines use the hardware vector numbering, ie. the first
-   IRQ is #16.  The internal GIC routines use #32 as the first IRQ.  */
+static int nvic_pending_prio(NVICState *s)
+{
+    /* return the priority of the current pending interrupt,
+     * or NVIC_NOEXC_PRIO if no interrupt is pending
+     */
+    return s->vectpending ? s->vectors[s->vectpending].prio : NVIC_NOEXC_PRIO;
+}
+
+/* Return the value of the ISCR RETTOBASE bit:
+ * 1 if there is exactly one active exception
+ * 0 if there is more than one active exception
+ * UNKNOWN if there are no active exceptions (we choose 1,
+ * which matches the choice Cortex-M3 is documented as making).
+ *
+ * NB: some versions of the documentation talk about this
+ * counting "active exceptions other than the one shown by IPSR";
+ * this is only different in the obscure corner case where guest
+ * code has manually deactivated an exception and is about
+ * to fail an exception-return integrity check. The definition
+ * above is the one from the v8M ARM ARM and is also in line
+ * with the behaviour documented for the Cortex-M3.
+ */
+static bool nvic_rettobase(NVICState *s)
+{
+    int irq, nhand = 0;
+
+    for (irq = ARMV7M_EXCP_RESET; irq < s->num_irq; irq++) {
+        if (s->vectors[irq].active) {
+            nhand++;
+            if (nhand == 2) {
+                return 0;
+            }
+        }
+    }
+
+    return 1;
+}
+
+/* Return the value of the ISCR ISRPENDING bit:
+ * 1 if an external interrupt is pending
+ * 0 if no external interrupt is pending
+ */
+static bool nvic_isrpending(NVICState *s)
+{
+    int irq;
+
+    /* We can shortcut if the highest priority pending interrupt
+     * happens to be external or if there is nothing pending.
+     */
+    if (s->vectpending > NVIC_FIRST_IRQ) {
+        return true;
+    }
+    if (s->vectpending == 0) {
+        return false;
+    }
+
+    for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
+        if (s->vectors[irq].pending) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/* Return a mask word which clears the subpriority bits from
+ * a priority value for an M-profile exception, leaving only
+ * the group priority.
+ */
+static inline uint32_t nvic_gprio_mask(NVICState *s)
+{
+    return ~0U << (s->prigroup + 1);
+}
+
+/* Recompute vectpending and exception_prio */
+static void nvic_recompute_state(NVICState *s)
+{
+    int i;
+    int pend_prio = NVIC_NOEXC_PRIO;
+    int active_prio = NVIC_NOEXC_PRIO;
+    int pend_irq = 0;
+
+    for (i = 1; i < s->num_irq; i++) {
+        VecInfo *vec = &s->vectors[i];
+
+        if (vec->enabled && vec->pending && vec->prio < pend_prio) {
+            pend_prio = vec->prio;
+            pend_irq = i;
+        }
+        if (vec->active && vec->prio < active_prio) {
+            active_prio = vec->prio;
+        }
+    }
+
+    s->vectpending = pend_irq;
+    s->exception_prio = active_prio & nvic_gprio_mask(s);
+
+    trace_nvic_recompute_state(s->vectpending, s->exception_prio);
+}
+
+/* Return the current execution priority of the CPU
+ * (equivalent to the pseudocode ExecutionPriority function).
+ * This is a value between -2 (NMI priority) and NVIC_NOEXC_PRIO.
+ */
+static inline int nvic_exec_prio(NVICState *s)
+{
+    CPUARMState *env = &s->cpu->env;
+    int running;
+
+    if (env->daif & PSTATE_F) { /* FAULTMASK */
+        running = -1;
+    } else if (env->daif & PSTATE_I) { /* PRIMASK */
+        running = 0;
+    } else if (env->v7m.basepri > 0) {
+        running = env->v7m.basepri & nvic_gprio_mask(s);
+    } else {
+        running = NVIC_NOEXC_PRIO; /* lower than any possible priority */
+    }
+    /* consider priority of active handler */
+    return MIN(running, s->exception_prio);
+}
+
+/* caller must call nvic_irq_update() after this */
+static void set_prio(NVICState *s, unsigned irq, uint8_t prio)
+{
+    assert(irq > ARMV7M_EXCP_NMI); /* only use for configurable prios */
+    assert(irq < s->num_irq);
+
+    s->vectors[irq].prio = prio;
+
+    trace_nvic_set_prio(irq, prio);
+}
+
+/* Recompute state and assert irq line accordingly.
+ * Must be called after changes to:
+ *  vec->active, vec->enabled, vec->pending or vec->prio for any vector
+ *  prigroup
+ */
+static void nvic_irq_update(NVICState *s)
+{
+    int lvl;
+    int pend_prio;
+
+    nvic_recompute_state(s);
+    pend_prio = nvic_pending_prio(s);
+
+    /* Raise NVIC output if this IRQ would be taken, except that we
+     * ignore the effects of the BASEPRI, FAULTMASK and PRIMASK (which
+     * will be checked for in arm_v7m_cpu_exec_interrupt()); changes
+     * to those CPU registers don't cause us to recalculate the NVIC
+     * pending info.
+     */
+    lvl = (pend_prio < s->exception_prio);
+    trace_nvic_irq_update(s->vectpending, pend_prio, s->exception_prio, lvl);
+    qemu_set_irq(s->excpout, lvl);
+}
+
+static void armv7m_nvic_clear_pending(void *opaque, int irq)
+{
+    NVICState *s = (NVICState *)opaque;
+    VecInfo *vec;
+
+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
+
+    vec = &s->vectors[irq];
+    trace_nvic_clear_pending(irq, vec->enabled, vec->prio);
+    if (vec->pending) {
+        vec->pending = 0;
+        nvic_irq_update(s);
+    }
+}
+
 void armv7m_nvic_set_pending(void *opaque, int irq)
 {
     NVICState *s = (NVICState *)opaque;
-    if (irq >= 16)
-        irq += 16;
-    gic_set_pending_private(&s->gic, 0, irq);
+    VecInfo *vec;
+
+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
+
+    vec = &s->vectors[irq];
+    trace_nvic_set_pending(irq, vec->enabled, vec->prio);
+    if (!vec->pending) {
+        vec->pending = 1;
+        nvic_irq_update(s);
+    }
 }
 
 /* Make pending IRQ active.  */
 int armv7m_nvic_acknowledge_irq(void *opaque)
 {
     NVICState *s = (NVICState *)opaque;
-    uint32_t irq;
-
-    irq = gic_acknowledge_irq(&s->gic, 0, MEMTXATTRS_UNSPECIFIED);
-    if (irq == 1023)
-        hw_error("Interrupt but no vector\n");
-    if (irq >= 32)
-        irq -= 16;
-    return irq;
+    CPUARMState *env = &s->cpu->env;
+    const int pending = s->vectpending;
+    const int running = nvic_exec_prio(s);
+    int pendgroupprio;
+    VecInfo *vec;
+
+    assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
+
+    vec = &s->vectors[pending];
+
+    assert(vec->enabled);
+    assert(vec->pending);
+
+    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    assert(pendgroupprio < running);
+
+    trace_nvic_acknowledge_irq(pending, vec->prio);
+
+    vec->active = 1;
+    vec->pending = 0;
+
+    env->v7m.exception = s->vectpending;
+
+    nvic_irq_update(s);
+
+    return env->v7m.exception;
 }
 
 void armv7m_nvic_complete_irq(void *opaque, int irq)
 {
     NVICState *s = (NVICState *)opaque;
-    if (irq >= 16)
-        irq += 16;
-    gic_complete_irq(&s->gic, 0, irq, MEMTXATTRS_UNSPECIFIED);
+    VecInfo *vec;
+
+    assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
+
+    vec = &s->vectors[irq];
+
+    trace_nvic_complete_irq(irq);
+
+    vec->active = 0;
+    if (vec->level) {
+        /* Re-pend the exception if it's still held high; only
+         * happens for extenal IRQs
+         */
+        assert(irq >= NVIC_FIRST_IRQ);
+        vec->pending = 1;
+    }
+
+    nvic_irq_update(s);
+}
+
+/* callback when external interrupt line is changed */
+static void set_irq_level(void *opaque, int n, int level)
+{
+    NVICState *s = opaque;
+    VecInfo *vec;
+
+    n += NVIC_FIRST_IRQ;
+
+    assert(n >= NVIC_FIRST_IRQ && n < s->num_irq);
+
+    trace_nvic_set_irq_level(n, level);
+
+    /* The pending status of an external interrupt is
+     * latched on rising edge and exception handler return.
+     *
+     * Pulsing the IRQ will always run the handler
+     * once, and the handler will re-run until the
+     * level is low when the handler completes.
+     */
+    vec = &s->vectors[n];
+    if (level != vec->level) {
+        vec->level = level;
+        if (level) {
+            armv7m_nvic_set_pending(s, n);
+        }
+    }
 }
 
 static uint32_t nvic_readl(NVICState *s, uint32_t offset)
 {
     ARMCPU *cpu = s->cpu;
     uint32_t val;
-    int irq;
 
     switch (offset) {
     case 4: /* Interrupt Control Type.  */
-        return (s->num_irq / 32) - 1;
+        return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
     case 0x10: /* SysTick Control and Status.  */
         val = s->systick.control;
         s->systick.control &= ~SYSTICK_COUNTFLAG;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xd04: /* Interrupt Control State.  */
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
-        if (val == 1023) {
-            val = 0;
-        } else if (val >= 32) {
-            val -= 16;
-        }
         /* VECTPENDING */
-        if (s->gic.current_pending[0] != 1023)
-            val |= (s->gic.current_pending[0] << 12);
-        /* ISRPENDING and RETTOBASE */
-        for (irq = 32; irq < s->num_irq; irq++) {
-            if (s->gic.irq_state[irq].pending) {
-                val |= (1 << 22);
-                break;
-            }
-            if (irq != cpu->env.v7m.exception && s->gic.irq_state[irq].active) {
-                val |= (1 << 11);
-            }
+        val |= (s->vectpending & 0xff) << 12;
+        /* ISRPENDING - set if any external IRQ is pending */
+        if (nvic_isrpending(s)) {
+            val |= (1 << 22);
+        }
+        /* RETTOBASE - set if only one handler is active */
+        if (nvic_rettobase(s)) {
+            val |= (1 << 11);
         }
         /* PENDSTSET */
-        if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending)
+        if (s->vectors[ARMV7M_EXCP_SYSTICK].pending) {
             val |= (1 << 26);
+        }
         /* PENDSVSET */
-        if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending)
+        if (s->vectors[ARMV7M_EXCP_PENDSV].pending) {
             val |= (1 << 28);
+        }
         /* NMIPENDSET */
-        if (s->gic.irq_state[ARMV7M_EXCP_NMI].pending)
+        if (s->vectors[ARMV7M_EXCP_NMI].pending) {
             val |= (1 << 31);
+        }
+        /* ISRPREEMPT not implemented */
         return val;
     case 0xd08: /* Vector Table Offset.  */
         return cpu->env.v7m.vecbase;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
         return cpu->env.v7m.ccr;
     case 0xd24: /* System Handler Status.  */
         val = 0;
-        if (s->gic.irq_state[ARMV7M_EXCP_MEM].active) val |= (1 << 0);
-        if (s->gic.irq_state[ARMV7M_EXCP_BUS].active) val |= (1 << 1);
-        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].active) val |= (1 << 3);
-        if (s->gic.irq_state[ARMV7M_EXCP_SVC].active) val |= (1 << 7);
-        if (s->gic.irq_state[ARMV7M_EXCP_DEBUG].active) val |= (1 << 8);
-        if (s->gic.irq_state[ARMV7M_EXCP_PENDSV].active) val |= (1 << 10);
-        if (s->gic.irq_state[ARMV7M_EXCP_SYSTICK].active) val |= (1 << 11);
-        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].pending) val |= (1 << 12);
-        if (s->gic.irq_state[ARMV7M_EXCP_MEM].pending) val |= (1 << 13);
-        if (s->gic.irq_state[ARMV7M_EXCP_BUS].pending) val |= (1 << 14);
-        if (s->gic.irq_state[ARMV7M_EXCP_SVC].pending) val |= (1 << 15);
-        if (s->gic.irq_state[ARMV7M_EXCP_MEM].enabled) val |= (1 << 16);
-        if (s->gic.irq_state[ARMV7M_EXCP_BUS].enabled) val |= (1 << 17);
-        if (s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled) val |= (1 << 18);
+        if (s->vectors[ARMV7M_EXCP_MEM].active) {
+            val |= (1 << 0);
+        }
+        if (s->vectors[ARMV7M_EXCP_BUS].active) {
+            val |= (1 << 1);
+        }
+        if (s->vectors[ARMV7M_EXCP_USAGE].active) {
+            val |= (1 << 3);
+        }
+        if (s->vectors[ARMV7M_EXCP_SVC].active) {
+            val |= (1 << 7);
+        }
+        if (s->vectors[ARMV7M_EXCP_DEBUG].active) {
+            val |= (1 << 8);
+        }
+        if (s->vectors[ARMV7M_EXCP_PENDSV].active) {
+            val |= (1 << 10);
+        }
+        if (s->vectors[ARMV7M_EXCP_SYSTICK].active) {
+            val |= (1 << 11);
+        }
+        if (s->vectors[ARMV7M_EXCP_USAGE].pending) {
+            val |= (1 << 12);
+        }
+        if (s->vectors[ARMV7M_EXCP_MEM].pending) {
+            val |= (1 << 13);
+        }
+        if (s->vectors[ARMV7M_EXCP_BUS].pending) {
+            val |= (1 << 14);
+        }
+        if (s->vectors[ARMV7M_EXCP_SVC].pending) {
+            val |= (1 << 15);
+        }
+        if (s->vectors[ARMV7M_EXCP_MEM].enabled) {
+            val |= (1 << 16);
+        }
+        if (s->vectors[ARMV7M_EXCP_BUS].enabled) {
+            val |= (1 << 17);
+        }
+        if (s->vectors[ARMV7M_EXCP_USAGE].enabled) {
+            val |= (1 << 18);
+        }
         return val;
     case 0xd28: /* Configurable Fault Status.  */
         return cpu->env.v7m.cfsr;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
         if (value & (1 << 28)) {
             armv7m_nvic_set_pending(s, ARMV7M_EXCP_PENDSV);
         } else if (value & (1 << 27)) {
-            s->gic.irq_state[ARMV7M_EXCP_PENDSV].pending = 0;
-            gic_update(&s->gic);
+            armv7m_nvic_clear_pending(s, ARMV7M_EXCP_PENDSV);
         }
         if (value & (1 << 26)) {
             armv7m_nvic_set_pending(s, ARMV7M_EXCP_SYSTICK);
         } else if (value & (1 << 25)) {
-            s->gic.irq_state[ARMV7M_EXCP_SYSTICK].pending = 0;
-            gic_update(&s->gic);
+            armv7m_nvic_clear_pending(s, ARMV7M_EXCP_SYSTICK);
         }
         break;
     case 0xd08: /* Vector Table Offset.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                 qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
             }
             s->prigroup = extract32(value, 8, 3);
+            nvic_irq_update(s);
         }
         break;
     case 0xd10: /* System Control.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
     case 0xd24: /* System Handler Control.  */
         /* TODO: Real hardware allows you to set/clear the active bits
            under some circumstances.  We don't implement this.  */
-        s->gic.irq_state[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
-        s->gic.irq_state[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
-        s->gic.irq_state[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
+        s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
+        s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+        s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
+        nvic_irq_update(s);
         break;
     case 0xd28: /* Configurable Fault Status.  */
         cpu->env.v7m.cfsr &= ~value; /* W1C */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                       "NVIC: Aux fault status registers unimplemented\n");
         break;
     case 0xf00: /* Software Triggered Interrupt Register */
+    {
         /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
-        if ((value & 0x1ff) < s->num_irq &&
+        int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
+        if (excnum < s->num_irq &&
             (arm_current_el(&cpu->env) ||
              (cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK))) {
-            gic_set_pending_private(&s->gic, 0, value & 0x1ff);
+            armv7m_nvic_set_pending(s, excnum);
         }
         break;
+    }
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "NVIC: Bad write offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr,
 {
     NVICState *s = (NVICState *)opaque;
     uint32_t offset = addr;
-    int i;
+    unsigned i, startvec, end;
     uint32_t val;
 
     switch (offset) {
+    /* reads of set and clear both return the status */
+    case 0x100 ... 0x13f: /* NVIC Set enable */
+        offset += 0x80;
+        /* fall through */
+    case 0x180 ... 0x1bf: /* NVIC Clear enable */
+        val = 0;
+        startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
+
+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            if (s->vectors[startvec + i].enabled) {
+                val |= (1 << i);
+            }
+        }
+        break;
+    case 0x200 ... 0x23f: /* NVIC Set pend */
+        offset += 0x80;
+        /* fall through */
+    case 0x280 ... 0x2bf: /* NVIC Clear pend */
+        val = 0;
+        startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            if (s->vectors[startvec + i].pending) {
+                val |= (1 << i);
+            }
+        }
+        break;
+    case 0x300 ... 0x33f: /* NVIC Active */
+        val = 0;
+        startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
+
+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            if (s->vectors[startvec + i].active) {
+                val |= (1 << i);
+            }
+        }
+        break;
+    case 0x400 ... 0x5ef: /* NVIC Priority */
+        val = 0;
+        startvec = offset - 0x400 + NVIC_FIRST_IRQ; /* vector # */
+
+        for (i = 0; i < size && startvec + i < s->num_irq; i++) {
+            val |= s->vectors[startvec + i].prio << (8 * i);
+        }
+        break;
     case 0xd18 ... 0xd23: /* System Handler Priority.  */
         val = 0;
         for (i = 0; i < size; i++) {
-            val |= s->gic.priority1[(offset - 0xd14) + i][0] << (i * 8);
+            val |= s->vectors[(offset - 0xd14) + i].prio << (i * 8);
         }
-        return val;
+        break;
     case 0xfe0 ... 0xfff: /* ID.  */
         if (offset & 3) {
-            return 0;
+            val = 0;
+        } else {
+            val = nvic_id[(offset - 0xfe0) >> 2];
+        }
+        break;
+    default:
+        if (size == 4) {
+            val = nvic_readl(s, offset);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "NVIC: Bad read of size %d at offset 0x%x\n",
+                          size, offset);
+            val = 0;
         }
-        return nvic_id[(offset - 0xfe0) >> 2];
-    }
-    if (size == 4) {
-        return nvic_readl(s, offset);
     }
-    qemu_log_mask(LOG_GUEST_ERROR,
-                  "NVIC: Bad read of size %d at offset 0x%x\n", size, offset);
-    return 0;
+
+    trace_nvic_sysreg_read(addr, val, size);
+    return val;
 }
 
 static void nvic_sysreg_write(void *opaque, hwaddr addr,
@@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr,
 {
     NVICState *s = (NVICState *)opaque;
     uint32_t offset = addr;
-    int i;
+    unsigned i, startvec, end;
+    unsigned setval = 0;
+
+    trace_nvic_sysreg_write(addr, value, size);
 
     switch (offset) {
+    case 0x100 ... 0x13f: /* NVIC Set enable */
+        offset += 0x80;
+        setval = 1;
+        /* fall through */
+    case 0x180 ... 0x1bf: /* NVIC Clear enable */
+        startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ;
+
+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            if (value & (1 << i)) {
+                s->vectors[startvec + i].enabled = setval;
+            }
+        }
+        nvic_irq_update(s);
+        return;
+    case 0x200 ... 0x23f: /* NVIC Set pend */
+        /* the special logic in armv7m_nvic_set_pending()
+         * is not needed since IRQs are never escalated
+         */
+        offset += 0x80;
+        setval = 1;
+        /* fall through */
+    case 0x280 ... 0x2bf: /* NVIC Clear pend */
+        startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
+
+        for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
+            if (value & (1 << i)) {
+                s->vectors[startvec + i].pending = setval;
+            }
+        }
+        nvic_irq_update(s);
+        return;
+    case 0x300 ... 0x33f: /* NVIC Active */
+        return; /* R/O */
+    case 0x400 ... 0x5ef: /* NVIC Priority */
+        startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
+
+        for (i = 0; i < size && startvec + i < s->num_irq; i++) {
+            set_prio(s, startvec + i, (value >> (i * 8)) & 0xff);
+        }
+        nvic_irq_update(s);
+        return;
     case 0xd18 ... 0xd23: /* System Handler Priority.  */
         for (i = 0; i < size; i++) {
-            s->gic.priority1[(offset - 0xd14) + i][0] =
-                (value >> (i * 8)) & 0xff;
+            unsigned hdlidx = (offset - 0xd14) + i;
+            set_prio(s, hdlidx, (value >> (i * 8)) & 0xff);
         }
-        gic_update(&s->gic);
+        nvic_irq_update(s);
         return;
     }
     if (size == 4) {
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_sysreg_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+static int nvic_post_load(void *opaque, int version_id)
+{
+    NVICState *s = opaque;
+    unsigned i;
+
+    /* Check for out of range priority settings */
+    if (s->vectors[ARMV7M_EXCP_RESET].prio != -3 ||
+        s->vectors[ARMV7M_EXCP_NMI].prio != -2 ||
+        s->vectors[ARMV7M_EXCP_HARD].prio != -1) {
+        return 1;
+    }
+    for (i = ARMV7M_EXCP_MEM; i < s->num_irq; i++) {
+        if (s->vectors[i].prio & ~0xff) {
+            return 1;
+        }
+    }
+
+    nvic_recompute_state(s);
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_VecInfo = {
+    .name = "armv7m_nvic_info",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_INT16(prio, VecInfo),
+        VMSTATE_UINT8(enabled, VecInfo),
+        VMSTATE_UINT8(pending, VecInfo),
+        VMSTATE_UINT8(active, VecInfo),
+        VMSTATE_UINT8(level, VecInfo),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_nvic = {
     .name = "armv7m_nvic",
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
+    .post_load = &nvic_post_load,
     .fields = (VMStateField[]) {
+        VMSTATE_STRUCT_ARRAY(vectors, NVICState, NVIC_MAX_VECTORS, 1,
+                             vmstate_VecInfo, VecInfo),
         VMSTATE_UINT32(systick.control, NVICState),
         VMSTATE_UINT32(systick.reload, NVICState),
         VMSTATE_INT64(systick.tick, NVICState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nvic = {
     }
 };
 
+static Property props_nvic[] = {
+    /* Number of external IRQ lines (so excluding the 16 internal exceptions) */
+    DEFINE_PROP_UINT32("num-irq", NVICState, num_irq, 64),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void armv7m_nvic_reset(DeviceState *dev)
 {
     NVICState *s = NVIC(dev);
-    NVICClass *nc = NVIC_GET_CLASS(s);
-    nc->parent_reset(dev);
-    /* Common GIC reset resets to disabled; the NVIC doesn't have
-     * per-CPU interfaces so mark our non-existent CPU interface
-     * as enabled by default, and with a priority mask which allows
-     * all interrupts through.
+
+    s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
+    s->vectors[ARMV7M_EXCP_HARD].enabled = 1;
+    /* MEM, BUS, and USAGE are enabled through
+     * the System Handler Control register
      */
-    s->gic.cpu_ctlr[0] = GICC_CTLR_EN_GRP0;
-    s->gic.priority_mask[0] = 0x100;
-    /* The NVIC as a whole is always enabled. */
-    s->gic.ctlr = 1;
+    s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
+    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
+    s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
+    s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
+
+    s->vectors[ARMV7M_EXCP_RESET].prio = -3;
+    s->vectors[ARMV7M_EXCP_NMI].prio = -2;
+    s->vectors[ARMV7M_EXCP_HARD].prio = -1;
+
+    /* Strictly speaking the reset handler should be enabled.
+     * However, we don't simulate soft resets through the NVIC,
+     * and the reset vector should never be pended.
+     * So we leave it disabled to catch logic errors.
+     */
+
+    s->exception_prio = NVIC_NOEXC_PRIO;
+    s->vectpending = 0;
+
     systick_reset(s);
 }
 
 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
 {
     NVICState *s = NVIC(dev);
-    NVICClass *nc = NVIC_GET_CLASS(s);
-    Error *local_err = NULL;
 
     s->cpu = ARM_CPU(qemu_get_cpu(0));
     assert(s->cpu);
-    /* The NVIC always has only one CPU */
-    s->gic.num_cpu = 1;
-    /* Tell the common code we're an NVIC */
-    s->gic.revision = 0xffffffff;
-    s->num_irq = s->gic.num_irq;
-    nc->parent_realize(dev, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+
+    if (s->num_irq > NVIC_MAX_IRQ) {
+        error_setg(errp, "num-irq %d exceeds NVIC maximum", s->num_irq);
         return;
     }
-    gic_init_irqs_and_distributor(&s->gic);
-    /* The NVIC and system controller register area looks like this:
-     *  0..0xff : system control registers, including systick
-     *  0x100..0xcff : GIC-like registers
-     *  0xd00..0xfff : system control registers
-     * We use overlaying to put the GIC like registers
-     * over the top of the system control register region.
+
+    qdev_init_gpio_in(dev, set_irq_level, s->num_irq);
+
+    /* include space for internal exception vectors */
+    s->num_irq += NVIC_FIRST_IRQ;
+
+    /* The NVIC and System Control Space (SCS) starts at 0xe000e000
+     * and looks like this:
+     *  0x004 - ICTR
+     *  0x010 - 0x1c - systick
+     *  0x100..0x7ec - NVIC
+     *  0x7f0..0xcff - Reserved
+     *  0xd00..0xd3c - SCS registers
+     *  0xd40..0xeff - Reserved or Not implemented
+     *  0xf00 - STIR
+     *
+     * At the moment there is only one thing in the container region,
+     * but we leave it in place to allow us to pull systick out into
+     * its own device object later.
      */
     memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000);
     /* The system register region goes at the bottom of the priority
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
                           "nvic_sysregs", 0x1000);
     memory_region_add_subregion(&s->container, 0, &s->sysregmem);
-    /* Alias the GIC region so we can get only the section of it
-     * we need, and layer it on top of the system register region.
-     */
-    memory_region_init_alias(&s->gic_iomem_alias, OBJECT(s),
-                             "nvic-gic", &s->gic.iomem,
-                             0x100, 0xc00);
-    memory_region_add_subregion_overlap(&s->container, 0x100,
-                                        &s->gic_iomem_alias, 1);
+
     /* Map the whole thing into system memory at the location required
      * by the v7M architecture.
      */
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
      * any user-specified property setting, so just modify the
      * value in the GICState struct.
      */
-    GICState *s = ARM_GIC_COMMON(obj);
     DeviceState *dev = DEVICE(obj);
     NVICState *nvic = NVIC(obj);
-    /* The ARM v7m may have anything from 0 to 496 external interrupt
-     * IRQ lines. We default to 64. Other boards may differ and should
-     * set the num-irq property appropriately.
-     */
-    s->num_irq = 64;
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    sysbus_init_irq(sbd, &nvic->excpout);
     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
 }
 
 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
 {
-    NVICClass *nc = NVIC_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    nc->parent_reset = dc->reset;
-    nc->parent_realize = dc->realize;
     dc->vmsd  = &vmstate_nvic;
+    dc->props = props_nvic;
     dc->reset = armv7m_nvic_reset;
     dc->realize = armv7m_nvic_realize;
 }
 
 static const TypeInfo armv7m_nvic_info = {
     .name          = TYPE_NVIC,
-    .parent        = TYPE_ARM_GIC_COMMON,
+    .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_init = armv7m_nvic_instance_init,
     .instance_size = sizeof(NVICState),
     .class_init    = armv7m_nvic_class_init,
-    .class_size    = sizeof(NVICClass),
+    .class_size    = sizeof(SysBusDeviceClass),
 };
 
 static void armv7m_nvic_register_types(void)
diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -XXX,XX +XXX,XX @@ gicv3_redist_write(uint32_t cpu, uint64_t offset, uint64_t data, unsigned size,
 gicv3_redist_badwrite(uint32_t cpu, uint64_t offset, uint64_t data, unsigned size, bool secure) "GICv3 redistributor %x write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u secure %d: error"
 gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor %x interrupt %d level changed to %d"
 gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor %x pending SGI %d"
+
+# hw/intc/armv7m_nvic.c
+nvic_recompute_state(int vectpending, int exception_prio) "NVIC state recomputed: vectpending %d exception_prio %d"
+nvic_set_prio(int irq, uint8_t prio) "NVIC set irq %d priority %d"
+nvic_irq_update(int vectpending, int pendprio, int exception_prio, int level) "NVIC vectpending %d pending prio %d exception_prio %d: setting irq line to %d"
+nvic_escalate_prio(int irq, int irqprio, int runprio) "NVIC escalating irq %d to HardFault: insufficient priority %d >= %d"
+nvic_escalate_disabled(int irq) "NVIC escalating irq %d to HardFault: disabled"
+nvic_set_pending(int irq, int en, int prio) "NVIC set pending irq %d (enabled: %d priority %d)"
+nvic_clear_pending(int irq, int en, int prio) "NVIC clear pending irq %d (enabled: %d priority %d)"
+nvic_set_pending_level(int irq) "NVIC set pending: irq %d higher prio than vectpending: setting irq line to 1"
+nvic_acknowledge_irq(int irq, int prio) "NVIC acknowledge IRQ: %d now active (prio %d)"
+nvic_complete_irq(int irq) "NVIC complete IRQ %d"
+nvic_set_irq_level(int irq, int level) "NVIC external irq %d level set to %d"
+nvic_sysreg_read(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
+nvic_sysreg_write(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
-- 
2.7.4

The M profile condition for when we can take a pending exception or
interrupt is not the same as that for A/R profile.  The code
originally copied from the A/R profile version of the
cpu_exec_interrupt function only worked by chance for the
very simple case of exceptions being masked by PRIMASK.
Replace it with a call to a function in the NVIC code that
correctly compares the priority of the pending exception
against the current execution priority of the CPU.

[Michael Davidsaver's patchset had a patch to do something
similar but the implementation ended up being a rewrite.]

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/cpu.h      |  8 ++++++++
 hw/intc/armv7m_nvic.c |  7 +++++++
 target/arm/cpu.c      | 16 ++++++++--------
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
 
 /* Interface between CPU and Interrupt controller.  */
+#ifndef CONFIG_USER_ONLY
+bool armv7m_nvic_can_take_pending_exception(void *opaque);
+#else
+static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
+{
+    return true;
+}
+#endif
 void armv7m_nvic_set_pending(void *opaque, int irq);
 int armv7m_nvic_acknowledge_irq(void *opaque);
 void armv7m_nvic_complete_irq(void *opaque, int irq);
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s)
     return MIN(running, s->exception_prio);
 }
 
+bool armv7m_nvic_can_take_pending_exception(void *opaque)
+{
+    NVICState *s = opaque;
+
+    return nvic_exec_prio(s) > nvic_pending_prio(s);
+}
+
 /* caller must call nvic_irq_update() after this */
 static void set_prio(NVICState *s, unsigned irq, uint8_t prio)
 {
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     CPUARMState *env = &cpu->env;
     bool ret = false;
 
-
-    if (interrupt_request & CPU_INTERRUPT_FIQ
-        && !(env->daif & PSTATE_F)) {
-        cs->exception_index = EXCP_FIQ;
-        cc->do_interrupt(cs);
-        ret = true;
-    }
     /* ARMv7-M interrupt return works by loading a magic value
      * into the PC.  On real hardware the load causes the
      * return to occur.  The qemu implementation performs the
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      * the stack if an interrupt occurred at the wrong time.
      * We avoid this by disabling interrupts when
      * pc contains a magic address.
+     *
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
      */
     if (interrupt_request & CPU_INTERRUPT_HARD
-        && !(env->daif & PSTATE_I)
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))
         && (env->regs[15] < 0xfffffff0)) {
         cs->exception_index = EXCP_IRQ;
         cc->do_interrupt(cs);
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Now that the NVIC is its own separate implementation, we can
clean up the GIC code by removing REV_NVIC and conditionals
which use it.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/gic_internal.h   |  7 ++-----
 hw/intc/arm_gic.c        | 31 +++++--------------------------
 hw/intc/arm_gic_common.c | 23 ++++++++---------------
 3 files changed, 15 insertions(+), 46 deletions(-)

diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gic_internal.h
+++ b/hw/intc/gic_internal.h
@@ -XXX,XX +XXX,XX @@
 
 #define ALL_CPU_MASK ((unsigned)(((1 << GIC_NCPU) - 1)))
 
-/* The NVIC has 16 internal vectors.  However these are not exposed
-   through the normal GIC interface.  */
-#define GIC_BASE_IRQ ((s->revision == REV_NVIC) ? 32 : 0)
+#define GIC_BASE_IRQ 0
 
 #define GIC_SET_ENABLED(irq, cm) s->irq_state[irq].enabled |= (cm)
 #define GIC_CLEAR_ENABLED(irq, cm) s->irq_state[irq].enabled &= ~(cm)
@@ -XXX,XX +XXX,XX @@
 
 /* The special cases for the revision property: */
 #define REV_11MPCORE 0
-#define REV_NVIC 0xffffffff
 
 void gic_set_pending_private(GICState *s, int cpu, int irq);
 uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs);
@@ -XXX,XX +XXX,XX @@ void gic_set_priority(GICState *s, int cpu, int irq, uint8_t val,
 
 static inline bool gic_test_pending(GICState *s, int irq, int cm)
 {
-    if (s->revision == REV_NVIC || s->revision == REV_11MPCORE) {
+    if (s->revision == REV_11MPCORE) {
         return s->irq_state[irq].pending & cm;
     } else {
         /* Edge-triggered interrupts are marked pending on a rising edge, but
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static void gic_set_irq_11mpcore(GICState *s, int irq, int level,
     }
 }
 
-static void gic_set_irq_nvic(GICState *s, int irq, int level,
-                                 int cm, int target)
-{
-    if (level) {
-        GIC_SET_LEVEL(irq, cm);
-        GIC_SET_PENDING(irq, target);
-    } else {
-        GIC_CLEAR_LEVEL(irq, cm);
-    }
-}
-
 static void gic_set_irq_generic(GICState *s, int irq, int level,
                                 int cm, int target)
 {
@@ -XXX,XX +XXX,XX @@ static void gic_set_irq(void *opaque, int irq, int level)
 
     if (s->revision == REV_11MPCORE) {
         gic_set_irq_11mpcore(s, irq, level, cm, target);
-    } else if (s->revision == REV_NVIC) {
-        gic_set_irq_nvic(s, irq, level, cm, target);
     } else {
         gic_set_irq_generic(s, irq, level, cm, target);
     }
@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
         return 1023;
     }
 
-    if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
+    if (s->revision == REV_11MPCORE) {
         /* Clear pending flags for both level and edge triggered interrupts.
          * Level triggered IRQs will be reasserted once they become inactive.
          */
@@ -XXX,XX +XXX,XX @@ void gic_complete_irq(GICState *s, int cpu, int irq, MemTxAttrs attrs)
             DPRINTF("Set %d pending mask %x\n", irq, cm);
             GIC_SET_PENDING(irq, cm);
         }
-    } else if (s->revision == REV_NVIC) {
-        if (GIC_TEST_LEVEL(irq, cm)) {
-            DPRINTF("Set nvic %d pending mask %x\n", irq, cm);
-            GIC_SET_PENDING(irq, cm);
-        }
     }
 
     group = gic_has_groups(s) && GIC_TEST_GROUP(irq, cm);
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
     } else if (offset < 0xf10) {
         goto bad_reg;
     } else if (offset < 0xf30) {
-        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
+        if (s->revision == REV_11MPCORE) {
             goto bad_reg;
         }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             case 2:
                 res = gic_id_gicv2[(offset - 0xfd0) >> 2];
                 break;
-            case REV_NVIC:
-                /* Shouldn't be able to get here */
-                abort();
             default:
                 res = 0;
             }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
                 continue; /* Ignore Non-secure access of Group0 IRQ */
             }
 
-            if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
+            if (s->revision == REV_11MPCORE) {
                 if (value & (1 << (i * 2))) {
                     GIC_SET_MODEL(irq + i);
                 } else {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         goto bad_reg;
     } else if (offset < 0xf20) {
         /* GICD_CPENDSGIRn */
-        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
+        if (s->revision == REV_11MPCORE) {
             goto bad_reg;
         }
         irq = (offset - 0xf10);
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0xf30) {
         /* GICD_SPENDSGIRn */
-        if (s->revision == REV_11MPCORE || s->revision == REV_NVIC) {
+        if (s->revision == REV_11MPCORE) {
             goto bad_reg;
         }
         irq = (offset - 0xf20);
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ void gic_init_irqs_and_mmio(GICState *s, qemu_irq_handler handler,
      *  [N+32..N+63] PPIs for CPU 1
      *   ...
      */
-    if (s->revision != REV_NVIC) {
-        i += (GIC_INTERNAL * s->num_cpu);
-    }
+    i += (GIC_INTERNAL * s->num_cpu);
     qdev_init_gpio_in(DEVICE(s), handler, i);
 
     for (i = 0; i < s->num_cpu; i++) {
@@ -XXX,XX +XXX,XX @@ void gic_init_irqs_and_mmio(GICState *s, qemu_irq_handler handler,
     memory_region_init_io(&s->iomem, OBJECT(s), ops, s, "gic_dist", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
 
-    if (s->revision != REV_NVIC) {
-        /* This is the main CPU interface "for this core". It is always
-         * present because it is required by both software emulation and KVM.
-         * NVIC is not handled here because its CPU interface is different,
-         * neither it can use KVM.
-         */
-        memory_region_init_io(&s->cpuiomem[0], OBJECT(s), ops ? &ops[1] : NULL,
-                              s, "gic_cpu", s->revision == 2 ? 0x2000 : 0x100);
-        sysbus_init_mmio(sbd, &s->cpuiomem[0]);
-    }
+    /* This is the main CPU interface "for this core". It is always
+     * present because it is required by both software emulation and KVM.
+     */
+    memory_region_init_io(&s->cpuiomem[0], OBJECT(s), ops ? &ops[1] : NULL,
+                          s, "gic_cpu", s->revision == 2 ? 0x2000 : 0x100);
+    sysbus_init_mmio(sbd, &s->cpuiomem[0]);
 }
 
 static void arm_gic_common_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->security_extn &&
-        (s->revision == REV_11MPCORE || s->revision == REV_NVIC)) {
+        (s->revision == REV_11MPCORE)) {
         error_setg(errp, "this GIC revision does not implement "
                    "the security extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
     DEFINE_PROP_UINT32("num-irq", GICState, num_irq, 32),
     /* Revision can be 1 or 2 for GIC architecture specification
      * versions 1 or 2, or 0 to indicate the legacy 11MPCore GIC.
-     * (Internally, 0xffffffff also indicates "not a GIC but an NVIC".)
      */
     DEFINE_PROP_UINT32("revision", GICState, revision, 1),
     /* True if the GIC should implement the security extensions */
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

The v7M exception architecture requires that if a synchronous
exception cannot be taken immediately (because it is disabled
or at too low a priority) then it should be escalated to
HardFault (and the HardFault exception is then taken).
Implement this escalation logic.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
[PMM: extracted from another patch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/helper.c   |  2 --
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq)
 
     vec = &s->vectors[irq];
     trace_nvic_set_pending(irq, vec->enabled, vec->prio);
+
+
+    if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) {
+        /* If a synchronous exception is pending then it may be
+         * escalated to HardFault if:
+         *  * it is equal or lower priority to current execution
+         *  * it is disabled
+         * (ie we need to take it immediately but we can't do so).
+         * Asynchronous exceptions (and interrupts) simply remain pending.
+         *
+         * For QEMU, we don't have any imprecise (asynchronous) faults,
+         * so we can assume that PREFETCH_ABORT and DATA_ABORT are always
+         * synchronous.
+         * Debug exceptions are awkward because only Debug exceptions
+         * resulting from the BKPT instruction should be escalated,
+         * but we don't currently implement any Debug exceptions other
+         * than those that result from BKPT, so we treat all debug exceptions
+         * as needing escalation.
+         *
+         * This all means we can identify whether to escalate based only on
+         * the exception number and don't (yet) need the caller to explicitly
+         * tell us whether this exception is synchronous or not.
+         */
+        int running = nvic_exec_prio(s);
+        bool escalate = false;
+
+        if (vec->prio >= running) {
+            trace_nvic_escalate_prio(irq, vec->prio, running);
+            escalate = true;
+        } else if (!vec->enabled) {
+            trace_nvic_escalate_disabled(irq);
+            escalate = true;
+        }
+
+        if (escalate) {
+            if (running < 0) {
+                /* We want to escalate to HardFault but we can't take a
+                 * synchronous HardFault at this point either. This is a
+                 * Lockup condition due to a guest bug. We don't model
+                 * Lockup, so report via cpu_abort() instead.
+                 */
+                cpu_abort(&s->cpu->parent_obj,
+                          "Lockup: can't escalate %d to HardFault "
+                          "(current priority %d)\n", irq, running);
+            }
+
+            /* We can do the escalation, so we take HardFault instead */
+            irq = ARMV7M_EXCP_HARD;
+            vec = &s->vectors[irq];
+            s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
+        }
+    }
+
     if (!vec->pending) {
         vec->pending = 1;
         nvic_irq_update(s);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
 
     /* For exceptions we just mark as pending on the NVIC, and let that
        handle it.  */
-    /* TODO: Need to escalate if the current priority is higher than the
-       one we're raising.  */
     switch (cs->exception_index) {
     case EXCP_UDEF:
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-- 
2.7.4

Having armv7m_nvic_acknowledge_irq() return the new value of
env->v7m.exception and its one caller assign the return value
back to env->v7m.exception is pointless. Just make the return
type void instead.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/cpu.h      | 2 +-
 hw/intc/armv7m_nvic.c | 4 +---
 target/arm/helper.c   | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

From: Michael Davidsaver <mdavidsaver@gmail.com>

All the places in armv7m_cpu_do_interrupt() which pend an
exception in the NVIC are doing so for synchronous
exceptions. We know that we will always take some
exception in this case, so we can just acknowledge it
immediately, rather than returning and then immediately
being called again because the NVIC has raised its outbound
IRQ line.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
[PMM: tweaked commit message; added DEBUG to the set of
exceptions we handle immediately, since it is synchronous
when it results from the BKPT instruction]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/helper.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
     case EXCP_UDEF:
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr |= R_V7M_CFSR_UNDEFINSTR_MASK;
-        return;
+        break;
     case EXCP_NOCP:
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr |= R_V7M_CFSR_NOCP_MASK;
-        return;
+        break;
     case EXCP_SWI:
         /* The PC already points to the next instruction.  */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
-        return;
+        break;
     case EXCP_PREFETCH_ABORT:
     case EXCP_DATA_ABORT:
         /* TODO: if we implemented the MPU registers, this is where we
          * should set the MMFAR, etc from exception.fsr and exception.vaddress.
          */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
-        return;
+        break;
     case EXCP_BKPT:
         if (semihosting_enabled()) {
             int nr;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
         }
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG);
-        return;
+        break;
     case EXCP_IRQ:
-        armv7m_nvic_acknowledge_irq(env->nvic);
         break;
     case EXCP_EXCEPTION_EXIT:
         do_v7m_exception_exit(env);
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
+    armv7m_nvic_acknowledge_irq(env->nvic);
+
+    qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
+
     /* Align stack pointer if the guest wants that */
     if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
         env->regs[13] -= 4;
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

The VECTCLRACTIVE and VECTRESET bits in the AIRCR are both
documented as UNPREDICTABLE if you write a 1 to them when
the processor is not halted in Debug state (ie stopped
and under the control of an external JTAG debugger).
Since we don't implement Debug state or emulated JTAG
these bits are always UNPREDICTABLE for us. Instead of
logging them as unimplemented we can simply log writes
as guest errors and ignore them.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
[PMM: change extracted from another patch; commit message
 constructed from scratch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
                 qemu_irq_pulse(s->sysresetreq);
             }
             if (value & 2) {
-                qemu_log_mask(LOG_UNIMP, "VECTCLRACTIVE unimplemented\n");
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Setting VECTCLRACTIVE when not in DEBUG mode "
+                              "is UNPREDICTABLE\n");
             }
             if (value & 1) {
-                qemu_log_mask(LOG_UNIMP, "AIRCR system reset unimplemented\n");
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Setting VECTRESET when not in DEBUG mode "
+                              "is UNPREDICTABLE\n");
             }
             s->prigroup = extract32(value, 8, 3);
             nvic_irq_update(s);
-- 
2.7.4

Extract the code from the tail end of arm_v7m_do_interrupt() which
enters the exception handler into a pair of utility functions
v7m_exception_taken() and v7m_push_stack(), which correspond roughly
to the pseudocode PushStack() and ExceptionTaken().

This also requires us to move the arm_v7m_load_vector() utility
routine up so we can call it.

Handling illegal exception returns has some cases where we want to
take a UsageFault either on an existing stack frame or with a new
stack frame but with a specific LR value, so we want to be able to
call these without having to go via arm_v7m_cpu_do_interrupt().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/helper.c | 118 ++++++++++++++++++++++++++++++----------------------
 1 file changed, 68 insertions(+), 50 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
     }
 }
 
+static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+{
+    CPUState *cs = CPU(cpu);
+    CPUARMState *env = &cpu->env;
+    MemTxResult result;
+    hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;
+    uint32_t addr;
+
+    addr = address_space_ldl(cs->as, vec,
+                             MEMTXATTRS_UNSPECIFIED, &result);
+    if (result != MEMTX_OK) {
+        /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,
+         * which would then be immediately followed by our failing to load
+         * the entry vector for that HardFault, which is a Lockup case.
+         * Since we don't model Lockup, we just report this guest error
+         * via cpu_abort().
+         */
+        cpu_abort(cs, "Failed to read from exception vector table "
+                  "entry %08x\n", (unsigned)vec);
+    }
+    return addr;
+}
+
+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
+{
+    /* Do the "take the exception" parts of exception entry,
+     * but not the pushing of state to the stack. This is
+     * similar to the pseudocode ExceptionTaken() function.
+     */
+    CPUARMState *env = &cpu->env;
+    uint32_t addr;
+
+    armv7m_nvic_acknowledge_irq(env->nvic);
+    switch_v7m_sp(env, 0);
+    /* Clear IT bits */
+    env->condexec_bits = 0;
+    env->regs[14] = lr;
+    addr = arm_v7m_load_vector(cpu);
+    env->regs[15] = addr & 0xfffffffe;
+    env->thumb = addr & 1;
+}
+
+static void v7m_push_stack(ARMCPU *cpu)
+{
+    /* Do the "set up stack frame" part of exception entry,
+     * similar to pseudocode PushStack().
+     */
+    CPUARMState *env = &cpu->env;
+    uint32_t xpsr = xpsr_read(env);
+
+    /* Align stack pointer if the guest wants that */
+    if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
+        env->regs[13] -= 4;
+        xpsr |= 0x200;
+    }
+    /* Switch to the handler mode.  */
+    v7m_push(env, xpsr);
+    v7m_push(env, env->regs[15]);
+    v7m_push(env, env->regs[14]);
+    v7m_push(env, env->regs[12]);
+    v7m_push(env, env->regs[3]);
+    v7m_push(env, env->regs[2]);
+    v7m_push(env, env->regs[1]);
+    v7m_push(env, env->regs[0]);
+}
+
 static void do_v7m_exception_exit(CPUARMState *env)
 {
     uint32_t type;
@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)
     }
 }
 
-static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
-
-{
-    CPUState *cs = CPU(cpu);
-    CPUARMState *env = &cpu->env;
-    MemTxResult result;
-    hwaddr vec = env->v7m.vecbase + env->v7m.exception * 4;
-    uint32_t addr;
-
-    addr = address_space_ldl(cs->as, vec,
-                             MEMTXATTRS_UNSPECIFIED, &result);
-    if (result != MEMTX_OK) {
-        /* Architecturally this should cause a HardFault setting HSFR.VECTTBL,
-         * which would then be immediately followed by our failing to load
-         * the entry vector for that HardFault, which is a Lockup case.
-         * Since we don't model Lockup, we just report this guest error
-         * via cpu_abort().
-         */
-        cpu_abort(cs, "Failed to read from exception vector table "
-                  "entry %08x\n", (unsigned)vec);
-    }
-    return addr;
-}
-
 void arm_v7m_cpu_do_interrupt(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-    uint32_t xpsr = xpsr_read(env);
     uint32_t lr;
-    uint32_t addr;
 
     arm_log_exception(cs->exception_index);
 
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    armv7m_nvic_acknowledge_irq(env->nvic);
-
+    v7m_push_stack(cpu);
+    v7m_exception_taken(cpu, lr);
     qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
-
-    /* Align stack pointer if the guest wants that */
-    if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) {
-        env->regs[13] -= 4;
-        xpsr |= 0x200;
-    }
-    /* Switch to the handler mode.  */
-    v7m_push(env, xpsr);
-    v7m_push(env, env->regs[15]);
-    v7m_push(env, env->regs[14]);
-    v7m_push(env, env->regs[12]);
-    v7m_push(env, env->regs[3]);
-    v7m_push(env, env->regs[2]);
-    v7m_push(env, env->regs[1]);
-    v7m_push(env, env->regs[0]);
-    switch_v7m_sp(env, 0);
-    /* Clear IT bits */
-    env->condexec_bits = 0;
-    env->regs[14] = lr;
-    addr = arm_v7m_load_vector(cpu);
-    env->regs[15] = addr & 0xfffffffe;
-    env->thumb = addr & 1;
 }
 
 /* Function used to synchronize QEMU's AArch64 register set with AArch32
-- 
2.7.4

Implement the exception return consistency checks
described in the v7M pseudocode ExceptionReturn().

Inspired by a patch from Michael Davidsaver's series, but
this is a reimplementation from scratch based on the
ARM ARM pseudocode.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/cpu.h      |  12 +++++-
 hw/intc/armv7m_nvic.c |  12 +++++-
 target/arm/helper.c   | 112 +++++++++++++++++++++++++++++++++++++++++++++-----
 3 files changed, 123 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
 #endif
 void armv7m_nvic_set_pending(void *opaque, int irq);
 void armv7m_nvic_acknowledge_irq(void *opaque);
-void armv7m_nvic_complete_irq(void *opaque, int irq);
+/**
+ * armv7m_nvic_complete_irq: complete specified interrupt or exception
+ * @opaque: the NVIC
+ * @irq: the exception number to complete
+ *
+ * Returns: -1 if the irq was not active
+ *           1 if completing this irq brought us back to base (no active irqs)
+ *           0 if there is still an irq active after this one was completed
+ * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
+ */
+int armv7m_nvic_complete_irq(void *opaque, int irq);
 
 /* Interface for defining coprocessor registers.
  * Registers are defined in tables of arm_cp_reginfo structs
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
-void armv7m_nvic_complete_irq(void *opaque, int irq)
+int armv7m_nvic_complete_irq(void *opaque, int irq)
 {
     NVICState *s = (NVICState *)opaque;
     VecInfo *vec;
+    int ret;
 
     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
 
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_complete_irq(void *opaque, int irq)
 
     trace_nvic_complete_irq(irq);
 
+    if (!vec->active) {
+        /* Tell the caller this was an illegal exception return */
+        return -1;
+    }
+
+    ret = nvic_rettobase(s);
+
     vec->active = 0;
     if (vec->level) {
         /* Re-pend the exception if it's still held high; only
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_complete_irq(void *opaque, int irq)
     }
 
     nvic_irq_update(s);
+
+    return ret;
 }
 
 /* callback when external interrupt line is changed */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
     v7m_push(env, env->regs[0]);
 }
 
-static void do_v7m_exception_exit(CPUARMState *env)
+static void do_v7m_exception_exit(ARMCPU *cpu)
 {
+    CPUARMState *env = &cpu->env;
     uint32_t type;
     uint32_t xpsr;
-
+    bool ufault = false;
+    bool return_to_sp_process = false;
+    bool return_to_handler = false;
+    bool rettobase = false;
+
+    /* We can only get here from an EXCP_EXCEPTION_EXIT, and
+     * arm_v7m_do_unassigned_access() enforces the architectural rule
+     * that jumps to magic addresses don't have magic behaviour unless
+     * we're in Handler mode (compare pseudocode BXWritePC()).
+     */
+    assert(env->v7m.exception != 0);
+
+    /* In the spec pseudocode ExceptionReturn() is called directly
+     * from BXWritePC() and gets the full target PC value including
+     * bit zero. In QEMU's implementation we treat it as a normal
+     * jump-to-register (which is then caught later on), and so split
+     * the target value up between env->regs[15] and env->thumb in
+     * gen_bx(). Reconstitute it.
+     */
     type = env->regs[15];
+    if (env->thumb) {
+        type |= 1;
+    }
+
+    qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
+                  " previous exception %d\n",
+                  type, env->v7m.exception);
+
+    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+    }
+
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
         /* Auto-clear FAULTMASK on return from other than NMI */
         env->daif &= ~PSTATE_F;
     }
-    if (env->v7m.exception != 0) {
-        armv7m_nvic_complete_irq(env->nvic, env->v7m.exception);
+
+    switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception)) {
+    case -1:
+        /* attempt to exit an exception that isn't active */
+        ufault = true;
+        break;
+    case 0:
+        /* still an irq active now */
+        break;
+    case 1:
+        /* we returned to base exception level, no nesting.
+         * (In the pseudocode this is written using "NestedActivation != 1"
+         * where we have 'rettobase == false'.)
+         */
+        rettobase = true;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    switch (type & 0xf) {
+    case 1: /* Return to Handler */
+        return_to_handler = true;
+        break;
+    case 13: /* Return to Thread using Process stack */
+        return_to_sp_process = true;
+        /* fall through */
+    case 9: /* Return to Thread using Main stack */
+        if (!rettobase &&
+            !(env->v7m.ccr & R_V7M_CCR_NONBASETHRDENA_MASK)) {
+            ufault = true;
+        }
+        break;
+    default:
+        ufault = true;
+    }
+
+    if (ufault) {
+        /* Bad exception return: instead of popping the exception
+         * stack, directly take a usage fault on the current stack.
+         */
+        env->v7m.cfsr |= R_V7M_CFSR_INVPC_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+        v7m_exception_taken(cpu, type | 0xf0000000);
+        qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                      "stackframe: failed exception return integrity check\n");
+        return;
     }
 
     /* Switch to the target stack.  */
-    switch_v7m_sp(env, (type & 4) != 0);
+    switch_v7m_sp(env, return_to_sp_process);
     /* Pop registers.  */
     env->regs[0] = v7m_pop(env);
     env->regs[1] = v7m_pop(env);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(CPUARMState *env)
     /* Undo stack alignment.  */
     if (xpsr & 0x200)
         env->regs[13] |= 4;
-    /* ??? The exception return type specifies Thread/Handler mode.  However
-       this is also implied by the xPSR value. Not sure what to do
-       if there is a mismatch.  */
-    /* ??? Likewise for mismatches between the CONTROL register and the stack
-       pointer.  */
+
+    /* The restored xPSR exception field will be zero if we're
+     * resuming in Thread mode. If that doesn't match what the
+     * exception return type specified then this is a UsageFault.
+     */
+    if (return_to_handler == (env->v7m.exception == 0)) {
+        /* Take an INVPC UsageFault by pushing the stack again. */
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+        env->v7m.cfsr |= R_V7M_CFSR_INVPC_MASK;
+        v7m_push_stack(cpu);
+        v7m_exception_taken(cpu, type | 0xf0000000);
+        qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
+                      "failed exception return integrity check\n");
+        return;
+    }
+
+    /* Otherwise, we have a successful exception exit. */
+    qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
 static void arm_log_exception(int idx)
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
     case EXCP_IRQ:
         break;
     case EXCP_EXCEPTION_EXIT:
-        do_v7m_exception_exit(env);
+        do_v7m_exception_exit(cpu);
         return;
     default:
         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
-- 
2.7.4

M profile doesn't implement ARM, and the architecturally required
behaviour for attempts to execute with the Thumb bit clear is to
generate a UsageFault with the CFSR INVSTATE bit set.  We were
incorrectly implementing this as generating an UNDEFINSTR UsageFault;
fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/cpu.h       | 1 +
 linux-user/main.c      | 1 +
 target/arm/helper.c    | 4 ++++
 target/arm/translate.c | 8 ++++++--
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define EXCP_VFIQ           15
 #define EXCP_SEMIHOST       16   /* semihosting call */
 #define EXCP_NOCP           17   /* v7M NOCP UsageFault */
+#define EXCP_INVSTATE       18   /* v7M INVSTATE UsageFault */
 
 #define ARMV7M_EXCP_RESET   1
 #define ARMV7M_EXCP_NMI     2
diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
         switch(trapnr) {
         case EXCP_UDEF:
         case EXCP_NOCP:
+        case EXCP_INVSTATE:
             {
                 TaskState *ts = cs->opaque;
                 uint32_t opcode;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr |= R_V7M_CFSR_NOCP_MASK;
         break;
+    case EXCP_INVSTATE:
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+        env->v7m.cfsr |= R_V7M_CFSR_INVSTATE_MASK;
+        break;
     case EXCP_SWI:
         /* The PC already points to the next instruction.  */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SVC);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     TCGv_i32 addr;
     TCGv_i64 tmp64;
 
-    /* M variants do not implement ARM mode.  */
+    /* M variants do not implement ARM mode; this must raise the INVSTATE
+     * UsageFault exception.
+     */
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        goto illegal_op;
+        gen_exception_insn(s, 4, EXCP_INVSTATE, syn_uncategorized(),
+                           default_exception_el(s));
+        return;
     }
     cond = insn >> 28;
     if (cond == 0xf){
-- 
2.7.4

Implement the NVIC SHCSR write behaviour which allows pending and
active status of some exceptions to be changed.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/intc/armv7m_nvic.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
         cpu->env.v7m.ccr = value;
         break;
     case 0xd24: /* System Handler Control.  */
-        /* TODO: Real hardware allows you to set/clear the active bits
-           under some circumstances.  We don't implement this.  */
+        s->vectors[ARMV7M_EXCP_MEM].active = (value & (1 << 0)) != 0;
+        s->vectors[ARMV7M_EXCP_BUS].active = (value & (1 << 1)) != 0;
+        s->vectors[ARMV7M_EXCP_USAGE].active = (value & (1 << 3)) != 0;
+        s->vectors[ARMV7M_EXCP_SVC].active = (value & (1 << 7)) != 0;
+        s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
+        s->vectors[ARMV7M_EXCP_PENDSV].active = (value & (1 << 10)) != 0;
+        s->vectors[ARMV7M_EXCP_SYSTICK].active = (value & (1 << 11)) != 0;
+        s->vectors[ARMV7M_EXCP_USAGE].pending = (value & (1 << 12)) != 0;
+        s->vectors[ARMV7M_EXCP_MEM].pending = (value & (1 << 13)) != 0;
+        s->vectors[ARMV7M_EXCP_BUS].pending = (value & (1 << 14)) != 0;
+        s->vectors[ARMV7M_EXCP_SVC].pending = (value & (1 << 15)) != 0;
         s->vectors[ARMV7M_EXCP_MEM].enabled = (value & (1 << 16)) != 0;
         s->vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
         s->vectors[ARMV7M_EXCP_USAGE].enabled = (value & (1 << 18)) != 0;
-- 
2.7.4

From: Clement Deschamps <clement.deschamps@antfield.fr>

This adds the BCM2835 SDHost controller from Arasan.

Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
Message-id: 20170224164021.9066-2-clement.deschamps@antfield.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/Makefile.objs            |   1 +
 include/hw/sd/bcm2835_sdhost.h |  48 +++++
 hw/sd/bcm2835_sdhost.c         | 429 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 478 insertions(+)
 create mode 100644 include/hw/sd/bcm2835_sdhost.h
 create mode 100644 hw/sd/bcm2835_sdhost.c

diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/Makefile.objs
+++ b/hw/sd/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SDHCI) += sdhci.o
 obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
 obj-$(CONFIG_OMAP) += omap_mmc.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
+obj-$(CONFIG_RASPI) += bcm2835_sdhost.o
diff --git a/include/hw/sd/bcm2835_sdhost.h b/include/hw/sd/bcm2835_sdhost.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/sd/bcm2835_sdhost.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Raspberry Pi (BCM2835) SD Host Controller
+ *
+ * Copyright (c) 2017 Antfield SAS
+ *
+ * Authors:
+ *  Clement Deschamps <clement.deschamps@antfield.fr>
+ *  Luc Michel <luc.michel@antfield.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef BCM2835_SDHOST_H
+#define BCM2835_SDHOST_H
+
+#include "hw/sysbus.h"
+#include "hw/sd/sd.h"
+
+#define TYPE_BCM2835_SDHOST "bcm2835-sdhost"
+#define BCM2835_SDHOST(obj) \
+        OBJECT_CHECK(BCM2835SDHostState, (obj), TYPE_BCM2835_SDHOST)
+
+#define BCM2835_SDHOST_FIFO_LEN 16
+
+typedef struct {
+    SysBusDevice busdev;
+    SDBus sdbus;
+    MemoryRegion iomem;
+
+    uint32_t cmd;
+    uint32_t cmdarg;
+    uint32_t status;
+    uint32_t rsp[4];
+    uint32_t config;
+    uint32_t edm;
+    uint32_t vdd;
+    uint32_t hbct;
+    uint32_t hblc;
+    int32_t fifo_pos;
+    int32_t fifo_len;
+    uint32_t fifo[BCM2835_SDHOST_FIFO_LEN];
+    uint32_t datacnt;
+
+    qemu_irq irq;
+} BCM2835SDHostState;
+
+#endif
diff --git a/hw/sd/bcm2835_sdhost.c b/hw/sd/bcm2835_sdhost.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sd/bcm2835_sdhost.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Raspberry Pi (BCM2835) SD Host Controller
+ *
+ * Copyright (c) 2017 Antfield SAS
+ *
+ * Authors:
+ *  Clement Deschamps <clement.deschamps@antfield.fr>
+ *  Luc Michel <luc.michel@antfield.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "sysemu/blockdev.h"
+#include "hw/sd/bcm2835_sdhost.h"
+
+#define TYPE_BCM2835_SDHOST_BUS "bcm2835-sdhost-bus"
+#define BCM2835_SDHOST_BUS(obj) \
+    OBJECT_CHECK(SDBus, (obj), TYPE_BCM2835_SDHOST_BUS)
+
+#define SDCMD  0x00 /* Command to SD card              - 16 R/W */
+#define SDARG  0x04 /* Argument to SD card             - 32 R/W */
+#define SDTOUT 0x08 /* Start value for timeout counter - 32 R/W */
+#define SDCDIV 0x0c /* Start value for clock divider   - 11 R/W */
+#define SDRSP0 0x10 /* SD card rsp (31:0)         - 32 R   */
+#define SDRSP1 0x14 /* SD card rsp (63:32)        - 32 R   */
+#define SDRSP2 0x18 /* SD card rsp (95:64)        - 32 R   */
+#define SDRSP3 0x1c /* SD card rsp (127:96)       - 32 R   */
+#define SDHSTS 0x20 /* SD host status                  - 11 R   */
+#define SDVDD  0x30 /* SD card power control           -  1 R/W */
+#define SDEDM  0x34 /* Emergency Debug Mode            - 13 R/W */
+#define SDHCFG 0x38 /* Host configuration              -  2 R/W */
+#define SDHBCT 0x3c /* Host byte count (debug)         - 32 R/W */
+#define SDDATA 0x40 /* Data to/from SD card            - 32 R/W */
+#define SDHBLC 0x50 /* Host block count (SDIO/SDHC)    -  9 R/W */
+
+#define SDCMD_NEW_FLAG                  0x8000
+#define SDCMD_FAIL_FLAG                 0x4000
+#define SDCMD_BUSYWAIT                  0x800
+#define SDCMD_NO_RESPONSE               0x400
+#define SDCMD_LONG_RESPONSE             0x200
+#define SDCMD_WRITE_CMD                 0x80
+#define SDCMD_READ_CMD                  0x40
+#define SDCMD_CMD_MASK                  0x3f
+
+#define SDCDIV_MAX_CDIV                 0x7ff
+
+#define SDHSTS_BUSY_IRPT                0x400
+#define SDHSTS_BLOCK_IRPT               0x200
+#define SDHSTS_SDIO_IRPT                0x100
+#define SDHSTS_REW_TIME_OUT             0x80
+#define SDHSTS_CMD_TIME_OUT             0x40
+#define SDHSTS_CRC16_ERROR              0x20
+#define SDHSTS_CRC7_ERROR               0x10
+#define SDHSTS_FIFO_ERROR               0x08
+/* Reserved */
+/* Reserved */
+#define SDHSTS_DATA_FLAG                0x01
+
+#define SDHCFG_BUSY_IRPT_EN     (1 << 10)
+#define SDHCFG_BLOCK_IRPT_EN    (1 << 8)
+#define SDHCFG_SDIO_IRPT_EN     (1 << 5)
+#define SDHCFG_DATA_IRPT_EN     (1 << 4)
+#define SDHCFG_SLOW_CARD        (1 << 3)
+#define SDHCFG_WIDE_EXT_BUS     (1 << 2)
+#define SDHCFG_WIDE_INT_BUS     (1 << 1)
+#define SDHCFG_REL_CMD_LINE     (1 << 0)
+
+#define SDEDM_FORCE_DATA_MODE   (1 << 19)
+#define SDEDM_CLOCK_PULSE       (1 << 20)
+#define SDEDM_BYPASS            (1 << 21)
+
+#define SDEDM_WRITE_THRESHOLD_SHIFT 9
+#define SDEDM_READ_THRESHOLD_SHIFT 14
+#define SDEDM_THRESHOLD_MASK     0x1f
+
+#define SDEDM_FSM_MASK           0xf
+#define SDEDM_FSM_IDENTMODE      0x0
+#define SDEDM_FSM_DATAMODE       0x1
+#define SDEDM_FSM_READDATA       0x2
+#define SDEDM_FSM_WRITEDATA      0x3
+#define SDEDM_FSM_READWAIT       0x4
+#define SDEDM_FSM_READCRC        0x5
+#define SDEDM_FSM_WRITECRC       0x6
+#define SDEDM_FSM_WRITEWAIT1     0x7
+#define SDEDM_FSM_POWERDOWN      0x8
+#define SDEDM_FSM_POWERUP        0x9
+#define SDEDM_FSM_WRITESTART1    0xa
+#define SDEDM_FSM_WRITESTART2    0xb
+#define SDEDM_FSM_GENPULSES      0xc
+#define SDEDM_FSM_WRITEWAIT2     0xd
+#define SDEDM_FSM_STARTPOWDOWN   0xf
+
+#define SDDATA_FIFO_WORDS        16
+
+static void bcm2835_sdhost_update_irq(BCM2835SDHostState *s)
+{
+    uint32_t irq = s->status &
+        (SDHSTS_BUSY_IRPT | SDHSTS_BLOCK_IRPT | SDHSTS_SDIO_IRPT);
+    qemu_set_irq(s->irq, !!irq);
+}
+
+static void bcm2835_sdhost_send_command(BCM2835SDHostState *s)
+{
+    SDRequest request;
+    uint8_t rsp[16];
+    int rlen;
+
+    request.cmd = s->cmd & SDCMD_CMD_MASK;
+    request.arg = s->cmdarg;
+
+    rlen = sdbus_do_command(&s->sdbus, &request, rsp);
+    if (rlen < 0) {
+        goto error;
+    }
+    if (!(s->cmd & SDCMD_NO_RESPONSE)) {
+#define RWORD(n) (((uint32_t)rsp[n] << 24) | (rsp[n + 1] << 16) \
+                  | (rsp[n + 2] << 8) | rsp[n + 3])
+        if (rlen == 0 || (rlen == 4 && (s->cmd & SDCMD_LONG_RESPONSE))) {
+            goto error;
+        }
+        if (rlen != 4 && rlen != 16) {
+            goto error;
+        }
+        if (rlen == 4) {
+            s->rsp[0] = RWORD(0);
+            s->rsp[1] = s->rsp[2] = s->rsp[3] = 0;
+        } else {
+            s->rsp[0] = RWORD(12);
+            s->rsp[1] = RWORD(8);
+            s->rsp[2] = RWORD(4);
+            s->rsp[3] = RWORD(0);
+        }
+#undef RWORD
+    }
+    return;
+
+error:
+    s->cmd |= SDCMD_FAIL_FLAG;
+    s->status |= SDHSTS_CMD_TIME_OUT;
+}
+
+static void bcm2835_sdhost_fifo_push(BCM2835SDHostState *s, uint32_t value)
+{
+    int n;
+
+    if (s->fifo_len == BCM2835_SDHOST_FIFO_LEN) {
+        /* FIFO overflow */
+        return;
+    }
+    n = (s->fifo_pos + s->fifo_len) & (BCM2835_SDHOST_FIFO_LEN - 1);
+    s->fifo_len++;
+    s->fifo[n] = value;
+}
+
+static uint32_t bcm2835_sdhost_fifo_pop(BCM2835SDHostState *s)
+{
+    uint32_t value;
+
+    if (s->fifo_len == 0) {
+        /* FIFO underflow */
+        return 0;
+    }
+    value = s->fifo[s->fifo_pos];
+    s->fifo_len--;
+    s->fifo_pos = (s->fifo_pos + 1) & (BCM2835_SDHOST_FIFO_LEN - 1);
+    return value;
+}
+
+static void bcm2835_sdhost_fifo_run(BCM2835SDHostState *s)
+{
+    uint32_t value = 0;
+    int n;
+    int is_read;
+
+    is_read = (s->cmd & SDCMD_READ_CMD) != 0;
+    if (s->datacnt != 0 && (!is_read || sdbus_data_ready(&s->sdbus))) {
+        if (is_read) {
+            n = 0;
+            while (s->datacnt && s->fifo_len < BCM2835_SDHOST_FIFO_LEN) {
+                value |= (uint32_t)sdbus_read_data(&s->sdbus) << (n * 8);
+                s->datacnt--;
+                n++;
+                if (n == 4) {
+                    bcm2835_sdhost_fifo_push(s, value);
+                    n = 0;
+                    value = 0;
+                }
+            }
+            if (n != 0) {
+                bcm2835_sdhost_fifo_push(s, value);
+            }
+        } else { /* write */
+            n = 0;
+            while (s->datacnt > 0 && (s->fifo_len > 0 || n > 0)) {
+                if (n == 0) {
+                    value = bcm2835_sdhost_fifo_pop(s);
+                    n = 4;
+                }
+                n--;
+                s->datacnt--;
+                sdbus_write_data(&s->sdbus, value & 0xff);
+                value >>= 8;
+            }
+        }
+    }
+    if (s->datacnt == 0) {
+        s->status |= SDHSTS_DATA_FLAG;
+
+        s->edm &= ~0xf;
+        s->edm |= SDEDM_FSM_DATAMODE;
+
+        if (s->config & SDHCFG_DATA_IRPT_EN) {
+            s->status |= SDHSTS_SDIO_IRPT;
+        }
+
+        if ((s->cmd & SDCMD_BUSYWAIT) && (s->config & SDHCFG_BUSY_IRPT_EN)) {
+            s->status |= SDHSTS_BUSY_IRPT;
+        }
+
+        if ((s->cmd & SDCMD_WRITE_CMD) && (s->config & SDHCFG_BLOCK_IRPT_EN)) {
+            s->status |= SDHSTS_BLOCK_IRPT;
+        }
+
+        bcm2835_sdhost_update_irq(s);
+    }
+
+    s->edm &= ~(0x1f << 4);
+    s->edm |= ((s->fifo_len & 0x1f) << 4);
+}
+
+static uint64_t bcm2835_sdhost_read(void *opaque, hwaddr offset,
+    unsigned size)
+{
+    BCM2835SDHostState *s = (BCM2835SDHostState *)opaque;
+    uint32_t res = 0;
+
+    switch (offset) {
+    case SDCMD:
+        res = s->cmd;
+        break;
+    case SDHSTS:
+        res = s->status;
+        break;
+    case SDRSP0:
+        res = s->rsp[0];
+        break;
+    case SDRSP1:
+        res = s->rsp[1];
+        break;
+    case SDRSP2:
+        res = s->rsp[2];
+        break;
+    case SDRSP3:
+        res = s->rsp[3];
+        break;
+    case SDEDM:
+        res = s->edm;
+        break;
+    case SDVDD:
+        res = s->vdd;
+        break;
+    case SDDATA:
+        res = bcm2835_sdhost_fifo_pop(s);
+        bcm2835_sdhost_fifo_run(s);
+        break;
+    case SDHBCT:
+        res = s->hbct;
+        break;
+    case SDHBLC:
+        res = s->hblc;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+                      __func__, offset);
+        res = 0;
+        break;
+    }
+
+    return res;
+}
+
+static void bcm2835_sdhost_write(void *opaque, hwaddr offset,
+    uint64_t value, unsigned size)
+{
+    BCM2835SDHostState *s = (BCM2835SDHostState *)opaque;
+
+    switch (offset) {
+    case SDCMD:
+        s->cmd = value;
+        if (value & SDCMD_NEW_FLAG) {
+            bcm2835_sdhost_send_command(s);
+            bcm2835_sdhost_fifo_run(s);
+            s->cmd &= ~SDCMD_NEW_FLAG;
+        }
+        break;
+    case SDTOUT:
+        break;
+    case SDCDIV:
+        break;
+    case SDHSTS:
+        s->status &= ~value;
+        bcm2835_sdhost_update_irq(s);
+        break;
+    case SDARG:
+        s->cmdarg = value;
+        break;
+    case SDEDM:
+        if ((value & 0xf) == 0xf) {
+            /* power down */
+            value &= ~0xf;
+        }
+        s->edm = value;
+        break;
+    case SDHCFG:
+        s->config = value;
+        bcm2835_sdhost_fifo_run(s);
+        break;
+    case SDVDD:
+        s->vdd = value;
+        break;
+    case SDDATA:
+        bcm2835_sdhost_fifo_push(s, value);
+        bcm2835_sdhost_fifo_run(s);
+        break;
+    case SDHBCT:
+        s->hbct = value;
+        break;
+    case SDHBLC:
+        s->hblc = value;
+        s->datacnt = s->hblc * s->hbct;
+        bcm2835_sdhost_fifo_run(s);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+                      __func__, offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps bcm2835_sdhost_ops = {
+    .read = bcm2835_sdhost_read,
+    .write = bcm2835_sdhost_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_bcm2835_sdhost = {
+    .name = TYPE_BCM2835_SDHOST,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(cmd, BCM2835SDHostState),
+        VMSTATE_UINT32(cmdarg, BCM2835SDHostState),
+        VMSTATE_UINT32(status, BCM2835SDHostState),
+        VMSTATE_UINT32_ARRAY(rsp, BCM2835SDHostState, 4),
+        VMSTATE_UINT32(config, BCM2835SDHostState),
+        VMSTATE_UINT32(edm, BCM2835SDHostState),
+        VMSTATE_UINT32(vdd, BCM2835SDHostState),
+        VMSTATE_UINT32(hbct, BCM2835SDHostState),
+        VMSTATE_UINT32(hblc, BCM2835SDHostState),
+        VMSTATE_INT32(fifo_pos, BCM2835SDHostState),
+        VMSTATE_INT32(fifo_len, BCM2835SDHostState),
+        VMSTATE_UINT32_ARRAY(fifo, BCM2835SDHostState, BCM2835_SDHOST_FIFO_LEN),
+        VMSTATE_UINT32(datacnt, BCM2835SDHostState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_sdhost_init(Object *obj)
+{
+    BCM2835SDHostState *s = BCM2835_SDHOST(obj);
+
+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
+                        TYPE_BCM2835_SDHOST_BUS, DEVICE(s), "sd-bus");
+
+    memory_region_init_io(&s->iomem, obj, &bcm2835_sdhost_ops, s,
+                          TYPE_BCM2835_SDHOST, 0x1000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
+}
+
+static void bcm2835_sdhost_reset(DeviceState *dev)
+{
+    BCM2835SDHostState *s = BCM2835_SDHOST(dev);
+
+    s->cmd = 0;
+    s->cmdarg = 0;
+    s->edm = 0x0000c60f;
+    s->config = 0;
+    s->hbct = 0;
+    s->hblc = 0;
+    s->datacnt = 0;
+    s->fifo_pos = 0;
+    s->fifo_len = 0;
+}
+
+static void bcm2835_sdhost_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = bcm2835_sdhost_reset;
+    dc->vmsd = &vmstate_bcm2835_sdhost;
+}
+
+static TypeInfo bcm2835_sdhost_info = {
+    .name          = TYPE_BCM2835_SDHOST,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835SDHostState),
+    .class_init    = bcm2835_sdhost_class_init,
+    .instance_init = bcm2835_sdhost_init,
+};
+
+static const TypeInfo bcm2835_sdhost_bus_info = {
+    .name = TYPE_BCM2835_SDHOST_BUS,
+    .parent = TYPE_SD_BUS,
+    .instance_size = sizeof(SDBus),
+};
+
+static void bcm2835_sdhost_register_types(void)
+{
+    type_register_static(&bcm2835_sdhost_info);
+    type_register_static(&bcm2835_sdhost_bus_info);
+}
+
+type_init(bcm2835_sdhost_register_types)
-- 
2.7.4

From: Clement Deschamps <clement.deschamps@antfield.fr>

Provide a new function sdbus_reparent_card() in sd core for reparenting
a card from a SDBus to another one.

This function is required by the raspi platform, where the two SD
controllers can be dynamically switched.

Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
Message-id: 20170224164021.9066-3-clement.deschamps@antfield.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added a doc comment to the header file]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sd.h | 11 +++++++++++
 hw/sd/core.c       | 30 ++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -XXX,XX +XXX,XX @@ uint8_t sdbus_read_data(SDBus *sd);
 bool sdbus_data_ready(SDBus *sd);
 bool sdbus_get_inserted(SDBus *sd);
 bool sdbus_get_readonly(SDBus *sd);
+/**
+ * sdbus_reparent_card: Reparent an SD card from one controller to another
+ * @from: controller bus to remove card from
+ * @to: controller bus to move card to
+ *
+ * Reparent an SD card, effectively unplugging it from one controller
+ * and inserting it into another. This is useful for SoCs like the
+ * bcm2835 which have two SD controllers and connect a single SD card
+ * to them, selected by the guest reprogramming GPIO line routing.
+ */
+void sdbus_reparent_card(SDBus *from, SDBus *to);
 
 /* Functions to be used by SD devices to report back to qdevified controllers */
 void sdbus_set_inserted(SDBus *sd, bool inserted);
diff --git a/hw/sd/core.c b/hw/sd/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/core.c
+++ b/hw/sd/core.c
@@ -XXX,XX +XXX,XX @@ void sdbus_set_readonly(SDBus *sdbus, bool readonly)
     }
 }
 
+void sdbus_reparent_card(SDBus *from, SDBus *to)
+{
+    BusChild *kid = QTAILQ_FIRST(&from->qbus.children);
+    SDState *card;
+    SDCardClass *sc;
+    bool readonly;
+
+    /* We directly reparent the card object rather than implementing this
+     * as a hotpluggable connection because we don't want to expose SD cards
+     * to users as being hotpluggable, and we can get away with it in this
+     * limited use case. This could perhaps be implemented more cleanly in
+     * future by adding support to the hotplug infrastructure for "device
+     * can be hotplugged only via code, not by user".
+     */
+
+    if (!kid) {
+        return;
+    }
+
+    card = SD_CARD(kid->child);
+    sc = SD_CARD_GET_CLASS(card);
+    readonly = sc->get_readonly(card);
+
+    sdbus_set_inserted(from, false);
+    object_unparent(OBJECT(kid));
+    qdev_set_parent_bus(DEVICE(card), &to->qbus);
+    sdbus_set_inserted(to, true);
+    sdbus_set_readonly(to, readonly);
+}
+
 static const TypeInfo sd_bus_info = {
     .name = TYPE_SD_BUS,
     .parent = TYPE_BUS,
-- 
2.7.4

From: Clement Deschamps <clement.deschamps@antfield.fr>

This adds the BCM2835 GPIO controller.

It currently implements:
- The 54 GPIOs as outputs (qemu_irq)
- The SD controller selection via alternate function of GPIOs 48-53

Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
Message-id: 20170224164021.9066-4-clement.deschamps@antfield.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/Makefile.objs          |   1 +
 include/hw/gpio/bcm2835_gpio.h |  39 +++++
 hw/gpio/bcm2835_gpio.c         | 353 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 393 insertions(+)
 create mode 100644 include/hw/gpio/bcm2835_gpio.h
 create mode 100644 hw/gpio/bcm2835_gpio.c

diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Makefile.objs
+++ b/hw/gpio/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_GPIO_KEY) += gpio_key.o
 
 obj-$(CONFIG_OMAP) += omap_gpio.o
 obj-$(CONFIG_IMX) += imx_gpio.o
+obj-$(CONFIG_RASPI) += bcm2835_gpio.o
diff --git a/include/hw/gpio/bcm2835_gpio.h b/include/hw/gpio/bcm2835_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/bcm2835_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Raspberry Pi (BCM2835) GPIO Controller
+ *
+ * Copyright (c) 2017 Antfield SAS
+ *
+ * Authors:
+ *  Clement Deschamps <clement.deschamps@antfield.fr>
+ *  Luc Michel <luc.michel@antfield.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef BCM2835_GPIO_H
+#define BCM2835_GPIO_H
+
+#include "hw/sd/sd.h"
+
+typedef struct BCM2835GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+
+    /* SDBus selector */
+    SDBus sdbus;
+    SDBus *sdbus_sdhci;
+    SDBus *sdbus_sdhost;
+
+    uint8_t fsel[54];
+    uint32_t lev0, lev1;
+    uint8_t sd_fsel;
+    qemu_irq out[54];
+} BCM2835GpioState;
+
+#define TYPE_BCM2835_GPIO "bcm2835_gpio"
+#define BCM2835_GPIO(obj) \
+    OBJECT_CHECK(BCM2835GpioState, (obj), TYPE_BCM2835_GPIO)
+
+#endif
diff --git a/hw/gpio/bcm2835_gpio.c b/hw/gpio/bcm2835_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/bcm2835_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Raspberry Pi (BCM2835) GPIO Controller
+ *
+ * Copyright (c) 2017 Antfield SAS
+ *
+ * Authors:
+ *  Clement Deschamps <clement.deschamps@antfield.fr>
+ *  Luc Michel <luc.michel@antfield.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/timer.h"
+#include "qapi/error.h"
+#include "hw/sysbus.h"
+#include "hw/sd/sd.h"
+#include "hw/gpio/bcm2835_gpio.h"
+
+#define GPFSEL0   0x00
+#define GPFSEL1   0x04
+#define GPFSEL2   0x08
+#define GPFSEL3   0x0C
+#define GPFSEL4   0x10
+#define GPFSEL5   0x14
+#define GPSET0    0x1C
+#define GPSET1    0x20
+#define GPCLR0    0x28
+#define GPCLR1    0x2C
+#define GPLEV0    0x34
+#define GPLEV1    0x38
+#define GPEDS0    0x40
+#define GPEDS1    0x44
+#define GPREN0    0x4C
+#define GPREN1    0x50
+#define GPFEN0    0x58
+#define GPFEN1    0x5C
+#define GPHEN0    0x64
+#define GPHEN1    0x68
+#define GPLEN0    0x70
+#define GPLEN1    0x74
+#define GPAREN0   0x7C
+#define GPAREN1   0x80
+#define GPAFEN0   0x88
+#define GPAFEN1   0x8C
+#define GPPUD     0x94
+#define GPPUDCLK0 0x98
+#define GPPUDCLK1 0x9C
+
+static uint32_t gpfsel_get(BCM2835GpioState *s, uint8_t reg)
+{
+    int i;
+    uint32_t value = 0;
+    for (i = 0; i < 10; i++) {
+        uint32_t index = 10 * reg + i;
+        if (index < sizeof(s->fsel)) {
+            value |= (s->fsel[index] & 0x7) << (3 * i);
+        }
+    }
+    return value;
+}
+
+static void gpfsel_set(BCM2835GpioState *s, uint8_t reg, uint32_t value)
+{
+    int i;
+    for (i = 0; i < 10; i++) {
+        uint32_t index = 10 * reg + i;
+        if (index < sizeof(s->fsel)) {
+            int fsel = (value >> (3 * i)) & 0x7;
+            s->fsel[index] = fsel;
+        }
+    }
+
+    /* SD controller selection (48-53) */
+    if (s->sd_fsel != 0
+            && (s->fsel[48] == 0) /* SD_CLK_R */
+            && (s->fsel[49] == 0) /* SD_CMD_R */
+            && (s->fsel[50] == 0) /* SD_DATA0_R */
+            && (s->fsel[51] == 0) /* SD_DATA1_R */
+            && (s->fsel[52] == 0) /* SD_DATA2_R */
+            && (s->fsel[53] == 0) /* SD_DATA3_R */
+            ) {
+        /* SDHCI controller selected */
+        sdbus_reparent_card(s->sdbus_sdhost, s->sdbus_sdhci);
+        s->sd_fsel = 0;
+    } else if (s->sd_fsel != 4
+            && (s->fsel[48] == 4) /* SD_CLK_R */
+            && (s->fsel[49] == 4) /* SD_CMD_R */
+            && (s->fsel[50] == 4) /* SD_DATA0_R */
+            && (s->fsel[51] == 4) /* SD_DATA1_R */
+            && (s->fsel[52] == 4) /* SD_DATA2_R */
+            && (s->fsel[53] == 4) /* SD_DATA3_R */
+            ) {
+        /* SDHost controller selected */
+        sdbus_reparent_card(s->sdbus_sdhci, s->sdbus_sdhost);
+        s->sd_fsel = 4;
+    }
+}
+
+static int gpfsel_is_out(BCM2835GpioState *s, int index)
+{
+    if (index >= 0 && index < 54) {
+        return s->fsel[index] == 1;
+    }
+    return 0;
+}
+
+static void gpset(BCM2835GpioState *s,
+        uint32_t val, uint8_t start, uint8_t count, uint32_t *lev)
+{
+    uint32_t changes = val & ~*lev;
+    uint32_t cur = 1;
+
+    int i;
+    for (i = 0; i < count; i++) {
+        if ((changes & cur) && (gpfsel_is_out(s, start + i))) {
+            qemu_set_irq(s->out[start + i], 1);
+        }
+        cur <<= 1;
+    }
+
+    *lev |= val;
+}
+
+static void gpclr(BCM2835GpioState *s,
+        uint32_t val, uint8_t start, uint8_t count, uint32_t *lev)
+{
+    uint32_t changes = val & *lev;
+    uint32_t cur = 1;
+
+    int i;
+    for (i = 0; i < count; i++) {
+        if ((changes & cur) && (gpfsel_is_out(s, start + i))) {
+            qemu_set_irq(s->out[start + i], 0);
+        }
+        cur <<= 1;
+    }
+
+    *lev &= ~val;
+}
+
+static uint64_t bcm2835_gpio_read(void *opaque, hwaddr offset,
+        unsigned size)
+{
+    BCM2835GpioState *s = (BCM2835GpioState *)opaque;
+
+    switch (offset) {
+    case GPFSEL0:
+    case GPFSEL1:
+    case GPFSEL2:
+    case GPFSEL3:
+    case GPFSEL4:
+    case GPFSEL5:
+        return gpfsel_get(s, offset / 4);
+    case GPSET0:
+    case GPSET1:
+        /* Write Only */
+        return 0;
+    case GPCLR0:
+    case GPCLR1:
+        /* Write Only */
+        return 0;
+    case GPLEV0:
+        return s->lev0;
+    case GPLEV1:
+        return s->lev1;
+    case GPEDS0:
+    case GPEDS1:
+    case GPREN0:
+    case GPREN1:
+    case GPFEN0:
+    case GPFEN1:
+    case GPHEN0:
+    case GPHEN1:
+    case GPLEN0:
+    case GPLEN1:
+    case GPAREN0:
+    case GPAREN1:
+    case GPAFEN0:
+    case GPAFEN1:
+    case GPPUD:
+    case GPPUDCLK0:
+    case GPPUDCLK1:
+        /* Not implemented */
+        return 0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+                __func__, offset);
+        break;
+    }
+
+    return 0;
+}
+
+static void bcm2835_gpio_write(void *opaque, hwaddr offset,
+        uint64_t value, unsigned size)
+{
+    BCM2835GpioState *s = (BCM2835GpioState *)opaque;
+
+    switch (offset) {
+    case GPFSEL0:
+    case GPFSEL1:
+    case GPFSEL2:
+    case GPFSEL3:
+    case GPFSEL4:
+    case GPFSEL5:
+        gpfsel_set(s, offset / 4, value);
+        break;
+    case GPSET0:
+        gpset(s, value, 0, 32, &s->lev0);
+        break;
+    case GPSET1:
+        gpset(s, value, 32, 22, &s->lev1);
+        break;
+    case GPCLR0:
+        gpclr(s, value, 0, 32, &s->lev0);
+        break;
+    case GPCLR1:
+        gpclr(s, value, 32, 22, &s->lev1);
+        break;
+    case GPLEV0:
+    case GPLEV1:
+        /* Read Only */
+        break;
+    case GPEDS0:
+    case GPEDS1:
+    case GPREN0:
+    case GPREN1:
+    case GPFEN0:
+    case GPFEN1:
+    case GPHEN0:
+    case GPHEN1:
+    case GPLEN0:
+    case GPLEN1:
+    case GPAREN0:
+    case GPAREN1:
+    case GPAFEN0:
+    case GPAFEN1:
+    case GPPUD:
+    case GPPUDCLK0:
+    case GPPUDCLK1:
+        /* Not implemented */
+        break;
+    default:
+        goto err_out;
+    }
+    return;
+
+err_out:
+    qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+            __func__, offset);
+}
+
+static void bcm2835_gpio_reset(DeviceState *dev)
+{
+    BCM2835GpioState *s = BCM2835_GPIO(dev);
+
+    int i;
+    for (i = 0; i < 6; i++) {
+        gpfsel_set(s, i, 0);
+    }
+
+    s->sd_fsel = 0;
+
+    /* SDHCI is selected by default */
+    sdbus_reparent_card(&s->sdbus, s->sdbus_sdhci);
+
+    s->lev0 = 0;
+    s->lev1 = 0;
+}
+
+static const MemoryRegionOps bcm2835_gpio_ops = {
+    .read = bcm2835_gpio_read,
+    .write = bcm2835_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_bcm2835_gpio = {
+    .name = "bcm2835_gpio",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8_ARRAY(fsel, BCM2835GpioState, 54),
+        VMSTATE_UINT32(lev0, BCM2835GpioState),
+        VMSTATE_UINT32(lev1, BCM2835GpioState),
+        VMSTATE_UINT8(sd_fsel, BCM2835GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_gpio_init(Object *obj)
+{
+    BCM2835GpioState *s = BCM2835_GPIO(obj);
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
+                        TYPE_SD_BUS, DEVICE(s), "sd-bus");
+
+    memory_region_init_io(&s->iomem, obj,
+            &bcm2835_gpio_ops, s, "bcm2835_gpio", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    qdev_init_gpio_out(dev, s->out, 54);
+}
+
+static void bcm2835_gpio_realize(DeviceState *dev, Error **errp)
+{
+    BCM2835GpioState *s = BCM2835_GPIO(dev);
+    Object *obj;
+    Error *err = NULL;
+
+    obj = object_property_get_link(OBJECT(dev), "sdbus-sdhci", &err);
+    if (obj == NULL) {
+        error_setg(errp, "%s: required sdhci link not found: %s",
+                __func__, error_get_pretty(err));
+        return;
+    }
+    s->sdbus_sdhci = SD_BUS(obj);
+
+    obj = object_property_get_link(OBJECT(dev), "sdbus-sdhost", &err);
+    if (obj == NULL) {
+        error_setg(errp, "%s: required sdhost link not found: %s",
+                __func__, error_get_pretty(err));
+        return;
+    }
+    s->sdbus_sdhost = SD_BUS(obj);
+}
+
+static void bcm2835_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_bcm2835_gpio;
+    dc->realize = &bcm2835_gpio_realize;
+    dc->reset = &bcm2835_gpio_reset;
+}
+
+static const TypeInfo bcm2835_gpio_info = {
+    .name          = TYPE_BCM2835_GPIO,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835GpioState),
+    .instance_init = bcm2835_gpio_init,
+    .class_init    = bcm2835_gpio_class_init,
+};
+
+static void bcm2835_gpio_register_types(void)
+{
+    type_register_static(&bcm2835_gpio_info);
+}
+
+type_init(bcm2835_gpio_register_types)
-- 
2.7.4

From: Clement Deschamps <clement.deschamps@antfield.fr>

This adds the bcm2835_sdhost and bcm2835_gpio to the BCM2835 platform.

For supporting the SD controller selection (alternate function of GPIOs
48-53), the bcm2835_gpio now exposes an sdbus.
It also has a link to both the sdbus of sdhci and sdhost controllers,
and the card is reparented from one bus to another when the alternate
function of GPIOs 48-53 is modified.

Signed-off-by: Clement Deschamps <clement.deschamps@antfield.fr>
Message-id: 20170224164021.9066-5-clement.deschamps@antfield.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h |  4 ++++
 hw/arm/bcm2835_peripherals.c         | 43 ++++++++++++++++++++++++++++++++++--
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/bcm2835_rng.h"
 #include "hw/misc/bcm2835_mbox.h"
 #include "hw/sd/sdhci.h"
+#include "hw/sd/bcm2835_sdhost.h"
+#include "hw/gpio/bcm2835_gpio.h"
 
 #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
 #define BCM2835_PERIPHERALS(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
     BCM2835RngState rng;
     BCM2835MboxState mboxes;
     SDHCIState sdhci;
+    BCM2835SDHostState sdhost;
+    BCM2835GpioState gpio;
 } BCM2835PeripheralState;
 
 #endif /* BCM2835_PERIPHERALS_H */
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
     object_property_add_child(obj, "sdhci", OBJECT(&s->sdhci), NULL);
     qdev_set_parent_bus(DEVICE(&s->sdhci), sysbus_get_default());
 
+    /* SDHOST */
+    object_initialize(&s->sdhost, sizeof(s->sdhost), TYPE_BCM2835_SDHOST);
+    object_property_add_child(obj, "sdhost", OBJECT(&s->sdhost), NULL);
+    qdev_set_parent_bus(DEVICE(&s->sdhost), sysbus_get_default());
+
     /* DMA Channels */
     object_initialize(&s->dma, sizeof(s->dma), TYPE_BCM2835_DMA);
     object_property_add_child(obj, "dma", OBJECT(&s->dma), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
 
     object_property_add_const_link(OBJECT(&s->dma), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr), &error_abort);
+
+    /* GPIO */
+    object_initialize(&s->gpio, sizeof(s->gpio), TYPE_BCM2835_GPIO);
+    object_property_add_child(obj, "gpio", OBJECT(&s->gpio), NULL);
+    qdev_set_parent_bus(DEVICE(&s->gpio), sysbus_get_default());
+
+    object_property_add_const_link(OBJECT(&s->gpio), "sdbus-sdhci",
+                                   OBJECT(&s->sdhci.sdbus), &error_abort);
+    object_property_add_const_link(OBJECT(&s->gpio), "sdbus-sdhost",
+                                   OBJECT(&s->sdhost.sdbus), &error_abort);
 }
 
 static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
                                INTERRUPT_ARASANSDIO));
-    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->sdhci), "sd-bus",
-                              &err);
+
+    /* SDHOST */
+    object_property_set_bool(OBJECT(&s->sdhost), true, "realized", &err);
     if (err) {
         error_propagate(errp, err);
         return;
     }
 
+    memory_region_add_subregion(&s->peri_mr, MMCI0_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhost), 0));
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhost), 0,
+        qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
+                               INTERRUPT_SDIO));
+
     /* DMA Channels */
     object_property_set_bool(OBJECT(&s->dma), true, "realized", &err);
     if (err) {
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
                                                   BCM2835_IC_GPU_IRQ,
                                                   INTERRUPT_DMA0 + n));
     }
+
+    /* GPIO */
+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    memory_region_add_subregion(&s->peri_mr, GPIO_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->gpio), 0));
+
+    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->gpio), "sd-bus",
+                              &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
 }
 
 static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

Without any clock controller, the Linux kernel was hitting division by
zero during boot or with clk_summary:
[    0.000000] [<c031054c>] (unwind_backtrace) from [<c030ba6c>] (show_stack+0x10/0x14)
[    0.000000] [<c030ba6c>] (show_stack) from [<c05b2660>] (dump_stack+0x88/0x9c)
[    0.000000] [<c05b2660>] (dump_stack) from [<c05b11a4>] (Ldiv0+0x8/0x10)
[    0.000000] [<c05b11a4>] (Ldiv0) from [<c06ad1e0>] (samsung_pll45xx_recalc_rate+0x58/0x74)
[    0.000000] [<c06ad1e0>] (samsung_pll45xx_recalc_rate) from [<c0692ec0>] (clk_register+0x39c/0x63c)
[    0.000000] [<c0692ec0>] (clk_register) from [<c125d360>] (samsung_clk_register_pll+0x2e0/0x3d4)
[    0.000000] [<c125d360>] (samsung_clk_register_pll) from [<c125d7e8>] (exynos4_clk_init+0x1b0/0x5e4)
[    0.000000] [<c125d7e8>] (exynos4_clk_init) from [<c12335f4>] (of_clk_init+0x17c/0x210)
[    0.000000] [<c12335f4>] (of_clk_init) from [<c1204700>] (time_init+0x24/0x2c)
[    0.000000] [<c1204700>] (time_init) from [<c1200b2c>] (start_kernel+0x24c/0x38c)
[    0.000000] [<c1200b2c>] (start_kernel) from [<4020807c>] (0x4020807c)

Provide stub for clock controller returning reset values for PLLs.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Message-id: 20170226200142.31169-1-krzk@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs    |   2 +-
 hw/arm/exynos4210.c      |   6 ++
 hw/misc/exynos4210_clk.c | 164 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 171 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/exynos4210_clk.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
 obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 obj-$(CONFIG_NSERIES) += cbus.o
 obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o
+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
 obj-$(CONFIG_IMX) += imx_ccm.o
 obj-$(CONFIG_IMX) += imx31_ccm.o
 obj-$(CONFIG_IMX) += imx25_ccm.o
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
+#include "qemu/log.h"
 #include "cpu.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@
 /* PMU SFR base address */
 #define EXYNOS4210_PMU_BASE_ADDR            0x10020000
 
+/* Clock controller SFR base address */
+#define EXYNOS4210_CLK_BASE_ADDR            0x10030000
+
 /* Display controllers (FIMD) */
 #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
 
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
     */
     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
 
+    sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
+
     /* PWM */
     sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
                           s->irq_table[exynos4210_get_irq(22, 0)],
diff --git a/hw/misc/exynos4210_clk.c b/hw/misc/exynos4210_clk.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/exynos4210_clk.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  Exynos4210 Clock Controller Emulation
+ *
+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the
+ *  Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "qemu/log.h"
+
+#define TYPE_EXYNOS4210_CLK             "exynos4210.clk"
+#define EXYNOS4210_CLK(obj) \
+    OBJECT_CHECK(Exynos4210ClkState, (obj), TYPE_EXYNOS4210_CLK)
+
+#define CLK_PLL_LOCKED                  BIT(29)
+
+#define EXYNOS4210_CLK_REGS_MEM_SIZE    0x15104
+
+typedef struct Exynos4210Reg {
+    const char   *name; /* for debug only */
+    uint32_t     offset;
+    uint32_t     reset_value;
+} Exynos4210Reg;
+
+/* Clock controller register base: 0x10030000 */
+static const Exynos4210Reg exynos4210_clk_regs[] = {
+    {"EPLL_LOCK",                     0xc010, 0x00000fff},
+    {"VPLL_LOCK",                     0xc020, 0x00000fff},
+    {"EPLL_CON0",                     0xc110, 0x00300301 | CLK_PLL_LOCKED},
+    {"EPLL_CON1",                     0xc114, 0x00000000},
+    {"VPLL_CON0",                     0xc120, 0x00240201 | CLK_PLL_LOCKED},
+    {"VPLL_CON1",                     0xc124, 0x66010464},
+    {"APLL_LOCK",                    0x14000, 0x00000fff},
+    {"MPLL_LOCK",                    0x14004, 0x00000fff},
+    {"APLL_CON0",                    0x14100, 0x00c80601 | CLK_PLL_LOCKED},
+    {"APLL_CON1",                    0x14104, 0x0000001c},
+    {"MPLL_CON0",                    0x14108, 0x00c80601 | CLK_PLL_LOCKED},
+    {"MPLL_CON1",                    0x1410c, 0x0000001c},
+};
+
+#define EXYNOS4210_REGS_NUM       ARRAY_SIZE(exynos4210_clk_regs)
+
+typedef struct Exynos4210ClkState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    uint32_t reg[EXYNOS4210_REGS_NUM];
+} Exynos4210ClkState;
+
+static uint64_t exynos4210_clk_read(void *opaque, hwaddr offset,
+                                    unsigned size)
+{
+    const Exynos4210ClkState *s = (Exynos4210ClkState *)opaque;
+    const Exynos4210Reg *regs = exynos4210_clk_regs;
+    unsigned int i;
+
+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
+        if (regs->offset == offset) {
+            return s->reg[i];
+        }
+        regs++;
+    }
+    qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read offset 0x%04x\n",
+                  __func__, (uint32_t)offset);
+    return 0;
+}
+
+static void exynos4210_clk_write(void *opaque, hwaddr offset,
+                                 uint64_t val, unsigned size)
+{
+    Exynos4210ClkState *s = (Exynos4210ClkState *)opaque;
+    const Exynos4210Reg *regs = exynos4210_clk_regs;
+    unsigned int i;
+
+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
+        if (regs->offset == offset) {
+            s->reg[i] = val;
+            return;
+        }
+        regs++;
+    }
+    qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write offset 0x%04x\n",
+                  __func__, (uint32_t)offset);
+}
+
+static const MemoryRegionOps exynos4210_clk_ops = {
+    .read = exynos4210_clk_read,
+    .write = exynos4210_clk_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false
+    }
+};
+
+static void exynos4210_clk_reset(DeviceState *dev)
+{
+    Exynos4210ClkState *s = EXYNOS4210_CLK(dev);
+    unsigned int i;
+
+    /* Set default values for registers */
+    for (i = 0; i < EXYNOS4210_REGS_NUM; i++) {
+        s->reg[i] = exynos4210_clk_regs[i].reset_value;
+    }
+}
+
+static void exynos4210_clk_init(Object *obj)
+{
+    Exynos4210ClkState *s = EXYNOS4210_CLK(obj);
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+
+    /* memory mapping */
+    memory_region_init_io(&s->iomem, obj, &exynos4210_clk_ops, s,
+                          TYPE_EXYNOS4210_CLK, EXYNOS4210_CLK_REGS_MEM_SIZE);
+    sysbus_init_mmio(dev, &s->iomem);
+}
+
+static const VMStateDescription exynos4210_clk_vmstate = {
+    .name = TYPE_EXYNOS4210_CLK,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(reg, Exynos4210ClkState, EXYNOS4210_REGS_NUM),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void exynos4210_clk_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = exynos4210_clk_reset;
+    dc->vmsd = &exynos4210_clk_vmstate;
+}
+
+static const TypeInfo exynos4210_clk_info = {
+    .name          = TYPE_EXYNOS4210_CLK,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210ClkState),
+    .instance_init = exynos4210_clk_init,
+    .class_init    = exynos4210_clk_class_init,
+};
+
+static void exynos4210_clk_register(void)
+{
+    qemu_log_mask(LOG_GUEST_ERROR, "Clock init\n");
+    type_register_static(&exynos4210_clk_info);
+}
+
+type_init(exynos4210_clk_register)
-- 
2.7.4

From: Krzysztof Kozlowski <krzk@kernel.org>

The Exynos4210 has cluster ID 0x9 in its MPIDR register (raw value
0x8000090x).  If this cluster ID is not provided, then Linux kernel
cannot map DeviceTree nodes to MPIDR values resulting in kernel
warning and lack of any secondary CPUs:

DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map
    ...
    smp: Bringing up secondary CPUs ...
    smp: Brought up 1 node, 1 CPU
    SMP: Total of 1 processors activated (24.00 BogoMIPS).

Provide a cluster ID so Linux will see proper MPIDR and will try to
bring the secondary CPU online.

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Message-id: 20170226200142.31169-2-krzk@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
                        info->smp_loader_start);
 }
 
+static uint64_t exynos4210_calc_affinity(int cpu)
+{
+    uint64_t mp_affinity;
+
+    /* Exynos4210 has 0x9 as cluster ID */
+    mp_affinity = (0x9 << ARM_AFF1_SHIFT) | cpu;
+
+    return mp_affinity;
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
         unsigned long ram_size)
 {
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem,
         }
 
         s->cpu[n] = ARM_CPU(cpuobj);
+        object_property_set_int(cpuobj, exynos4210_calc_affinity(n),
+                                "mp-affinity", &error_abort);
         object_property_set_int(cpuobj, EXYNOS4210_SMP_PRIVATE_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(cpuobj, true, "realized", &error_fatal);
-- 
2.7.4

ARM bugfixes for rc1...

The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113

for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:

accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)

----------------------------------------------------------------
target-arm queue:
 * translate-a64.c: silence gcc5 warning
 * highbank: validate register offset before access
 * MAINTAINERS: Add entries for Smartfusion2
 * accel/tcg/translate-all: expand cpu_restore_state addr check
   (so usermode insn aborts don't crash with an assertion failure)
 * fix TCG initialization of some Arm boards by allowing them
   to specify min/default number of CPUs to create

----------------------------------------------------------------
Alex Bennée (1):
      accel/tcg/translate-all: expand cpu_restore_state addr check

Alistair Francis (2):
      xlnx-zynqmp: Properly support the smp command line option
      xlnx-zcu102: Add an info message deprecating the EP108

Emilio G. Cota (4):
      arm/translate-a64: mark path as unreachable to eliminate warning
      qom: move CPUClass.tcg_initialize to a global
      xlnx-zcu102: Specify the max number of CPUs for the EP108
      hw: add .min_cpus and .default_cpus fields to machine_class

Prasad J Pandit (1):
      highbank: validate register offset before access

Subbaraya Sundeep (1):
      MAINTAINERS: Add entries for Smartfusion2

From: "Emilio G. Cota" <cota@braap.org>

Fixes the following warning when compiling with gcc 5.4.0 with -O1
optimizations and --enable-debug:

target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (!post_index) {
        ^
target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
     bool post_index;
          ^
target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (writeback) {
        ^
target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
     bool writeback;
          ^

Note that idx comes from selecting 2 bits, and therefore its value
can be at most 3.

Signed-off-by: Emilio G. Cota <cota@braap.org>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 ++
 1 file changed, 2 insertions(+)

From: Prasad J Pandit <pjp@fedoraproject.org>

An 'offset' parameter sent to highbank register r/w functions
could be greater than number(NUM_REGS=0x200) of hb registers,
leading to an OOB access issue. Add check to avoid it.

Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171113062658.9697-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/highbank.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/ide/ahci.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/cpu/a15mpcore.h"
+#include "qemu/log.h"
 
 #define SMP_BOOT_ADDR           0x100
 #define SMP_BOOT_REG            0x40
@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
         }
     }
 
-    regs[offset/4] = value;
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
+        return;
+    }
+    regs[offset / 4] = value;
 }
 
 static uint64_t hb_regs_read(void *opaque, hwaddr offset,
                              unsigned size)
 {
+    uint32_t value;
     uint32_t *regs = opaque;
-    uint32_t value = regs[offset/4];
+
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
+        return 0;
+    }
+    value = regs[offset / 4];
 
     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
         value |= 0x30000000;
-- 
2.7.4

From: Subbaraya Sundeep <sundeep.lkml@gmail.com>

Voluntarily add myself as maintainer for Smartfusion2

Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/arm/netduino2.c
 
+SmartFusion2
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-soc.c
+F: hw/misc/msf2-sysreg.c
+F: hw/timer/mss-timer.c
+F: hw/ssi/mss-spi.c
+F: include/hw/arm/msf2-soc.h
+F: include/hw/misc/msf2-sysreg.h
+F: include/hw/timer/mss-timer.h
+F: include/hw/ssi/mss-spi.h
+
+Emcraft M2S-FG484
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-som.c
+
 CRIS Machines
 -------------
 Axis Dev88
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

55c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
introduces a per-CPUClass bool that we check so that the target CPU
is initialized for TCG only once. This works well except when
we end up creating more than one CPUClass, in which case we end
up incorrectly initializing TCG more than once, i.e. once for
each CPUClass.

This can be replicated with:
  $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
      -global driver=xlnx,,zynqmp,property=has_rpu,value=on
In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
whereas the "regular" CPUs are prefixed by "cortex-a53-". This
results in two CPUClass instances being created.

Fix it by introducing a static variable, so that only the first
target CPU being initialized will initialize the target-dependent
part of TCG, regardless of CPUClass instances.

Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
Signed-off-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qom/cpu.h | 1 -
 exec.c            | 5 +++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
-    bool tcg_initialized;
 } CPUClass;
 
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
+    static bool tcg_target_initialized;
 
     cpu_list_add(cpu);
 
-    if (tcg_enabled() && !cc->tcg_initialized) {
-        cc->tcg_initialized = true;
+    if (tcg_enabled() && !tcg_target_initialized) {
+        tcg_target_initialized = true;
         cc->tcg_initialize();
     }
 
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Allow the -smp command line option to control the number of CPUs we
create.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Tested-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c |  3 ++-
 hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->desc = "Xilinx ZynqMP ZCU102 board";
+    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
+               "the value of smp";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
 {
     Error *err = NULL;
     int i;
+    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
+    for (i = 0; i < num_rpus; i++) {
         char *name;
 
         object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
 {
     XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
     int i;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                           "cortex-a53-" TYPE_ARM_CPU);
         object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     MemoryRegion *system_memory = get_system_memory();
     uint8_t i;
     uint64_t ram_size;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
     const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
     ram_addr_t ddr_low_size, ddr_high_size;
     qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
     qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
-    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
 
     /* Realize APUs before realizing the GIC. KVM requires this.  */
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         char *name;
 
         object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         qemu_irq irq;
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->has_rpu) {
-        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
-        if (err) {
-            error_propagate(errp, err);
-            return;
-        }
+        info_report("The 'has_rpu' property is no longer required, to use the "
+                    "RPUs just use -smp 6.");
+    }
+
+    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
     }
 
     if (!s->boot_cpu_ptr) {
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 was an early access development board that is no longer used.
Add an info message to convert any users to the ZCU102 instead. On QEMU
they are both identical.

This patch also updated the qemu-doc.texi file to indicate that the
EP108 has been deprecated.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 3 +++
 qemu-doc.texi        | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 {
     XlnxZCU102 *s = EP108_MACHINE(machine);
 
+    info_report("The Xilinx EP108 machine is deprecated, please use the "
+                "ZCU102 machine instead. It has the same features supported.");
+
     xlnx_zynqmp_init(s, machine);
 }
 
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
 The ``spapr-pci-vfio-host-bridge'' device type is replaced by
 the ``spapr-pci-host-bridge'' device type.
 
+@section System emulator machines
+
+@subsection Xilinx EP108 (since 2.11.0)
+
+The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
+The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
+
 @node License
 @appendix License
 
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

max_cpus needs to be an upper bound on the number of vCPUs
initialized; otherwise TCG region initialization breaks.

Some boards initialize a hard-coded number of vCPUs, which is not
captured by the global max_cpus and therefore breaks TCG initialization.
Fix it by adding the .min_cpus field to machine_class.

This commit also changes some user-facing behaviour: we now die if
-smp is below this hard-coded vCPU minimum instead of silently
ignoring the passed -smp value (sometimes announcing this by printing
a warning). However, the introduction of .default_cpus lessens the
likelihood that users will notice this: if -smp isn't set, we now
assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
if a user does not set -smp, they always get a correct number of vCPUs.

This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
softmmu", 2017-10-24), which broke TCG initialization for some
ARM boards.

Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/boards.h     |  5 +++++
 hw/arm/exynos4_boards.c | 12 ++++--------
 hw/arm/raspi.c          |  2 ++
 hw/arm/xlnx-zcu102.c    |  2 ++
 vl.c                    | 21 ++++++++++++++++++---
 5 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 /**
  * MachineClass:
+ * @max_cpus: maximum number of CPUs supported. Default: 1
+ * @min_cpus: minimum number of CPUs supported. Default: 1
+ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
  * @get_hotplug_handler: this function is called during bus-less
  *    device hotplug. If defined it returns pointer to an instance
  *    of HotplugHandler object, which handles hotplug operation
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
     BlockInterfaceType block_default_type;
     int units_per_default_bus;
     int max_cpus;
+    int min_cpus;
+    int default_cpus;
     unsigned int no_serial:1,
         no_parallel:1,
         use_virtcon:1,
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/qtest.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
                            Exynos4BoardType board_type)
 {
     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-
-    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
-                     " value",
-                     mc->name, EXYNOS4210_NCPUS);
-    }
 
     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung NURI board (Exynos4210)";
     mc->init = nuri_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
     mc->init = smdkc210_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->max_cpus = BCM2836_NCPUS;
+    mc->min_cpus = BCM2836_NCPUS;
+    mc->default_cpus = BCM2836_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
 Chardev *sclp_hds[MAX_SCLP_CONSOLES];
 int win2k_install_hack = 0;
 int singlestep = 0;
-int smp_cpus = 1;
-unsigned int max_cpus = 1;
+int smp_cpus;
+unsigned int max_cpus;
 int smp_cores = 1;
 int smp_threads = 1;
 int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         exit(0);
     }
 
+    /* machine_class: default to UP */
+    machine_class->max_cpus = machine_class->max_cpus ?: 1;
+    machine_class->min_cpus = machine_class->min_cpus ?: 1;
+    machine_class->default_cpus = machine_class->default_cpus ?: 1;
+
+    /* default to machine_class->default_cpus */
+    smp_cpus = machine_class->default_cpus;
+    max_cpus = machine_class->default_cpus;
+
     smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 
-    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
+    /* sanity-check smp_cpus and max_cpus against machine_class */
+    if (smp_cpus < machine_class->min_cpus) {
+        error_report("Invalid SMP CPUs %d. The min CPUs "
+                     "supported by machine '%s' is %d", smp_cpus,
+                     machine_class->name, machine_class->min_cpus);
+        exit(1);
+    }
     if (max_cpus > machine_class->max_cpus) {
         error_report("Invalid SMP CPUs %d. The max CPUs "
                      "supported by machine '%s' is %d", max_cpus,
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

We are still seeing signals during translation time when we walk over
a page protection boundary. This expands the check to ensure the host
PC is inside the code generation buffer. The original suggestion was
to check versus tcg_ctx.code_gen_ptr but as we now segment the
translation buffer we have to settle for just a general check for
being inside.

I've also fixed up the declaration to make it clear it can deal with
invalid addresses. A later patch will fix up the call sites.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/exec-all.h   | 11 ++++++++++
 accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
 2 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
                           target_ulong *data);
 
 void cpu_gen_init(void);
+
+/**
+ * cpu_restore_state:
+ * @cpu: the vCPU state is to be restore to
+ * @searched_pc: the host PC the fault occurred at
+ * @return: true if state was restored, false otherwise
+ *
+ * Attempt to restore the state for a fault occurring in translated
+ * code. If the searched_pc is not in translated code no state is
+ * restored and the function returns false.
+ */
 bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
 
 void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
     return 0;
 }
 
-bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
 {
     TranslationBlock *tb;
     bool r = false;
+    uintptr_t check_offset;
 
-    /* A retaddr of zero is invalid so we really shouldn't have ended
-     * up here. The target code has likely forgotten to check retaddr
-     * != 0 before attempting to restore state. We return early to
-     * avoid blowing up on a recursive tb_lock(). The target must have
-     * previously survived a failed cpu_restore_state because
-     * tb_find_pc(0) would have failed anyway. It still should be
-     * fixed though.
+    /* The host_pc has to be in the region of current code buffer. If
+     * it is not we will not be able to resolve it here. The two cases
+     * where host_pc will not be correct are:
+     *
+     *  - fault during translation (instruction fetch)
+     *  - fault from helper (not using GETPC() macro)
+     *
+     * Either way we need return early to avoid blowing up on a
+     * recursive tb_lock() as we can't resolve it here.
+     *
+     * We are using unsigned arithmetic so if host_pc <
+     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
+     * above the code_gen_buffer_size
      */
-
-    if (!retaddr) {
-        return r;
-    }
-
-    tb_lock();
-    tb = tb_find_pc(retaddr);
-    if (tb) {
-        cpu_restore_state_from_tb(cpu, tb, retaddr);
-        if (tb->cflags & CF_NOCACHE) {
-            /* one-shot translation, invalidate it immediately */
-            tb_phys_invalidate(tb, -1);
-            tb_remove(tb);
+    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
+
+    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
+        tb_lock();
+        tb = tb_find_pc(host_pc);
+        if (tb) {
+            cpu_restore_state_from_tb(cpu, tb, host_pc);
+            if (tb->cflags & CF_NOCACHE) {
+                /* one-shot translation, invalidate it immediately */
+                tb_phys_invalidate(tb, -1);
+                tb_remove(tb);
+            }
+            r = true;
         }
-        r = true;
+        tb_unlock();
     }
-    tb_unlock();
 
     return r;
 }
-- 
2.7.4