Series comparison

-[Qemu-devel] [PULL 00/18] target-arm queue
+[Qemu-devel] [PULL 00/25] target-arm queue
-ARM queue for 2.10 soft freeze...
+target-arm queue. This has the "plumb txattrs through various
 bits of exec.c" patches, and a collection of bug fixes from
 various people.
 thanks
 -- PMM
-The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:
-  Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)
-are available in the git repository at:
+The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170717
+  Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)
-for you to fetch changes up to e5a6a6e64e82a132cebef023d867085b0a2993d7:
+are available in the Git repository at:
-  MAINTAINERS: Add entries for MPS2 board (2017-07-17 13:36:09 +0100)
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531
 for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:
   KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * new model of the ARM MPS2/MPS2+ FPGA based development board
+ * target/arm: Honour FPCR.FZ in FRECPX
- * clean up DISAS_* exit conditions and fix various regressions
+ * MAINTAINERS: Add entries for newer MPS2 boards and devices
-   since commits e75449a346 8a6b28c7b5 (in particular including
+ * hw/intc/arm_gicv3: Fix APxR<n> register dispatching
-   ones which broke OP-TEE guests)
+ * arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel
- * make Cortex-M3 and M4 correctly default to 8 PMSA regions
+   GIC state
  * tcg: Fix helper function vs host abi for float16
  * arm: fix qemu crash on startup with -bios option
  * arm: fix malloc type mismatch
  * xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
  * Correct CPACR reset value for v7 cores
  * memory.h: Improve IOMMU related documentation
  * exec: Plumb transaction attributes through various functions in
    preparation for allowing IOMMUs to see them
  * vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
  * ARM: ACPI: Fix use-after-free due to memory realloc
  * KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice
 ----------------------------------------------------------------
-Alex Bennée (6):
+Francisco Iglesias (1):
-      include/exec/exec-all: document common exit conditions
+      xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
       target/arm/translate: make DISAS_UPDATE match declared semantics
       target/arm/translate.h: expand comment on DISAS_EXIT
       target/arm/translate: ensure gen_goto_tb sets exit flags
       target/arm: use gen_goto_tb for ISB handling
       target/arm: use DISAS_EXIT for eret handling
-Peter Maydell (12):
+Igor Mammedov (1):
-      qdev-properties.h: Explicitly set the default value for arraylen properties
+      arm: fix qemu crash on startup with -bios option
       qdev: support properties which don't set a default value
       target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions
       hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models
       hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART
       hw/arm/mps2: Add UARTs
       hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device
       hw/arm/mps2: Add timers
       hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller
       hw/arm/mps2: Add SCC
       hw/arm/mps2: Add ethernet
       MAINTAINERS: Add entries for MPS2 board
- hw/arm/Makefile.objs               |   1 +
+Jan Kiszka (1):
- hw/char/Makefile.objs              |   1 +
+      hw/intc/arm_gicv3: Fix APxR<n> register dispatching
  hw/misc/Makefile.objs              |   1 +
  hw/timer/Makefile.objs             |   1 +
  include/exec/exec-all.h            |  29 ++-
  include/hw/char/cmsdk-apb-uart.h   |  78 +++++++
  include/hw/misc/mps2-scc.h         |  43 ++++
  include/hw/qdev-core.h             |  10 +
  include/hw/qdev-properties.h       |  21 ++
  include/hw/timer/cmsdk-apb-timer.h |  59 ++++++
  target/arm/translate.h             |   5 +-
  hw/arm/mps2.c                      | 385 +++++++++++++++++++++++++++++++++++
  hw/char/cmsdk-apb-uart.c           | 403 +++++++++++++++++++++++++++++++++++++
  hw/core/qdev.c                     |   2 +-
  hw/misc/mps2-scc.c                 | 310 ++++++++++++++++++++++++++++
  hw/timer/cmsdk-apb-timer.c         | 253 +++++++++++++++++++++++
  target/arm/cpu.c                   |  12 +-
  target/arm/translate-a64.c         |  19 +-
  target/arm/translate.c             |  22 +-
  MAINTAINERS                        |  14 +-
  default-configs/arm-softmmu.mak    |   6 +
  hw/char/trace-events               |   9 +
  hw/misc/trace-events               |   8 +
  hw/timer/trace-events              |   5 +
 files changed, 1673 insertions(+), 24 deletions(-)
  create mode 100644 include/hw/char/cmsdk-apb-uart.h
  create mode 100644 include/hw/misc/mps2-scc.h
  create mode 100644 include/hw/timer/cmsdk-apb-timer.h
  create mode 100644 hw/arm/mps2.c
  create mode 100644 hw/char/cmsdk-apb-uart.c
  create mode 100644 hw/misc/mps2-scc.c
  create mode 100644 hw/timer/cmsdk-apb-timer.c
+Paolo Bonzini (1):
+      arm: fix malloc type mismatch
+Peter Maydell (17):
+      target/arm: Honour FPCR.FZ in FRECPX
+      MAINTAINERS: Add entries for newer MPS2 boards and devices
+      Correct CPACR reset value for v7 cores
+      memory.h: Improve IOMMU related documentation
+      Make tb_invalidate_phys_addr() take a MemTxAttrs argument
+      Make address_space_translate{, _cached}() take a MemTxAttrs argument
+      Make address_space_map() take a MemTxAttrs argument
+      Make address_space_access_valid() take a MemTxAttrs argument
+      Make flatview_extend_translation() take a MemTxAttrs argument
+      Make memory_region_access_valid() take a MemTxAttrs argument
+      Make MemoryRegion valid.accepts callback take a MemTxAttrs argument
+      Make flatview_access_valid() take a MemTxAttrs argument
+      Make flatview_translate() take a MemTxAttrs argument
+      Make address_space_get_iotlb_entry() take a MemTxAttrs argument
+      Make flatview_do_translate() take a MemTxAttrs argument
+      Make address_space_translate_iommu take a MemTxAttrs argument
+      vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
+Richard Henderson (1):
+      tcg: Fix helper function vs host abi for float16
+Shannon Zhao (3):
+      arm_gicv3_kvm: increase clroffset accordingly
+      ARM: ACPI: Fix use-after-free due to memory realloc
+      KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice
+ include/exec/exec-all.h        |   5 +-
+ include/exec/helper-head.h     |   2 +-
+ include/exec/memory-internal.h |   3 +-
+ include/exec/memory.h          | 128 +++++++++++++++++++++++++++++++++++------
+ include/migration/vmstate.h    |   3 +
+ include/sysemu/dma.h           |   6 +-
+ accel/tcg/translate-all.c      |   4 +-
+ exec.c                         |  95 ++++++++++++++++++------------
+ hw/arm/boot.c                  |  18 +++---
+ hw/arm/virt-acpi-build.c       |  20 +++++--
+ hw/dma/xlnx-zdma.c             |  10 +++-
+ hw/hppa/dino.c                 |   3 +-
+ hw/intc/arm_gic_kvm.c          |   1 -
+ hw/intc/arm_gicv3_cpuif.c      |  12 ++--
+ hw/intc/arm_gicv3_kvm.c        |   2 +-
+ hw/nvram/fw_cfg.c              |  12 ++--
+ hw/s390x/s390-pci-inst.c       |   3 +-
+ hw/scsi/esp.c                  |   3 +-
+ hw/vfio/common.c               |   3 +-
+ hw/virtio/vhost.c              |   3 +-
+ hw/xen/xen_pt_msi.c            |   3 +-
+ memory.c                       |  12 ++--
+ memory_ldst.inc.c              |  18 +++---
+ target/arm/gdbstub.c           |   3 +-
+ target/arm/helper-a64.c        |  41 +++++++------
+ target/arm/helper.c            |  90 ++++++++++++++++-------------
+ target/ppc/mmu-hash64.c        |   3 +-
+ target/riscv/helper.c          |   2 +-
+ target/s390x/diag.c            |   6 +-
+ target/s390x/excp_helper.c     |   3 +-
+ target/s390x/mmu_helper.c      |   3 +-
+ target/s390x/sigp.c            |   3 +-
+ target/xtensa/op_helper.c      |   3 +-
+ MAINTAINERS                    |   9 ++-
+files changed, 353 insertions(+), 182 deletions(-)

-New patch
+[Qemu-devel] [PULL 01/25] target/arm: Honour FPCR.FZ in FRECPX
+The FRECPX instructions should (like most other floating point operations)
+honour the FPCR.FZ bit which specifies whether input denormals should
+be flushed to zero (or FZ16 for the half-precision version).
+We forgot to implement this, which doesn't affect the results (since
+the calculation doesn't actually care about the mantissa bits) but did
+mean we were failing to set the FPSR.IDC bit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180521172712.19930-1-peter.maydell@linaro.org
+---
+ target/arm/helper-a64.c | 6 ++++++
+file changed, 6 insertions(+)
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper-a64.c
++++ b/target/arm/helper-a64.c
+@@ -XXX,XX +XXX,XX @@ float16 HELPER(frecpx_f16)(float16 a, void *fpstp)
+         return nan;
+     }
++    a = float16_squash_input_denormal(a, fpst);
++
+     val16 = float16_val(a);
+     sbit = 0x8000 & val16;
+     exp = extract32(val16, 10, 5);
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)
+         return nan;
+     }
++    a = float32_squash_input_denormal(a, fpst);
++
+     val32 = float32_val(a);
+     sbit = 0x80000000ULL & val32;
+     exp = extract32(val32, 23, 8);
+@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)
+         return nan;
+     }
++    a = float64_squash_input_denormal(a, fpst);
++
+     val64 = float64_val(a);
+     sbit = 0x8000000000000000ULL & val64;
+     exp = extract64(float64_val(a), 52, 11);
+--
+.17.1

-[Qemu-devel] [PULL 18/18] MAINTAINERS: Add entries for MPS2 board
+[Qemu-devel] [PULL 02/25] MAINTAINERS: Add entries for newer MPS2 boards and devices
-Add entries to the MAINTAINERS file for the new MPS2
+Add entries to MAINTAINERS to cover the newer MPS2 boards and
-board and devices.
+the new devices they use.
 Since the CMSDK devices are not specific to the MPS2 board,
 extend the existing 'PrimeCell' section to cover CMSDK
 devices as well; in both cases these are devices implemented
 by ARM and provided as RTL that may be used in multiple
 SoCs and boards.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1500029487-14822-10-git-send-email-peter.maydell@linaro.org
+Message-id: 20180518153157.14899-1-peter.maydell@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- MAINTAINERS | 14 +++++++++++++-
+ MAINTAINERS | 9 +++++++--
-file changed, 13 insertions(+), 1 deletion(-)
+file changed, 7 insertions(+), 2 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: hw/*/allwinner*
+@@ -XXX,XX +XXX,XX @@ F: hw/timer/cmsdk-apb-timer.c
- F: include/hw/*/allwinner*
+ F: include/hw/timer/cmsdk-apb-timer.h
- F: hw/arm/cubieboard.c
+ F: hw/char/cmsdk-apb-uart.c
+ F: include/hw/char/cmsdk-apb-uart.h
--ARM PrimeCell
++F: hw/misc/tz-ppc.c
-+ARM PrimeCell and CMSDK devices
++F: include/hw/misc/tz-ppc.h
  ARM cores
  M: Peter Maydell <peter.maydell@linaro.org>
+@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
-@@ -XXX,XX +XXX,XX @@ F: hw/intc/pl190.c
+ F: hw/arm/mps2.c
- F: hw/sd/pl181.c
+-F: hw/misc/mps2-scc.c
- F: hw/timer/pl031.c
+-F: include/hw/misc/mps2-scc.h
- F: include/hw/arm/primecell.h
++F: hw/arm/mps2-tz.c
-+F: hw/timer/cmsdk-apb-timer.c
++F: hw/misc/mps2-*.c
-+F: include/hw/timer/cmsdk-apb-timer.h
++F: include/hw/misc/mps2-*.h
-+F: hw/char/cmsdk-apb-uart.c
++F: hw/arm/iotkit.c
-+F: include/hw/char/cmsdk-apb-uart.h
++F: include/hw/arm/iotkit.h
  ARM cores
  M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ S: Maintained
  F: hw/arm/integratorcp.c
  F: hw/misc/arm_integrator_debug.c
 +MPS2
 +M: Peter Maydell <peter.maydell@linaro.org>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/arm/mps2.c
 +F: hw/misc/mps2-scc.c
 +F: include/hw/misc/mps2-scc.h
 +
  Musicpal
  M: Jan Kiszka <jan.kiszka@web.de>
- L: qemu-arm@nongnu.org
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 06/18] target/arm/translate.h: expand comment on DISAS_EXIT
+[Qemu-devel] [PULL 03/25] hw/intc/arm_gicv3: Fix APxR<n> register dispatching
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Jan Kiszka <jan.kiszka@siemens.com>
-We already have an exit condition, DISAS_UPDATE which will exit the
+There was a nasty flip in identifying which register group an access is
-run-loop. Expand on the difference with DISAS_EXIT in the comments.
+targeting. The issue caused spuriously raised priorities of the guest
 when handing CPUs over in the Jailhouse hypervisor.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Richard Henderson <rth@twiddle.net>
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
-Message-id: 20170713141928.25419-4-alex.bennee@linaro.org
+Message-id: 28b927d3-da58-bce4-cc13-bfec7f9b1cb9@siemens.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.h | 5 ++++-
+ hw/intc/arm_gicv3_cpuif.c | 12 ++++++------
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 6 insertions(+), 6 deletions(-)
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/target/arm/translate.h
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+@@ -XXX,XX +XXX,XX @@ static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
-  */
+ {
- #define DISAS_BX_EXCRET 11
+     GICv3CPUState *cs = icc_cs_from_env(env);
- /* For instructions which want an immediate exit to the main loop,
+     int regno = ri->opc2 & 3;
-- * as opposed to attempting to use lookup_and_goto_ptr.
+-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
-+ * as opposed to attempting to use lookup_and_goto_ptr. Unlike
++    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
-+ * DISAS_UPDATE this doesn't write the PC on exiting the translation
+     uint64_t value = cs->ich_apr[grp][regno];
-+ * loop so you need to ensure something (gen_a64_set_pc_im or runtime
-+ * helper) has done so before we reach return from cpu_tb_exec.
+     trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
-  */
+@@ -XXX,XX +XXX,XX @@ static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
- #define DISAS_EXIT 12
+ {
      GICv3CPUState *cs = icc_cs_from_env(env);
      int regno = ri->opc2 & 3;
 -    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
 +    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
      trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
@@ -XXX,XX +XXX,XX @@ static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
      uint64_t value;
      int regno = ri->opc2 & 3;
 -    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
 +    int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
      if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
          return icv_ap_read(env, ri);
@@ -XXX,XX +XXX,XX @@ static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
      GICv3CPUState *cs = icc_cs_from_env(env);
      int regno = ri->opc2 & 3;
 -    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
 +    int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
      if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
          icv_ap_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
      GICv3CPUState *cs = icc_cs_from_env(env);
      int regno = ri->opc2 & 3;
 -    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
 +    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
      uint64_t value;
      value = cs->ich_apr[grp][regno];
@@ -XXX,XX +XXX,XX @@ static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      GICv3CPUState *cs = icc_cs_from_env(env);
      int regno = ri->opc2 & 3;
 -    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
 +    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
      trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
 --
-.7.4
+.17.1

-New patch
+[Qemu-devel] [PULL 04/25] arm_gicv3_kvm: increase clroffset accordingly
+From: Shannon Zhao <zhaoshenglong@huawei.com>
+It forgot to increase clroffset during the loop. So it only clear the
+first 4 bytes.
+Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 1527047633-12368-1-git-send-email-zhaoshenglong@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/intc/arm_gicv3_kvm.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/arm_gicv3_kvm.c
++++ b/hw/intc/arm_gicv3_kvm.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,
+         if (clroffset != 0) {
+             reg = 0;
+             kvm_gicd_access(s, clroffset, &reg, true);
++            clroffset += 4;
+         }
+         reg = *gic_bmp_ptr32(bmp, irq);
+         kvm_gicd_access(s, offset, &reg, true);
+--
+.17.1

-New patch
+[Qemu-devel] [PULL 05/25] tcg: Fix helper function vs host abi for float16
+From: Richard Henderson <richard.henderson@linaro.org>
 Depending on the host abi, float16, aka uint16_t, values are
 passed and returned either zero-extended in the host register
 or with garbage at the top of the host register.
 The tcg code generator has so far been assuming garbage, as that
 matches the x86 abi, but this is incorrect for other host abis.
 Further, target/arm has so far been assuming zero-extended results,
 so that it may store the 16-bit value into a 32-bit slot with the
 high 16-bits already clear.
 Rectify both problems by mapping "f16" in the helper definition
 to uint32_t instead of (a typedef for) uint16_t.  This forces
 the host compiler to assume garbage in the upper 16 bits on input
 and to zero-extend the result on output.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Message-id: 20180522175629.24932-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/exec/helper-head.h |  2 +-
  target/arm/helper-a64.c    | 35 +++++++++--------
  target/arm/helper.c        | 80 +++++++++++++++++++-------------------
 files changed, 59 insertions(+), 58 deletions(-)
 diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/helper-head.h
 +++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
  #define dh_ctype_int int
  #define dh_ctype_i64 uint64_t
  #define dh_ctype_s64 int64_t
 -#define dh_ctype_f16 float16
 +#define dh_ctype_f16 uint32_t
  #define dh_ctype_f32 float32
  #define dh_ctype_f64 float64
  #define dh_ctype_ptr void *
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
      return flags;
  }
 -uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
 +uint64_t HELPER(vfp_cmph_a64)(uint32_t x, uint32_t y, void *fp_status)
  {
      return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
  }
 -uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
 +uint64_t HELPER(vfp_cmpeh_a64)(uint32_t x, uint32_t y, void *fp_status)
  {
      return float_rel_to_flags(float16_compare(x, y, fp_status));
  }
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, void *fpstp)
  #define float64_three make_float64(0x4008000000000000ULL)
  #define float64_one_point_five make_float64(0x3FF8000000000000ULL)
 -float16 HELPER(recpsf_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(recpsf_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpsf_f64)(float64 a, float64 b, void *fpstp)
      return float64_muladd(a, b, float64_two, 0, fpst);
  }
 -float16 HELPER(rsqrtsf_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_addlp_u16)(uint64_t a)
  }
  /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
 -float16 HELPER(frecpx_f16)(float16 a, void *fpstp)
 +uint32_t HELPER(frecpx_f16)(uint32_t a, void *fpstp)
  {
      float_status *fpst = fpstp;
      uint16_t val16, sbit;
@@ -XXX,XX +XXX,XX @@ void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
  #define ADVSIMD_HELPER(name, suffix) HELPER(glue(glue(advsimd_, name), suffix))
  #define ADVSIMD_HALFOP(name) \
 -float16 ADVSIMD_HELPER(name, h)(float16 a, float16 b, void *fpstp) \
 +uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, void *fpstp) \
  { \
      float_status *fpst = fpstp; \
      return float16_ ## name(a, b, fpst);    \
@@ -XXX,XX +XXX,XX @@ ADVSIMD_HALFOP(mulx)
  ADVSIMD_TWOHALFOP(mulx)
  /* fused multiply-accumulate */
 -float16 HELPER(advsimd_muladdh)(float16 a, float16 b, float16 c, void *fpstp)
 +uint32_t HELPER(advsimd_muladdh)(uint32_t a, uint32_t b, uint32_t c,
 +                                 void *fpstp)
  {
      float_status *fpst = fpstp;
      return float16_muladd(a, b, c, 0, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_muladd2h)(uint32_t two_a, uint32_t two_b,
  #define ADVSIMD_CMPRES(test) (test) ? 0xffff : 0
 -uint32_t HELPER(advsimd_ceq_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(advsimd_ceq_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
      int compare = float16_compare_quiet(a, b, fpst);
      return ADVSIMD_CMPRES(compare == float_relation_equal);
  }
 -uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(advsimd_cge_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
      int compare = float16_compare(a, b, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)
                            compare == float_relation_equal);
  }
 -uint32_t HELPER(advsimd_cgt_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(advsimd_cgt_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
      int compare = float16_compare(a, b, fpst);
      return ADVSIMD_CMPRES(compare == float_relation_greater);
  }
 -uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(advsimd_acge_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
      float16 f0 = float16_abs(a);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)
                            compare == float_relation_equal);
  }
 -uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)
 +uint32_t HELPER(advsimd_acgt_f16)(uint32_t a, uint32_t b, void *fpstp)
  {
      float_status *fpst = fpstp;
      float16 f0 = float16_abs(a);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)
  }
  /* round to integral */
 -float16 HELPER(advsimd_rinth_exact)(float16 x, void *fp_status)
 +uint32_t HELPER(advsimd_rinth_exact)(uint32_t x, void *fp_status)
  {
      return float16_round_to_int(x, fp_status);
  }
 -float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)
 +uint32_t HELPER(advsimd_rinth)(uint32_t x, void *fp_status)
  {
      int old_flags = get_float_exception_flags(fp_status), new_flags;
      float16 ret;
@@ -XXX,XX +XXX,XX @@ float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)
   * setting the mode appropriately before calling the helper.
   */
 -uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)
 +uint32_t HELPER(advsimd_f16tosinth)(uint32_t a, void *fpstp)
  {
      float_status *fpst = fpstp;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)
      return float16_to_int16(a, fpst);
  }
 -uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)
 +uint32_t HELPER(advsimd_f16touinth)(uint32_t a, void *fpstp)
  {
      float_status *fpst = fpstp;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)
   * Square Root and Reciprocal square root
   */
 -float16 HELPER(sqrt_f16)(float16 a, void *fpstp)
 +uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
  {
      float_status *s = fpstp;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ DO_VFP_cmp(d, float64)
  /* Integer to float and float to integer conversions */
 -#define CONV_ITOF(name, fsz, sign) \
 -    float##fsz HELPER(name)(uint32_t x, void *fpstp) \
 -{ \
 -    float_status *fpst = fpstp; \
 -    return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
 +#define CONV_ITOF(name, ftype, fsz, sign)                           \
 +ftype HELPER(name)(uint32_t x, void *fpstp)                         \
 +{                                                                   \
 +    float_status *fpst = fpstp;                                     \
 +    return sign##int32_to_##float##fsz((sign##int32_t)x, fpst);     \
  }
 -#define CONV_FTOI(name, fsz, sign, round) \
 -uint32_t HELPER(name)(float##fsz x, void *fpstp) \
 -{ \
 -    float_status *fpst = fpstp; \
 -    if (float##fsz##_is_any_nan(x)) { \
 -        float_raise(float_flag_invalid, fpst); \
 -        return 0; \
 -    } \
 -    return float##fsz##_to_##sign##int32##round(x, fpst); \
 +#define CONV_FTOI(name, ftype, fsz, sign, round)                \
 +uint32_t HELPER(name)(ftype x, void *fpstp)                     \
 +{                                                               \
 +    float_status *fpst = fpstp;                                 \
 +    if (float##fsz##_is_any_nan(x)) {                           \
 +        float_raise(float_flag_invalid, fpst);                  \
 +        return 0;                                               \
 +    }                                                           \
 +    return float##fsz##_to_##sign##int32##round(x, fpst);       \
  }
 -#define FLOAT_CONVS(name, p, fsz, sign) \
 -CONV_ITOF(vfp_##name##to##p, fsz, sign) \
 -CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
 -CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
 +#define FLOAT_CONVS(name, p, ftype, fsz, sign)            \
 +    CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign)        \
 +    CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, )        \
 +    CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero)
 -FLOAT_CONVS(si, h, 16, )
 -FLOAT_CONVS(si, s, 32, )
 -FLOAT_CONVS(si, d, 64, )
 -FLOAT_CONVS(ui, h, 16, u)
 -FLOAT_CONVS(ui, s, 32, u)
 -FLOAT_CONVS(ui, d, 64, u)
 +FLOAT_CONVS(si, h, uint32_t, 16, )
 +FLOAT_CONVS(si, s, float32, 32, )
 +FLOAT_CONVS(si, d, float64, 64, )
 +FLOAT_CONVS(ui, h, uint32_t, 16, u)
 +FLOAT_CONVS(ui, s, float32, 32, u)
 +FLOAT_CONVS(ui, d, float64, 64, u)
  #undef CONV_ITOF
  #undef CONV_FTOI
@@ -XXX,XX +XXX,XX @@ static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
      return float64_to_float16(float64_scalbn(f, -shift, fpst), true, fpst);
  }
 -float16 HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return do_postscale_fp16(int32_to_float64(x, fpst), shift, fpst);
  }
 -float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 -float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
  {
      return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
  }
 -float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
  {
      return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
  }
@@ -XXX,XX +XXX,XX @@ static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
      }
  }
 -uint32_t HELPER(vfp_toshh)(float16 x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_int16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 -uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 -uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
  }
 -uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
  }
 -uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
  }
 -uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst)
  {
      return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
  }
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
  }
  /* Half precision conversions.  */
 -float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)
 +float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode)
  {
      /* Squash FZ16 to 0 for the duration of conversion.  In this case,
       * it would affect flushing input denormals.
@@ -XXX,XX +XXX,XX @@ float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)
      return r;
  }
 -float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
 +uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
  {
      /* Squash FZ16 to 0 for the duration of conversion.  In this case,
       * it would affect flushing output denormals.
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
      return r;
  }
 -float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)
 +float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode)
  {
      /* Squash FZ16 to 0 for the duration of conversion.  In this case,
       * it would affect flushing input denormals.
@@ -XXX,XX +XXX,XX @@ float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)
      return r;
  }
 -float16 HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)
 +uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)
  {
      /* Squash FZ16 to 0 for the duration of conversion.  In this case,
       * it would affect flushing output denormals.
@@ -XXX,XX +XXX,XX @@ static bool round_to_inf(float_status *fpst, bool sign_bit)
      g_assert_not_reached();
  }
 -float16 HELPER(recpe_f16)(float16 input, void *fpstp)
 +uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)
  {
      float_status *fpst = fpstp;
      float16 f16 = float16_squash_input_denormal(input, fpst);
@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
      return extract64(estimate, 0, 8) << 44;
  }
 -float16 HELPER(rsqrte_f16)(float16 input, void *fpstp)
 +uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)
  {
      float_status *s = fpstp;
      float16 f16 = float16_squash_input_denormal(input, s);
 --
 .17.1

-New patch
+[Qemu-devel] [PULL 06/25] arm: fix qemu crash on startup with -bios option
+From: Igor Mammedov <imammedo@redhat.com>
+When QEMU is started with following CLI
+ -machine virt,gic-version=3,accel=kvm -cpu host -bios AAVMF_CODE.fd
+it crashes with abort at
+ accel/kvm/kvm-all.c:2164:
+ KVM_SET_DEVICE_ATTR failed: Group 6 attr 0x000000000000c665: Invalid argument
+Which is caused by implicit dependency of kvm_arm_gicv3_reset() on
+arm_gicv3_icc_reset() where the later is called by CPU reset
+reset callback.
+However commit:
+b77f6c arm/boot: split load_dtb() from arm_load_kernel()
+broke CPU reset callback registration in case
+  arm_load_kernel()
+      ...
+      if (!info->kernel_filename || info->firmware_loaded)
+branch is taken, i.e. it's sufficient to provide a firmware
+or do not provide kernel on CLI to skip cpu reset callback
+registration, where before offending commit the callback
+has been registered unconditionally.
+Fix it by registering the callback right at the beginning of
+arm_load_kernel() unconditionally instead of doing it at the end.
+NOTE:
+ we probably should eliminate that dependency anyways as well as
+ separate arch CPU reset parts from arm_load_kernel() into CPU
+ itself, but that refactoring that I probably would have to do
+ anyways later for CPU hotplug to work.
+Reported-by: Auger Eric <eric.auger@redhat.com>
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 1527070950-208350-1-git-send-email-imammedo@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/boot.c | 18 +++++++++---------
+file changed, 9 insertions(+), 9 deletions(-)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
+     static const ARMInsnFixup *primary_loader;
+     AddressSpace *as = arm_boot_address_space(cpu, info);
++    /* CPU objects (unlike devices) are not automatically reset on system
++     * reset, so we must always register a handler to do so. If we're
++     * actually loading a kernel, the handler is also responsible for
++     * arranging that we start it correctly.
++     */
++    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
++        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
++    }
++
+     /* The board code is not supposed to set secure_board_setup unless
+      * running its code in secure mode is actually possible, and KVM
+      * doesn't support secure.
+@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
+         ARM_CPU(cs)->env.boot_info = info;
+     }
+-    /* CPU objects (unlike devices) are not automatically reset on system
+-     * reset, so we must always register a handler to do so. If we're
+-     * actually loading a kernel, the handler is also responsible for
+-     * arranging that we start it correctly.
+-     */
+-    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
+-        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
+-    }
+-
+     if (!info->skip_dtb_autoload && have_dtb(info)) {
+         if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
+             exit(1);
+--
+.17.1

-New patch
+[Qemu-devel] [PULL 07/25] arm: fix malloc type mismatch
+From: Paolo Bonzini <pbonzini@redhat.com>
+cpregs_keys is an uint32_t* so the allocation should use uint32_t.
+g_new is even better because it is type-safe.
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/gdbstub.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/gdbstub.c
++++ b/target/arm/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_xml(CPUState *cs)
+     RegisterSysregXmlParam param = {cs, s};
+     cpu->dyn_xml.num_cpregs = 0;
+-    cpu->dyn_xml.cpregs_keys = g_malloc(sizeof(uint32_t *) *
+-                                        g_hash_table_size(cpu->cp_regs));
++    cpu->dyn_xml.cpregs_keys = g_new(uint32_t, g_hash_table_size(cpu->cp_regs));
+     g_string_printf(s, "<?xml version=\"1.0\"?>");
+     g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+     g_string_append_printf(s, "<feature name=\"org.qemu.gdb.arm.sys.regs\">");
+--
+.17.1

-New patch
+[Qemu-devel] [PULL 08/25] xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
+From: Francisco Iglesias <frasse.iglesias@gmail.com>
+Coverity found that the string return by 'object_get_canonical_path' was not
+being freed at two locations in the model (CID 1391294 and CID 1391293) and
+also that a memset was being called with a value greater than the max of a byte
+on the second argument (CID 1391286). This patch corrects this by adding the
+freeing of the strings and also changing to memset to zero instead on
+descriptor unaligned errors.
+Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20180528184859.3530-1-frasse.iglesias@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/dma/xlnx-zdma.c | 10 +++++++---
+file changed, 7 insertions(+), 3 deletions(-)
+diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/xlnx-zdma.c
++++ b/hw/dma/xlnx-zdma.c
+@@ -XXX,XX +XXX,XX @@ static bool zdma_load_descriptor(XlnxZDMA *s, uint64_t addr, void *buf)
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "zdma: unaligned descriptor at %" PRIx64,
+                       addr);
+-        memset(buf, 0xdeadbeef, sizeof(XlnxZDMADescr));
++        memset(buf, 0x0, sizeof(XlnxZDMADescr));
+         s->error = true;
+         return false;
+     }
+@@ -XXX,XX +XXX,XX @@ static uint64_t zdma_read(void *opaque, hwaddr addr, unsigned size)
+     RegisterInfo *r = &s->regs_info[addr / 4];
+     if (!r->data) {
++        gchar *path = object_get_canonical_path(OBJECT(s));
+         qemu_log("%s: Decode error: read from %" HWADDR_PRIx "\n",
+-                 object_get_canonical_path(OBJECT(s)),
++                 path,
+                  addr);
++        g_free(path);
+         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);
+         zdma_ch_imr_update_irq(s);
+         return 0;
+@@ -XXX,XX +XXX,XX @@ static void zdma_write(void *opaque, hwaddr addr, uint64_t value,
+     RegisterInfo *r = &s->regs_info[addr / 4];
+     if (!r->data) {
++        gchar *path = object_get_canonical_path(OBJECT(s));
+         qemu_log("%s: Decode error: write to %" HWADDR_PRIx "=%" PRIx64 "\n",
+-                 object_get_canonical_path(OBJECT(s)),
++                 path,
+                  addr, value);
++        g_free(path);
+         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);
+         zdma_ch_imr_update_irq(s);
+         return;
+--
+.17.1

-[Qemu-devel] [PULL 07/18] target/arm/translate: ensure gen_goto_tb sets exit flags
+[Qemu-devel] [PULL 09/25] Correct CPACR reset value for v7 cores
-From: Alex Bennée <alex.bennee@linaro.org>
+In commit f0aff255700 we made cpacr_write() enforce that some CPACR
 bits are RAZ/WI and some are RAO/WI for ARMv7 cores. Unfortunately
 we forgot to also update the register's reset value. The effect
 was that (a) a guest that read CPACR on reset would not see ones in
 the RAO bits, and (b) if you did a migration before the guest did
 a write to the CPACR then the migration would fail because the
 destination would enforce the RAO bits and then complain that they
 didn't match the zero value from the source.
-As the gen_goto_tb function can do both static and dynamic jumps it
+Implement reset for the CPACR using a custom reset function
-should also set the is_jmp field. This matches the behaviour of the
+that just calls cpacr_write(), to avoid having to duplicate
-a64 code.
+the logic for which bits are RAO.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+This bug would affect migration for TCG CPUs which are ARMv7
-Reviewed-by: Richard Henderson <rth@twiddle.net>
+with VFP but without one of Neon or VFPv3.
-Message-id: 20170713141928.25419-5-alex.bennee@linaro.org
-[tweak to multiline comment formatting]
+Reported-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20180522173713.26282-1-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 6 +++++-
+ target/arm/helper.c | 10 +++++++++-
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/helper.c
-+++ b/target/arm/translate.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_ptr(void)
+@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     tcg_temp_free(addr);
+     env->cp15.cpacr_el1 = value;
  }
-+/* This will end the TB but doesn't guarantee we'll return to
++static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-+ * cpu_loop_exec. Any live exit_requests will be processed as we
++{
-+ * enter the next TB.
++    /* Call cpacr_write() so that we reset with the correct RAO bits set
-+ */
++     * for our CPU features.
- static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
++     */
 +    cpacr_write(env, ri, 0);
 +}
 +
  static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                     bool isread)
  {
-     if (use_goto_tb(s, dest)) {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
-@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
+     { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
-         gen_set_pc_im(s, dest);
+       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
-         gen_goto_ptr();
+       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
-     }
+-      .resetvalue = 0, .writefn = cpacr_write },
-+    s->is_jmp = DISAS_TB_JUMP;
++      .resetfn = cpacr_reset, .writefn = cpacr_write },
- }
+     REGINFO_SENTINEL
+ };
  static inline void gen_jmp (DisasContext *s, uint32_t dest)
@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp (DisasContext *s, uint32_t dest)
          gen_bx_im(s, dest);
      } else {
          gen_goto_tb(s, 0, dest);
 -        s->is_jmp = DISAS_TB_JUMP;
      }
  }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 15/18] hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller
+[Qemu-devel] [PULL 10/25] memory.h: Improve IOMMU related documentation
-Implement a model of the Serial Communication Controller (SCC) found
+Add more detail to the documentation for memory_region_init_iommu()
-in MPS2 FPGA images.
+and other IOMMU-related functions and data structures.
 The primary purpose of this device is to communicate with the
 Motherboard Configuration Controller (MCC) which is located on
 the MPS board itself, outside the FPGA image. This is used
 for programming the MPS clock generators. The SCC also has
 some basic ID registers and an output for the board LEDs.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1500029487-14822-7-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20180521140402.23318-2-peter.maydell@linaro.org
 ---
- hw/misc/Makefile.objs           |   1 +
+ include/exec/memory.h | 105 ++++++++++++++++++++++++++++++++++++++----
- include/hw/misc/mps2-scc.h      |  43 ++++++
+file changed, 95 insertions(+), 10 deletions(-)
  hw/misc/mps2-scc.c              | 310 ++++++++++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   2 +
  hw/misc/trace-events            |   8 ++
 files changed, 364 insertions(+)
  create mode 100644 include/hw/misc/mps2-scc.h
  create mode 100644 hw/misc/mps2-scc.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/include/exec/memory.h
-+++ b/hw/misc/Makefile.objs
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
+@@ -XXX,XX +XXX,XX @@ enum IOMMUMemoryRegionAttr {
- obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
+     IOMMU_ATTR_SPAPR_TCE_FD
- obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
+ };
- obj-$(CONFIG_MIPS_ITU) += mips_itu.o
-+obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
++/**
++ * IOMMUMemoryRegionClass:
  obj-$(CONFIG_PVPANIC) += pvpanic.o
  obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM MPS2 SCC emulation
 + *
-+ * Copyright (c) 2017 Linaro Limited
++ * All IOMMU implementations need to subclass TYPE_IOMMU_MEMORY_REGION
-+ * Written by Peter Maydell
++ * and provide an implementation of at least the @translate method here
 + * to handle requests to the memory region. Other methods are optional.
 + *
-+ *  This program is free software; you can redistribute it and/or modify
++ * The IOMMU implementation must use the IOMMU notifier infrastructure
-+ *  it under the terms of the GNU General Public License version 2 or
++ * to report whenever mappings are changed, by calling
-+ *  (at your option) any later version.
++ * memory_region_notify_iommu() (or, if necessary, by calling
 + * memory_region_notify_one() for each registered notifier).
 + */
-+
+ typedef struct IOMMUMemoryRegionClass {
-+#ifndef MPS2_SCC_H
+     /* private */
-+#define MPS2_SCC_H
+     struct DeviceClass parent_class;
-+
-+#include "hw/sysbus.h"
+     /*
-+
+-     * Return a TLB entry that contains a given address. Flag should
-+#define TYPE_MPS2_SCC "mps2-scc"
+-     * be the access permission of this translation operation. We can
-+#define MPS2_SCC(obj) OBJECT_CHECK(MPS2SCC, (obj), TYPE_MPS2_SCC)
+-     * set flag to IOMMU_NONE to mean that we don't need any
-+
+-     * read/write permission checks, like, when for region replay.
-+#define NUM_OSCCLK 3
++     * Return a TLB entry that contains a given address.
-+
++     *
-+typedef struct {
++     * The IOMMUAccessFlags indicated via @flag are optional and may
-+    /*< private >*/
++     * be specified as IOMMU_NONE to indicate that the caller needs
-+    SysBusDevice parent_obj;
++     * the full translation information for both reads and writes. If
-+
++     * the access flags are specified then the IOMMU implementation
-+    /*< public >*/
++     * may use this as an optimization, to stop doing a page table
-+    MemoryRegion iomem;
++     * walk as soon as it knows that the requested permissions are not
-+
++     * allowed. If IOMMU_NONE is passed then the IOMMU must do the
-+    uint32_t cfg0;
++     * full page table walk and report the permissions in the returned
-+    uint32_t cfg1;
++     * IOMMUTLBEntry. (Note that this implies that an IOMMU may not
-+    uint32_t cfg4;
++     * return different mappings for reads and writes.)
-+    uint32_t cfgdata_rtn;
++     *
-+    uint32_t cfgdata_out;
++     * The returned information remains valid while the caller is
-+    uint32_t cfgctrl;
++     * holding the big QEMU lock or is inside an RCU critical section;
-+    uint32_t cfgstat;
++     * if the caller wishes to cache the mapping beyond that it must
-+    uint32_t dll;
++     * register an IOMMU notifier so it can invalidate its cached
-+    uint32_t aid;
++     * information when the IOMMU mapping changes.
-+    uint32_t id;
++     *
-+    uint32_t oscclk[NUM_OSCCLK];
++     * @iommu: the IOMMUMemoryRegion
-+    uint32_t oscclk_reset[NUM_OSCCLK];
++     * @hwaddr: address to be translated within the memory region
-+} MPS2SCC;
++     * @flag: requested access permissions
-+
+      */
-+#endif
+     IOMMUTLBEntry (*translate)(IOMMUMemoryRegion *iommu, hwaddr addr,
-diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
+                                IOMMUAccessFlags flag);
-new file mode 100644
+-    /* Returns minimum supported page size */
-index XXXXXXX..XXXXXXX
++    /* Returns minimum supported page size in bytes.
---- /dev/null
++     * If this method is not provided then the minimum is assumed to
-+++ b/hw/misc/mps2-scc.c
++     * be TARGET_PAGE_SIZE.
-@@ -XXX,XX +XXX,XX @@
++     *
-+/*
++     * @iommu: the IOMMUMemoryRegion
-+ * ARM MPS2 SCC emulation
++     */
      uint64_t (*get_min_page_size)(IOMMUMemoryRegion *iommu);
 -    /* Called when IOMMU Notifier flag changed */
 +    /* Called when IOMMU Notifier flag changes (ie when the set of
 +     * events which IOMMU users are requesting notification for changes).
 +     * Optional method -- need not be provided if the IOMMU does not
 +     * need to know exactly which events must be notified.
 +     *
 +     * @iommu: the IOMMUMemoryRegion
 +     * @old_flags: events which previously needed to be notified
 +     * @new_flags: events which now need to be notified
 +     */
      void (*notify_flag_changed)(IOMMUMemoryRegion *iommu,
                                  IOMMUNotifierFlag old_flags,
                                  IOMMUNotifierFlag new_flags);
 -    /* Set this up to provide customized IOMMU replay function */
 +    /* Called to handle memory_region_iommu_replay().
 +     *
 +     * The default implementation of memory_region_iommu_replay() is to
 +     * call the IOMMU translate method for every page in the address space
 +     * with flag == IOMMU_NONE and then call the notifier if translate
 +     * returns a valid mapping. If this method is implemented then it
 +     * overrides the default behaviour, and must provide the full semantics
 +     * of memory_region_iommu_replay(), by calling @notifier for every
 +     * translation present in the IOMMU.
 +     *
 +     * Optional method -- an IOMMU only needs to provide this method
 +     * if the default is inefficient or produces undesirable side effects.
 +     *
 +     * Note: this is not related to record-and-replay functionality.
 +     */
      void (*replay)(IOMMUMemoryRegion *iommu, IOMMUNotifier *notifier);
 -    /* Get IOMMU misc attributes */
 -    int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr,
 +    /* Get IOMMU misc attributes. This is an optional method that
 +     * can be used to allow users of the IOMMU to get implementation-specific
 +     * information. The IOMMU implements this method to handle calls
 +     * by IOMMU users to memory_region_iommu_get_attr() by filling in
 +     * the arbitrary data pointer for any IOMMUMemoryRegionAttr values that
 +     * the IOMMU supports. If the method is unimplemented then
 +     * memory_region_iommu_get_attr() will always return -EINVAL.
 +     *
 +     * @iommu: the IOMMUMemoryRegion
 +     * @attr: attribute being queried
 +     * @data: memory to fill in with the attribute data
 +     *
 +     * Returns 0 on success, or a negative errno; in particular
 +     * returns -EINVAL for unrecognized or unimplemented attribute types.
 +     */
 +    int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr attr,
                      void *data);
  } IOMMUMemoryRegionClass;
@@ -XXX,XX +XXX,XX @@ static inline void memory_region_init_reservation(MemoryRegion *mr,
   * An IOMMU region translates addresses and forwards accesses to a target
   * memory region.
   *
 + * The IOMMU implementation must define a subclass of TYPE_IOMMU_MEMORY_REGION.
 + * @_iommu_mr should be a pointer to enough memory for an instance of
 + * that subclass, @instance_size is the size of that subclass, and
 + * @mrtypename is its name. This function will initialize @_iommu_mr as an
 + * instance of the subclass, and its methods will then be called to handle
 + * accesses to the memory region. See the documentation of
 + * #IOMMUMemoryRegionClass for further details.
 + *
-+ * Copyright (c) 2017 Linaro Limited
+  * @_iommu_mr: the #IOMMUMemoryRegion to be initialized
-+ * Written by Peter Maydell
+  * @instance_size: the IOMMUMemoryRegion subclass instance size
   * @mrtypename: the type name of the #IOMMUMemoryRegion
@@ -XXX,XX +XXX,XX @@ void memory_region_register_iommu_notifier(MemoryRegion *mr,
   * a notifier with the minimum page granularity returned by
   * mr->iommu_ops->get_page_size().
   *
 + * Note: this is not related to record-and-replay functionality.
 + *
-+ *  This program is free software; you can redistribute it and/or modify
+  * @iommu_mr: the memory region to observe
-+ *  it under the terms of the GNU General Public License version 2 or
+  * @n: the notifier to which to replay iommu mappings
-+ *  (at your option) any later version.
+  */
-+ */
+@@ -XXX,XX +XXX,XX @@ void memory_region_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n);
-+
+  * memory_region_iommu_replay_all: replay existing IOMMU translations
-+/* This is a model of the SCC (Serial Communication Controller)
+  * to all the notifiers registered.
-+ * found in the FPGA images of MPS2 development boards.
+  *
 + * Note: this is not related to record-and-replay functionality.
 + *
-+ * Documentation of it can be found in the MPS2 TRM:
+  * @iommu_mr: the memory region to observe
-+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.100112_0100_03_en/index.html
+  */
-+ * and also in the Application Notes documenting individual FPGA images.
+ void memory_region_iommu_replay_all(IOMMUMemoryRegion *iommu_mr);
-+ */
+@@ -XXX,XX +XXX,XX @@ void memory_region_unregister_iommu_notifier(MemoryRegion *mr,
-+
+  * memory_region_iommu_get_attr: return an IOMMU attr if get_attr() is
-+#include "qemu/osdep.h"
+  * defined on the IOMMU.
-+#include "qemu/log.h"
+  *
-+#include "qapi/error.h"
+- * Returns 0 if succeded, error code otherwise.
-+#include "trace.h"
++ * Returns 0 on success, or a negative errno otherwise. In particular,
-+#include "hw/sysbus.h"
++ * -EINVAL indicates that the IOMMU does not support the requested
-+#include "hw/registerfields.h"
++ * attribute.
-+#include "hw/misc/mps2-scc.h"
+  *
-+
+  * @iommu_mr: the memory region
-+REG32(CFG0, 0)
+  * @attr: the requested attribute
 +REG32(CFG1, 4)
 +REG32(CFG3, 0xc)
 +REG32(CFG4, 0x10)
 +REG32(CFGDATA_RTN, 0xa0)
 +REG32(CFGDATA_OUT, 0xa4)
 +REG32(CFGCTRL, 0xa8)
 +    FIELD(CFGCTRL, DEVICE, 0, 12)
 +    FIELD(CFGCTRL, RES1, 12, 8)
 +    FIELD(CFGCTRL, FUNCTION, 20, 6)
 +    FIELD(CFGCTRL, RES2, 26, 4)
 +    FIELD(CFGCTRL, WRITE, 30, 1)
 +    FIELD(CFGCTRL, START, 31, 1)
 +REG32(CFGSTAT, 0xac)
 +    FIELD(CFGSTAT, DONE, 0, 1)
 +    FIELD(CFGSTAT, ERROR, 1, 1)
 +REG32(DLL, 0x100)
 +REG32(AID, 0xFF8)
 +REG32(ID, 0xFFC)
 +
 +/* Handle a write via the SYS_CFG channel to the specified function/device.
 + * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit).
 + */
 +static bool scc_cfg_write(MPS2SCC *s, unsigned function,
 +                          unsigned device, uint32_t value)
 +{
 +    trace_mps2_scc_cfg_write(function, device, value);
 +
 +    if (function != 1 || device >= NUM_OSCCLK) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "MPS2 SCC config write: bad function %d device %d\n",
 +                      function, device);
 +        return false;
 +    }
 +
 +    s->oscclk[device] = value;
 +    return true;
 +}
 +
 +/* Handle a read via the SYS_CFG channel to the specified function/device.
 + * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit),
 + * or set *value on success.
 + */
 +static bool scc_cfg_read(MPS2SCC *s, unsigned function,
 +                         unsigned device, uint32_t *value)
 +{
 +    if (function != 1 || device >= NUM_OSCCLK) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "MPS2 SCC config read: bad function %d device %d\n",
 +                      function, device);
 +        return false;
 +    }
 +
 +    *value = s->oscclk[device];
 +
 +    trace_mps2_scc_cfg_read(function, device, *value);
 +    return true;
 +}
 +
 +static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    MPS2SCC *s = MPS2_SCC(opaque);
 +    uint64_t r;
 +
 +    switch (offset) {
 +    case A_CFG0:
 +        r = s->cfg0;
 +        break;
 +    case A_CFG1:
 +        r = s->cfg1;
 +        break;
 +    case A_CFG3:
 +        /* These are user-settable DIP switches on the board. We don't
 +         * model that, so just return zeroes.
 +         */
 +        r = 0;
 +        break;
 +    case A_CFG4:
 +        r = s->cfg4;
 +        break;
 +    case A_CFGDATA_RTN:
 +        r = s->cfgdata_rtn;
 +        break;
 +    case A_CFGDATA_OUT:
 +        r = s->cfgdata_out;
 +        break;
 +    case A_CFGCTRL:
 +        r = s->cfgctrl;
 +        break;
 +    case A_CFGSTAT:
 +        r = s->cfgstat;
 +        break;
 +    case A_DLL:
 +        r = s->dll;
 +        break;
 +    case A_AID:
 +        r = s->aid;
 +        break;
 +    case A_ID:
 +        r = s->id;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "MPS2 SCC read: bad offset %x\n", (int) offset);
 +        r = 0;
 +        break;
 +    }
 +
 +    trace_mps2_scc_read(offset, r, size);
 +    return r;
 +}
 +
 +static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
 +                           unsigned size)
 +{
 +    MPS2SCC *s = MPS2_SCC(opaque);
 +
 +    trace_mps2_scc_write(offset, value, size);
 +
 +    switch (offset) {
 +    case A_CFG0:
 +        /* TODO on some boards bit 0 controls RAM remapping */
 +        s->cfg0 = value;
 +        break;
 +    case A_CFG1:
 +        /* CFG1 bits [7:0] control the board LEDs. We don't currently have
 +         * a mechanism for displaying this graphically, so use a trace event.
 +         */
 +        trace_mps2_scc_leds(value & 0x80 ? '*' : '.',
 +                            value & 0x40 ? '*' : '.',
 +                            value & 0x20 ? '*' : '.',
 +                            value & 0x10 ? '*' : '.',
 +                            value & 0x08 ? '*' : '.',
 +                            value & 0x04 ? '*' : '.',
 +                            value & 0x02 ? '*' : '.',
 +                            value & 0x01 ? '*' : '.');
 +        s->cfg1 = value;
 +        break;
 +    case A_CFGDATA_OUT:
 +        s->cfgdata_out = value;
 +        break;
 +    case A_CFGCTRL:
 +        /* Writing to CFGCTRL clears SYS_CFGSTAT */
 +        s->cfgstat = 0;
 +        s->cfgctrl = value & ~(R_CFGCTRL_RES1_MASK |
 +                               R_CFGCTRL_RES2_MASK |
 +                               R_CFGCTRL_START_MASK);
 +
 +        if (value & R_CFGCTRL_START_MASK) {
 +            /* Start bit set -- do a read or write (instantaneously) */
 +            int device = extract32(s->cfgctrl, R_CFGCTRL_DEVICE_SHIFT,
 +                                   R_CFGCTRL_DEVICE_LENGTH);
 +            int function = extract32(s->cfgctrl, R_CFGCTRL_FUNCTION_SHIFT,
 +                                     R_CFGCTRL_FUNCTION_LENGTH);
 +
 +            s->cfgstat = R_CFGSTAT_DONE_MASK;
 +            if (s->cfgctrl & R_CFGCTRL_WRITE_MASK) {
 +                if (!scc_cfg_write(s, function, device, s->cfgdata_out)) {
 +                    s->cfgstat |= R_CFGSTAT_ERROR_MASK;
 +                }
 +            } else {
 +                uint32_t result;
 +                if (!scc_cfg_read(s, function, device, &result)) {
 +                    s->cfgstat |= R_CFGSTAT_ERROR_MASK;
 +                } else {
 +                    s->cfgdata_rtn = result;
 +                }
 +            }
 +        }
 +        break;
 +    case A_DLL:
 +        /* DLL stands for Digital Locked Loop.
 +         * Bits [31:24] (DLL_LOCK_MASK) are writable, and indicate a
 +         * mask of which of the DLL_LOCKED bits [16:23] should be ORed
 +         * together to determine the ALL_UNMASKED_DLLS_LOCKED bit [0].
 +         * For QEMU, our DLLs are always locked, so we can leave bit 0
 +         * as 1 always and don't need to recalculate it.
 +         */
 +        s->dll = deposit32(s->dll, 24, 8, extract32(value, 24, 8));
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "MPS2 SCC write: bad offset 0x%x\n", (int) offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps mps2_scc_ops = {
 +    .read = mps2_scc_read,
 +    .write = mps2_scc_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void mps2_scc_reset(DeviceState *dev)
 +{
 +    MPS2SCC *s = MPS2_SCC(dev);
 +    int i;
 +
 +    trace_mps2_scc_reset();
 +    s->cfg0 = 0;
 +    s->cfg1 = 0;
 +    s->cfgdata_rtn = 0;
 +    s->cfgdata_out = 0;
 +    s->cfgctrl = 0x100000;
 +    s->cfgstat = 0;
 +    s->dll = 0xffff0001;
 +    for (i = 0; i < NUM_OSCCLK; i++) {
 +        s->oscclk[i] = s->oscclk_reset[i];
 +    }
 +}
 +
 +static void mps2_scc_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    MPS2SCC *s = MPS2_SCC(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static void mps2_scc_realize(DeviceState *dev, Error **errp)
 +{
 +}
 +
 +static const VMStateDescription mps2_scc_vmstate = {
 +    .name = "mps2-scc",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(cfg0, MPS2SCC),
 +        VMSTATE_UINT32(cfg1, MPS2SCC),
 +        VMSTATE_UINT32(cfgdata_rtn, MPS2SCC),
 +        VMSTATE_UINT32(cfgdata_out, MPS2SCC),
 +        VMSTATE_UINT32(cfgctrl, MPS2SCC),
 +        VMSTATE_UINT32(cfgstat, MPS2SCC),
 +        VMSTATE_UINT32(dll, MPS2SCC),
 +        VMSTATE_UINT32_ARRAY(oscclk, MPS2SCC, NUM_OSCCLK),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property mps2_scc_properties[] = {
 +    /* Values for various read-only ID registers (which are specific
 +     * to the board model or FPGA image)
 +     */
 +    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, aid, 0),
 +    DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
 +    DEFINE_PROP_UINT32("scc-id", MPS2SCC, aid, 0),
 +    /* These are the initial settings for the source clocks on the board.
 +     * In hardware they can be configured via a config file read by the
 +     * motherboard configuration controller to suit the FPGA image.
 +     * These default values are used by most of the standard FPGA images.
 +     */
 +    DEFINE_PROP_UINT32("oscclk0", MPS2SCC, oscclk_reset[0], 50000000),
 +    DEFINE_PROP_UINT32("oscclk1", MPS2SCC, oscclk_reset[1], 24576000),
 +    DEFINE_PROP_UINT32("oscclk2", MPS2SCC, oscclk_reset[2], 25000000),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void mps2_scc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = mps2_scc_realize;
 +    dc->vmsd = &mps2_scc_vmstate;
 +    dc->reset = mps2_scc_reset;
 +    dc->props = mps2_scc_properties;
 +}
 +
 +static const TypeInfo mps2_scc_info = {
 +    .name = TYPE_MPS2_SCC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(MPS2SCC),
 +    .instance_init = mps2_scc_init,
 +    .class_init = mps2_scc_class_init,
 +};
 +
 +static void mps2_scc_register_types(void)
 +{
 +    type_register_static(&mps2_scc_info);
 +}
 +
 +type_init(mps2_scc_register_types);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F205_SOC=y
  CONFIG_CMSDK_APB_TIMER=y
  CONFIG_CMSDK_APB_UART=y
 +CONFIG_MPS2_SCC=y
 +
  CONFIG_VERSATILE_PCI=y
  CONFIG_VERSATILE_I2C=y
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ milkymist_pfpu_pulse_irq(void) "Pulse IRQ"
  # hw/misc/aspeed_scu.c
  aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
 +
 +# hw/misc/mps2_scc.c
 +mps2_scc_read(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 +mps2_scc_write(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 +mps2_scc_reset(void) "MPS2 SCC: reset"
 +mps2_scc_leds(char led7, char led6, char led5, char led4, char led3, char led2, char led1, char led0) "MPS2 SCC LEDs: %c%c%c%c%c%c%c%c"
 +mps2_scc_cfg_write(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config write: function %d device %d data 0x%" PRIx32
 +mps2_scc_cfg_read(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config read: function %d device %d data 0x%" PRIx32
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 04/18] include/exec/exec-all: document common exit conditions
+[Qemu-devel] [PULL 11/25] Make tb_invalidate_phys_addr() take a MemTxAttrs argument
-From: Alex Bennée <alex.bennee@linaro.org>
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to tb_invalidate_phys_addr().
 Its callers either have an attrs value to hand, or don't care
 and can use MEMTXATTRS_UNSPECIFIED.
-As a precursor to later patches attempt to come up with a more
-concrete wording for what each of the common exit cases would be.
-CC: Emilio G. Cota <cota@braap.org>
-CC: Richard Henderson <rth@twiddle.net>
-CC: Lluís Vilanova <vilanova@ac.upc.edu>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <rth@twiddle.net>
-Message-id: 20170713141928.25419-2-alex.bennee@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180521140402.23318-3-peter.maydell@linaro.org
 ---
- include/exec/exec-all.h | 29 ++++++++++++++++++++++++++---
+ include/exec/exec-all.h   | 5 +++--
-file changed, 26 insertions(+), 3 deletions(-)
+ accel/tcg/translate-all.c | 2 +-
  exec.c                    | 2 +-
  target/xtensa/op_helper.c | 3 ++-
 files changed, 7 insertions(+), 5 deletions(-)
 diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/exec-all.h
 +++ b/include/exec/exec-all.h
-@@ -XXX,XX +XXX,XX @@ typedef abi_ulong tb_page_addr_t;
+@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
- typedef ram_addr_t tb_page_addr_t;
+ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                    hwaddr paddr, int prot,
                    int mmu_idx, target_ulong size);
 -void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);
 +void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
  void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
                   uintptr_t retaddr);
  #else
@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                         uint16_t idxmap)
  {
  }
 -static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)
 +static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr,
 +                                           MemTxAttrs attrs)
  {
  }
  #endif
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
--/* is_jmp field values */
+index XXXXXXX..XXXXXXX 100644
-+/* DisasContext is_jmp field values
+--- a/accel/tcg/translate-all.c
-+ *
++++ b/accel/tcg/translate-all.c
-+ * is_jmp starts as DISAS_NEXT. The translator will keep processing
+@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
-+ * instructions until an exit condition is reached. If we reach the
+ }
-+ * exit condition and is_jmp is still DISAS_NEXT (because of some
-+ * other condition) we simply "jump" to the next address.
+ #if !defined(CONFIG_USER_ONLY)
-+ * The remaining exit cases are:
+-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)
-+ *
++void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
-+ *   DISAS_JUMP    - Only the PC was modified dynamically (e.g computed)
+ {
-+ *   DISAS_TB_JUMP - Only the PC was modified statically (e.g. branch)
+     ram_addr_t ram_addr;
-+ *
+     MemoryRegion *mr;
-+ * In these cases as long as the PC is updated we can chain to the
+diff --git a/exec.c b/exec.c
-+ * next TB either by exiting the loop or looking up the next TB via
+index XXXXXXX..XXXXXXX 100644
-+ * the loookup helper.
+--- a/exec.c
-+ *
++++ b/exec.c
-+ *   DISAS_UPDATE  - CPU State was modified dynamically
+@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
-+ *
+     if (phys != -1) {
-+ * This covers any other CPU state which necessities us exiting the
+         /* Locks grabbed by tb_invalidate_phys_addr */
-+ * TCG code to the main run-loop. Typically this includes anything
+         tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
-+ * that might change the interrupt state.
+-                                phys | (pc & ~TARGET_PAGE_MASK));
-+ *
++                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
-+ * Individual translators may define additional exit cases to deal
+     }
-+ * with per-target special conditions.
+ }
-+ */
+ #endif
- #define DISAS_NEXT    0 /* next instruction can be analyzed */
+diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
- #define DISAS_JUMP    1 /* only pc was modified dynamically */
+index XXXXXXX..XXXXXXX 100644
--#define DISAS_UPDATE  2 /* cpu state was modified dynamically */
+--- a/target/xtensa/op_helper.c
--#define DISAS_TB_JUMP 3 /* only pc was modified statically */
++++ b/target/xtensa/op_helper.c
-+#define DISAS_TB_JUMP 2 /* only pc was modified statically */
+@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_virtual_addr(CPUXtensaState *env, uint32_t vaddr)
-+#define DISAS_UPDATE  3 /* cpu state was modified dynamically */
+     int ret = xtensa_get_physical_addr(env, false, vaddr, 2, 0,
+             &paddr, &page_size, &access);
- #include "qemu/log.h"
+     if (ret == 0) {
 -        tb_invalidate_phys_addr(&address_space_memory, paddr);
 +        tb_invalidate_phys_addr(&address_space_memory, paddr,
 +                                MEMTXATTRS_UNSPECIFIED);
      }
  }
 --
-.7.4
+.17.1

-New patch
+[Qemu-devel] [PULL 12/25] Make address_space_translate{, _cached}() take a MemTxAttrs argument
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to address_space_translate()
 and address_space_translate_cached(). Callers either have an
 attrs value to hand, or don't care and can use MEMTXATTRS_UNSPECIFIED.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-4-peter.maydell@linaro.org
 ---
  include/exec/memory.h     |  4 +++-
  accel/tcg/translate-all.c |  2 +-
  exec.c                    | 14 +++++++++-----
  hw/vfio/common.c          |  3 ++-
  memory_ldst.inc.c         | 18 +++++++++---------
  target/riscv/helper.c     |  2 +-
 files changed, 25 insertions(+), 18 deletions(-)
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
   * #MemoryRegion.
   * @len: pointer to length
   * @is_write: indicates the transfer direction
 + * @attrs: memory attributes
   */
  MemoryRegion *flatview_translate(FlatView *fv,
                                   hwaddr addr, hwaddr *xlat,
@@ -XXX,XX +XXX,XX @@ MemoryRegion *flatview_translate(FlatView *fv,
  static inline MemoryRegion *address_space_translate(AddressSpace *as,
                                                      hwaddr addr, hwaddr *xlat,
 -                                                    hwaddr *len, bool is_write)
 +                                                    hwaddr *len, bool is_write,
 +                                                    MemTxAttrs attrs)
  {
      return flatview_translate(address_space_to_flatview(as),
                                addr, xlat, len, is_write);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
      hwaddr l = 1;
      rcu_read_lock();
 -    mr = address_space_translate(as, addr, &addr, &l, false);
 +    mr = address_space_translate(as, addr, &addr, &l, false, attrs);
      if (!(memory_region_is_ram(mr)
            || memory_region_is_romd(mr))) {
          rcu_read_unlock();
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_physical_memory_write_rom_internal(AddressSpace *as,
      rcu_read_lock();
      while (len > 0) {
          l = len;
 -        mr = address_space_translate(as, addr, &addr1, &l, true);
 +        mr = address_space_translate(as, addr, &addr1, &l, true,
 +                                     MEMTXATTRS_UNSPECIFIED);
          if (!(memory_region_is_ram(mr) ||
                memory_region_is_romd(mr))) {
@@ -XXX,XX +XXX,XX @@ void address_space_cache_destroy(MemoryRegionCache *cache)
   */
  static inline MemoryRegion *address_space_translate_cached(
      MemoryRegionCache *cache, hwaddr addr, hwaddr *xlat,
 -    hwaddr *plen, bool is_write)
 +    hwaddr *plen, bool is_write, MemTxAttrs attrs)
  {
      MemoryRegionSection section;
      MemoryRegion *mr;
@@ -XXX,XX +XXX,XX @@ address_space_read_cached_slow(MemoryRegionCache *cache, hwaddr addr,
      MemoryRegion *mr;
      l = len;
 -    mr = address_space_translate_cached(cache, addr, &addr1, &l, false);
 +    mr = address_space_translate_cached(cache, addr, &addr1, &l, false,
 +                                        MEMTXATTRS_UNSPECIFIED);
      flatview_read_continue(cache->fv,
                             addr, MEMTXATTRS_UNSPECIFIED, buf, len,
                             addr1, l, mr);
@@ -XXX,XX +XXX,XX @@ address_space_write_cached_slow(MemoryRegionCache *cache, hwaddr addr,
      MemoryRegion *mr;
      l = len;
 -    mr = address_space_translate_cached(cache, addr, &addr1, &l, true);
 +    mr = address_space_translate_cached(cache, addr, &addr1, &l, true,
 +                                        MEMTXATTRS_UNSPECIFIED);
      flatview_write_continue(cache->fv,
                              addr, MEMTXATTRS_UNSPECIFIED, buf, len,
                              addr1, l, mr);
@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_is_io(hwaddr phys_addr)
      rcu_read_lock();
      mr = address_space_translate(&address_space_memory,
 -                                 phys_addr, &phys_addr, &l, false);
 +                                 phys_addr, &phys_addr, &l, false,
 +                                 MEMTXATTRS_UNSPECIFIED);
      res = !(memory_region_is_ram(mr) || memory_region_is_romd(mr));
      rcu_read_unlock();
 diff --git a/hw/vfio/common.c b/hw/vfio/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/common.c
 +++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ static bool vfio_get_vaddr(IOMMUTLBEntry *iotlb, void **vaddr,
       */
      mr = address_space_translate(&address_space_memory,
                                   iotlb->translated_addr,
 -                                 &xlat, &len, writable);
 +                                 &xlat, &len, writable,
 +                                 MEMTXATTRS_UNSPECIFIED);
      if (!memory_region_is_ram(mr)) {
          error_report("iommu map to non memory area %"HWADDR_PRIx"",
                       xlat);
 diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory_ldst.inc.c
 +++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, false);
 +    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
      if (l < 4 || !IS_DIRECT(mr, false)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, false);
 +    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
      if (l < 8 || !IS_DIRECT(mr, false)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, false);
 +    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
      if (!IS_DIRECT(mr, false)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, false);
 +    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
      if (l < 2 || !IS_DIRECT(mr, false)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, true);
 +    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 4 || !IS_DIRECT(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, true);
 +    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 4 || !IS_DIRECT(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, true);
 +    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (!IS_DIRECT(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
          r = memory_region_dispatch_write(mr, addr1, val, 1, attrs);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, true);
 +    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 2 || !IS_DIRECT(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
      bool release_lock = false;
      RCU_READ_LOCK();
 -    mr = TRANSLATE(addr, &addr1, &l, true);
 +    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
      if (l < 8 || !IS_DIRECT(mr, true)) {
          release_lock |= prepare_mmio_access(mr);
 diff --git a/target/riscv/helper.c b/target/riscv/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.c
 +++ b/target/riscv/helper.c
@@ -XXX,XX +XXX,XX @@ restart:
                  MemoryRegion *mr;
                  hwaddr l = sizeof(target_ulong), addr1;
                  mr = address_space_translate(cs->as, pte_addr,
 -                    &addr1, &l, false);
 +                    &addr1, &l, false, MEMTXATTRS_UNSPECIFIED);
                  if (memory_access_is_direct(mr, true)) {
                      target_ulong *pte_pa =
                          qemu_map_ram_ptr(mr->ram_block, addr1);
 --
 .17.1

-[Qemu-devel] [PULL 14/18] hw/arm/mps2: Add timers
+[Qemu-devel] [PULL 13/25] Make address_space_map() take a MemTxAttrs argument
-Add the CMSDK APB timers to the MPS2 board.
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to address_space_map().
 Its callers either have an attrs value to hand, or don't care
 and can use MEMTXATTRS_UNSPECIFIED.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1500029487-14822-6-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-5-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 4 ++++
+ include/exec/memory.h   | 3 ++-
-file changed, 4 insertions(+)
+ include/sysemu/dma.h    | 3 ++-
  exec.c                  | 6 ++++--
  target/ppc/mmu-hash64.c | 3 ++-
 files changed, 10 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/include/exec/memory.h
-+++ b/hw/arm/mps2.c
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_
- #include "sysemu/sysemu.h"
+  * @addr: address within that address space
- #include "hw/misc/unimp.h"
+  * @plen: pointer to length of buffer; updated on return
- #include "hw/char/cmsdk-apb-uart.h"
+  * @is_write: indicates the transfer direction
-+#include "hw/timer/cmsdk-apb-timer.h"
++ * @attrs: memory attributes
+  */
- typedef enum MPS2FPGAType {
+ void *address_space_map(AddressSpace *as, hwaddr addr,
-     FPGA_AN385,
+-                        hwaddr *plen, bool is_write);
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
++                        hwaddr *plen, bool is_write, MemTxAttrs attrs);
-         g_assert_not_reached();
  /* address_space_unmap: Unmaps a memory region previously mapped by address_space_map()
   *
 diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/dma.h
 +++ b/include/sysemu/dma.h
@@ -XXX,XX +XXX,XX @@ static inline void *dma_memory_map(AddressSpace *as,
      hwaddr xlen = *len;
      void *p;
 -    p = address_space_map(as, addr, &xlen, dir == DMA_DIRECTION_FROM_DEVICE);
 +    p = address_space_map(as, addr, &xlen, dir == DMA_DIRECTION_FROM_DEVICE,
 +                          MEMTXATTRS_UNSPECIFIED);
      *len = xlen;
      return p;
  }
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ flatview_extend_translation(FlatView *fv, hwaddr addr,
  void *address_space_map(AddressSpace *as,
                          hwaddr addr,
                          hwaddr *plen,
 -                        bool is_write)
 +                        bool is_write,
 +                        MemTxAttrs attrs)
  {
      hwaddr len = *plen;
      hwaddr l, xlat;
@@ -XXX,XX +XXX,XX @@ void *cpu_physical_memory_map(hwaddr addr,
                                hwaddr *plen,
                                int is_write)
  {
 -    return address_space_map(&address_space_memory, addr, plen, is_write);
 +    return address_space_map(&address_space_memory, addr, plen, is_write,
 +                             MEMTXATTRS_UNSPECIFIED);
  }
  void cpu_physical_memory_unmap(void *buffer, hwaddr len,
 diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/mmu-hash64.c
 +++ b/target/ppc/mmu-hash64.c
@@ -XXX,XX +XXX,XX @@ const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
          return NULL;
      }
-+    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
+-    hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false);
-+    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
++    hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false,
-+
++                              MEMTXATTRS_UNSPECIFIED);
-     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+     if (plen < (n * HASH_PTE_SIZE_64)) {
+         hw_error("%s: Unable to map all requested HPTEs\n", __func__);
-     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+     }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 09/18] target/arm: use DISAS_EXIT for eret handling
+[Qemu-devel] [PULL 14/25] Make address_space_access_valid() take a MemTxAttrs argument
-From: Alex Bennée <alex.bennee@linaro.org>
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to address_space_access_valid().
 Its callers either have an attrs value to hand, or don't care
 and can use MEMTXATTRS_UNSPECIFIED.
-Previously DISAS_JUMP did ensure this but with the optimisation of
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-a6b28c7 (optimize indirect branches) we might not leave the loop.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-This means if any pending interrupts are cleared by changing IRQ flags
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-we might never get around to servicing them. You usually notice this
+Message-id: 20180521140402.23318-6-peter.maydell@linaro.org
-by seeing the lookup_tb_ptr() helper gainfully chaining TBs together
+---
-while cpu->interrupt_request remains high and the exit_request has not
+ include/exec/memory.h      | 4 +++-
-been set.
+ include/sysemu/dma.h       | 3 ++-
  exec.c                     | 3 ++-
  target/s390x/diag.c        | 6 ++++--
  target/s390x/excp_helper.c | 3 ++-
  target/s390x/mmu_helper.c  | 3 ++-
  target/s390x/sigp.c        | 3 ++-
 files changed, 17 insertions(+), 8 deletions(-)
-This breaks amongst other things the OPTEE test suite which executes
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 an eret from the secure world after a non-secure world IRQ has gone
 pending which then never gets serviced.
 Instead of using the previously implied semantics of DISAS_JUMP we use
 DISAS_EXIT which will always exit the run-loop.
 CC: Etienne Carriere <etienne.carriere@linaro.org>
 CC: Joakim Bech <joakim.bech@linaro.org>
 CC: Jaroslaw Pelczar <j.pelczar@samsung.com>
 CC: Peter Maydell <peter.maydell@linaro.org>
 CC: Emilio G. Cota <cota@braap.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <rth@twiddle.net>
 Message-id: 20170713141928.25419-7-alex.bennee@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 3 ++-
  target/arm/translate.c     | 6 ++++--
 files changed, 6 insertions(+), 3 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/exec/memory.h
-+++ b/target/arm/translate-a64.c
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate(AddressSpace *as,
   * @addr: address within that address space
   * @len: length of the area to be checked
   * @is_write: indicates the transfer direction
 + * @attrs: memory attributes
   */
 -bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write);
 +bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len,
 +                                bool is_write, MemTxAttrs attrs);
  /* address_space_map: map a physical memory region into a host virtual address
   *
 diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/dma.h
 +++ b/include/sysemu/dma.h
@@ -XXX,XX +XXX,XX @@ static inline bool dma_memory_valid(AddressSpace *as,
                                      DMADirection dir)
  {
      return address_space_access_valid(as, addr, len,
 -                                      dir == DMA_DIRECTION_FROM_DEVICE);
 +                                      dir == DMA_DIRECTION_FROM_DEVICE,
 +                                      MEMTXATTRS_UNSPECIFIED);
  }
  static inline int dma_memory_rw_relaxed(AddressSpace *as, dma_addr_t addr,
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
  }
  bool address_space_access_valid(AddressSpace *as, hwaddr addr,
 -                                int len, bool is_write)
 +                                int len, bool is_write,
 +                                MemTxAttrs attrs)
  {
      FlatView *fv;
      bool result;
 diff --git a/target/s390x/diag.c b/target/s390x/diag.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/diag.c
 +++ b/target/s390x/diag.c
@@ -XXX,XX +XXX,XX @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
              return;
          }
-         gen_helper_exception_return(cpu_env);
+         if (!address_space_access_valid(&address_space_memory, addr,
--        s->is_jmp = DISAS_JUMP;
+-                                        sizeof(IplParameterBlock), false)) {
-+        /* Must exit loop to check un-masked IRQs */
++                                        sizeof(IplParameterBlock), false,
-+        s->is_jmp = DISAS_EXIT;
++                                        MEMTXATTRS_UNSPECIFIED)) {
              s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
              return;
          }
@@ -XXX,XX +XXX,XX @@ out:
              return;
          }
          if (!address_space_access_valid(&address_space_memory, addr,
 -                                        sizeof(IplParameterBlock), true)) {
 +                                        sizeof(IplParameterBlock), true,
 +                                        MEMTXATTRS_UNSPECIFIED)) {
              s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
              return;
          }
 diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/excp_helper.c
 +++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ int s390_cpu_handle_mmu_fault(CPUState *cs, vaddr orig_vaddr, int size,
      /* check out of RAM access */
      if (!address_space_access_valid(&address_space_memory, raddr,
 -                                    TARGET_PAGE_SIZE, rw)) {
 +                                    TARGET_PAGE_SIZE, rw,
 +                                    MEMTXATTRS_UNSPECIFIED)) {
          DPRINTF("%s: raddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,
                  (uint64_t)raddr, (uint64_t)ram_size);
          trigger_pgm_exception(env, PGM_ADDRESSING, ILEN_AUTO);
 diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/mmu_helper.c
 +++ b/target/s390x/mmu_helper.c
@@ -XXX,XX +XXX,XX @@ static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
              return ret;
          }
          if (!address_space_access_valid(&address_space_memory, pages[i],
 -                                        TARGET_PAGE_SIZE, is_write)) {
 +                                        TARGET_PAGE_SIZE, is_write,
 +                                        MEMTXATTRS_UNSPECIFIED)) {
              trigger_access_exception(env, PGM_ADDRESSING, ILEN_AUTO, 0);
              return -EFAULT;
          }
 diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/s390x/sigp.c
 +++ b/target/s390x/sigp.c
@@ -XXX,XX +XXX,XX @@ static void sigp_set_prefix(CPUState *cs, run_on_cpu_data arg)
      cpu_synchronize_state(cs);
      if (!address_space_access_valid(&address_space_memory, addr,
 -                                    sizeof(struct LowCore), false)) {
 +                                    sizeof(struct LowCore), false,
 +                                    MEMTXATTRS_UNSPECIFIED)) {
          set_sigp_status(si, SIGP_STAT_INVALID_PARAMETER);
          return;
-     case 5: /* DRPS */
+     }
          if (rn != 0x1f) {
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
       */
      gen_helper_cpsr_write_eret(cpu_env, cpsr);
      tcg_temp_free_i32(cpsr);
 -    s->is_jmp = DISAS_JUMP;
 +    /* Must exit loop to check un-masked IRQs */
 +    s->is_jmp = DISAS_EXIT;
  }
  /* Generate an old-style exception return. Marks pc as dead. */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                      tmp = load_cpu_field(spsr);
                      gen_helper_cpsr_write_eret(cpu_env, tmp);
                      tcg_temp_free_i32(tmp);
 -                    s->is_jmp = DISAS_JUMP;
 +                    /* Must exit loop to check un-masked IRQs */
 +                    s->is_jmp = DISAS_EXIT;
                  }
              }
              break;
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 17/18] hw/arm/mps2: Add ethernet
+[Qemu-devel] [PULL 15/25] Make flatview_extend_translation() take a MemTxAttrs argument
-The MPS2 FPGA images support ethernet via a LAN9220. We use
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
-QEMU's LAN9118 model, which is software compatible except
+add MemTxAttrs as an argument to flatview_extend_translation().
-that it is missing the checksum-offload feature.
+Its callers either have an attrs value to hand, or don't care
 and can use MEMTXATTRS_UNSPECIFIED.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1500029487-14822-9-git-send-email-peter.maydell@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-7-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 10 +++++++++-
+ exec.c | 15 ++++++++++-----
-file changed, 9 insertions(+), 1 deletion(-)
+file changed, 10 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/exec.c
-+++ b/hw/arm/mps2.c
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr,
- #include "hw/char/cmsdk-apb-uart.h"
- #include "hw/timer/cmsdk-apb-timer.h"
+ static hwaddr
- #include "hw/misc/mps2-scc.h"
+ flatview_extend_translation(FlatView *fv, hwaddr addr,
-+#include "hw/devices.h"
+-                                 hwaddr target_len,
-+#include "net/net.h"
+-                                 MemoryRegion *mr, hwaddr base, hwaddr len,
+-                                 bool is_write)
- typedef enum MPS2FPGAType {
++                            hwaddr target_len,
-     FPGA_AN385,
++                            MemoryRegion *mr, hwaddr base, hwaddr len,
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
++                            bool is_write, MemTxAttrs attrs)
-     create_unimplemented_device("Extra peripheral region @0x40020000",
+ {
-x40020000, 0x00010000);
+     hwaddr done = 0;
-     create_unimplemented_device("RESERVED 4", 0x40030000, 0x001D0000);
+     hwaddr xlat;
--    create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
+@@ -XXX,XX +XXX,XX @@ void *address_space_map(AddressSpace *as,
-     create_unimplemented_device("VGA", 0x41000000, 0x0200000);
+     memory_region_ref(mr);
-     switch (mmc->fpga_type) {
+     *plen = flatview_extend_translation(fv, addr, len, mr, xlat,
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+-                                             l, is_write);
-                              &error_fatal);
++                                        l, is_write, attrs);
-     sysbus_mmio_map(SYS_BUS_DEVICE(sccdev), 0, 0x4002f000);
+     ptr = qemu_ram_ptr_length(mr->ram_block, xlat, plen, true);
+     rcu_read_unlock();
-+    /* In hardware this is a LAN9220; the LAN9118 is software compatible
-+     * except that it doesn't support the checksum-offload feature.
+@@ -XXX,XX +XXX,XX @@ int64_t address_space_cache_init(MemoryRegionCache *cache,
-+     */
+     mr = cache->mrs.mr;
-+    lan9118_init(&nd_table[0], 0x40200000,
+     memory_region_ref(mr);
-+                 qdev_get_gpio_in(armv7m,
+     if (memory_access_is_direct(mr, is_write)) {
-+                                  mmc->fpga_type == FPGA_AN385 ? 13 : 47));
++        /* We don't care about the memory attributes here as we're only
-+
++         * doing this if we found actual RAM, which behaves the same
-     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
++         * regardless of attributes; so UNSPECIFIED is fine.
++         */
-     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+         l = flatview_extend_translation(cache->fv, addr, len, mr,
 -                                        cache->xlat, l, is_write);
 +                                        cache->xlat, l, is_write,
 +                                        MEMTXATTRS_UNSPECIFIED);
          cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, &l, true);
      } else {
          cache->ptr = NULL;
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 13/18] hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device
+[Qemu-devel] [PULL 16/25] Make memory_region_access_valid() take a MemTxAttrs argument
-Implement a model of the simple timer device found in the CMSDK.
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to memory_region_access_valid().
 Its callers either have an attrs value to hand, or don't care
 and can use MEMTXATTRS_UNSPECIFIED.
 The callsite in flatview_access_valid() is part of a recursive
 loop flatview_access_valid() -> memory_region_access_valid() ->
  subpage_accepts() -> flatview_access_valid(); we make it pass
 MEMTXATTRS_UNSPECIFIED for now, until the next several commits
 have plumbed an attrs parameter through the rest of the loop
 and we can add an attrs parameter to flatview_access_valid().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1500029487-14822-5-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-8-peter.maydell@linaro.org
 ---
- hw/timer/Makefile.objs             |   1 +
+ include/exec/memory-internal.h | 3 ++-
- include/hw/timer/cmsdk-apb-timer.h |  59 +++++++++
+ exec.c                         | 4 +++-
- hw/timer/cmsdk-apb-timer.c         | 253 +++++++++++++++++++++++++++++++++++++
+ hw/s390x/s390-pci-inst.c       | 3 ++-
- default-configs/arm-softmmu.mak    |   1 +
+ memory.c                       | 7 ++++---
- hw/timer/trace-events              |   5 +
+files changed, 11 insertions(+), 6 deletions(-)
 files changed, 319 insertions(+)
  create mode 100644 include/hw/timer/cmsdk-apb-timer.h
  create mode 100644 hw/timer/cmsdk-apb-timer.c
-diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
+diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/Makefile.objs
+--- a/include/exec/memory-internal.h
-+++ b/hw/timer/Makefile.objs
++++ b/include/exec/memory-internal.h
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_STM32F2XX_TIMER) += stm32f2xx_timer.o
+@@ -XXX,XX +XXX,XX @@ void flatview_unref(FlatView *view);
- common-obj-$(CONFIG_ASPEED_SOC) += aspeed_timer.o
+ extern const MemoryRegionOps unassigned_mem_ops;
- common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
+ bool memory_region_access_valid(MemoryRegion *mr, hwaddr addr,
-+common-obj-$(CONFIG_CMSDK_APB_TIMER) += cmsdk-apb-timer.o
+-                                unsigned size, bool is_write);
-diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
++                                unsigned size, bool is_write,
-new file mode 100644
++                                MemTxAttrs attrs);
-index XXXXXXX..XXXXXXX
---- /dev/null
+ void flatview_add_to_dispatch(FlatView *fv, MemoryRegionSection *section);
-+++ b/include/hw/timer/cmsdk-apb-timer.h
+ AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv);
-@@ -XXX,XX +XXX,XX @@
+diff --git a/exec.c b/exec.c
 +/*
 + * ARM CMSDK APB timer emulation
 + *
 + * Copyright (c) 2017 Linaro Limited
 + * Written by Peter Maydell
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +#ifndef CMSDK_APB_TIMER_H
 +#define CMSDK_APB_TIMER_H
 +
 +#include "hw/sysbus.h"
 +#include "hw/ptimer.h"
 +
 +#define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
 +#define CMSDK_APB_TIMER(obj) OBJECT_CHECK(CMSDKAPBTIMER, (obj), \
 +                                         TYPE_CMSDK_APB_TIMER)
 +
 +typedef struct {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion iomem;
 +    qemu_irq timerint;
 +    uint32_t pclk_frq;
 +    struct ptimer_state *timer;
 +
 +    uint32_t ctrl;
 +    uint32_t value;
 +    uint32_t reload;
 +    uint32_t intstatus;
 +} CMSDKAPBTIMER;
 +
 +/**
 + * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
 + * @addr: location in system memory to map registers
 + * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
 + */
 +static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
 +                                                 qemu_irq timerint,
 +                                                 uint32_t pclk_frq)
 +{
 +    DeviceState *dev;
 +    SysBusDevice *s;
 +
 +    dev = qdev_create(NULL, TYPE_CMSDK_APB_TIMER);
 +    s = SYS_BUS_DEVICE(dev);
 +    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
 +    qdev_init_nofail(dev);
 +    sysbus_mmio_map(s, 0, addr);
 +    sysbus_connect_irq(s, 0, timerint);
 +    return dev;
 +}
 +
 +#endif
 diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM CMSDK APB timer emulation
 + *
 + * Copyright (c) 2017 Linaro Limited
 + * Written by Peter Maydell
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +/* This is a model of the "APB timer" which is part of the Cortex-M
 + * System Design Kit (CMSDK) and documented in the Cortex-M System
 + * Design Kit Technical Reference Manual (ARM DDI0479C):
 + * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
 + *
 + * The hardware has an EXTIN input wire, which can be configured
 + * by the guest to act either as a 'timer enable' (timer does not run
 + * when EXTIN is low), or as a 'timer clock' (timer runs at frequency
 + * of EXTIN clock, not PCLK frequency). We don't model this.
 + *
 + * The documentation is not very clear about the exact behaviour;
 + * we choose to implement that the interrupt is triggered when
 + * the counter goes from 1 to 0, that the counter then holds at 0
 + * for one clock cycle before reloading from the RELOAD register,
 + * and that if the RELOAD register is 0 this does not cause an
 + * interrupt (as there is no further 1->0 transition).
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qemu/main-loop.h"
 +#include "qapi/error.h"
 +#include "trace.h"
 +#include "hw/sysbus.h"
 +#include "hw/registerfields.h"
 +#include "hw/timer/cmsdk-apb-timer.h"
 +
 +REG32(CTRL, 0)
 +    FIELD(CTRL, EN, 0, 1)
 +    FIELD(CTRL, SELEXTEN, 1, 1)
 +    FIELD(CTRL, SELEXTCLK, 2, 1)
 +    FIELD(CTRL, IRQEN, 3, 1)
 +REG32(VALUE, 4)
 +REG32(RELOAD, 8)
 +REG32(INTSTATUS, 0xc)
 +    FIELD(INTSTATUS, IRQ, 0, 1)
 +REG32(PID4, 0xFD0)
 +REG32(PID5, 0xFD4)
 +REG32(PID6, 0xFD8)
 +REG32(PID7, 0xFDC)
 +REG32(PID0, 0xFE0)
 +REG32(PID1, 0xFE4)
 +REG32(PID2, 0xFE8)
 +REG32(PID3, 0xFEC)
 +REG32(CID0, 0xFF0)
 +REG32(CID1, 0xFF4)
 +REG32(CID2, 0xFF8)
 +REG32(CID3, 0xFFC)
 +
 +/* PID/CID values */
 +static const int timer_id[] = {
 +    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
 +    0x22, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
 +    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 +};
 +
 +static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
 +{
 +    qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
 +}
 +
 +static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
 +    uint64_t r;
 +
 +    switch (offset) {
 +    case A_CTRL:
 +        r = s->ctrl;
 +        break;
 +    case A_VALUE:
 +        r = ptimer_get_count(s->timer);
 +        break;
 +    case A_RELOAD:
 +        r = ptimer_get_limit(s->timer);
 +        break;
 +    case A_INTSTATUS:
 +        r = s->intstatus;
 +        break;
 +    case A_PID4 ... A_CID3:
 +        r = timer_id[(offset - A_PID4) / 4];
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB timer read: bad offset %x\n", (int) offset);
 +        r = 0;
 +        break;
 +    }
 +    trace_cmsdk_apb_timer_read(offset, r, size);
 +    return r;
 +}
 +
 +static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
 +                                  unsigned size)
 +{
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
 +
 +    trace_cmsdk_apb_timer_write(offset, value, size);
 +
 +    switch (offset) {
 +    case A_CTRL:
 +        if (value & 6) {
 +            /* Bits [1] and [2] enable using EXTIN as either clock or
 +             * an enable line. We don't model this.
 +             */
 +            qemu_log_mask(LOG_UNIMP,
 +                          "CMSDK APB timer: EXTIN input not supported\n");
 +        }
 +        s->ctrl = value & 0xf;
 +        if (s->ctrl & R_CTRL_EN_MASK) {
 +            ptimer_run(s->timer, 0);
 +        } else {
 +            ptimer_stop(s->timer);
 +        }
 +        break;
 +    case A_RELOAD:
 +        /* Writing to reload also sets the current timer value */
 +        ptimer_set_limit(s->timer, value, 1);
 +        break;
 +    case A_VALUE:
 +        ptimer_set_count(s->timer, value);
 +        break;
 +    case A_INTSTATUS:
 +        /* Just one bit, which is W1C. */
 +        value &= 1;
 +        s->intstatus &= ~value;
 +        cmsdk_apb_timer_update(s);
 +        break;
 +    case A_PID4 ... A_CID3:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB timer write: write to RO offset 0x%x\n",
 +                      (int)offset);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB timer write: bad offset 0x%x\n", (int) offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps cmsdk_apb_timer_ops = {
 +    .read = cmsdk_apb_timer_read,
 +    .write = cmsdk_apb_timer_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void cmsdk_apb_timer_tick(void *opaque)
 +{
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
 +
 +    if (s->ctrl & R_CTRL_IRQEN_MASK) {
 +        s->intstatus |= R_INTSTATUS_IRQ_MASK;
 +        cmsdk_apb_timer_update(s);
 +    }
 +}
 +
 +static void cmsdk_apb_timer_reset(DeviceState *dev)
 +{
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
 +
 +    trace_cmsdk_apb_timer_reset();
 +    s->ctrl = 0;
 +    s->intstatus = 0;
 +    ptimer_stop(s->timer);
 +    /* Set the limit and the count */
 +    ptimer_set_limit(s->timer, 0, 1);
 +}
 +
 +static void cmsdk_apb_timer_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
 +                          s, "cmsdk-apb-timer", 0x1000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->timerint);
 +}
 +
 +static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 +{
 +    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
 +    QEMUBH *bh;
 +
 +    if (s->pclk_frq == 0) {
 +        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
 +        return;
 +    }
 +
 +    bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
 +    s->timer = ptimer_init(bh,
 +                           PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
 +                           PTIMER_POLICY_NO_IMMEDIATE_TRIGGER |
 +                           PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
 +                           PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 +
 +    ptimer_set_freq(s->timer, s->pclk_frq);
 +}
 +
 +static const VMStateDescription cmsdk_apb_timer_vmstate = {
 +    .name = "cmsdk-apb-timer",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
 +        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
 +        VMSTATE_UINT32(value, CMSDKAPBTIMER),
 +        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
 +        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property cmsdk_apb_timer_properties[] = {
 +    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = cmsdk_apb_timer_realize;
 +    dc->vmsd = &cmsdk_apb_timer_vmstate;
 +    dc->reset = cmsdk_apb_timer_reset;
 +    dc->props = cmsdk_apb_timer_properties;
 +}
 +
 +static const TypeInfo cmsdk_apb_timer_info = {
 +    .name = TYPE_CMSDK_APB_TIMER,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(CMSDKAPBTIMER),
 +    .instance_init = cmsdk_apb_timer_init,
 +    .class_init = cmsdk_apb_timer_class_init,
 +};
 +
 +static void cmsdk_apb_timer_register_types(void)
 +{
 +    type_register_static(&cmsdk_apb_timer_info);
 +}
 +
 +type_init(cmsdk_apb_timer_register_types);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
+--- a/exec.c
-+++ b/default-configs/arm-softmmu.mak
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_ADC=y
+@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
- CONFIG_STM32F2XX_SPI=y
+         mr = flatview_translate(fv, addr, &xlat, &l, is_write);
- CONFIG_STM32F205_SOC=y
+         if (!memory_access_is_direct(mr, is_write)) {
+             l = memory_access_size(mr, l, addr);
-+CONFIG_CMSDK_APB_TIMER=y
+-            if (!memory_region_access_valid(mr, xlat, l, is_write)) {
- CONFIG_CMSDK_APB_UART=y
++            /* When our callers all have attrs we'll pass them through here */
++            if (!memory_region_access_valid(mr, xlat, l, is_write,
- CONFIG_VERSATILE_PCI=y
++                                            MEMTXATTRS_UNSPECIFIED)) {
-diff --git a/hw/timer/trace-events b/hw/timer/trace-events
+                 return false;
              }
          }
 diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/trace-events
+--- a/hw/s390x/s390-pci-inst.c
-+++ b/hw/timer/trace-events
++++ b/hw/s390x/s390-pci-inst.c
-@@ -XXX,XX +XXX,XX @@ systick_reload(void) "systick reload"
+@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
- systick_timer_tick(void) "systick reload"
+     mr = s390_get_subregion(mr, offset, len);
- systick_read(uint64_t addr, uint32_t value, unsigned size) "systick read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
+     offset -= mr->addr;
- systick_write(uint64_t addr, uint32_t value, unsigned size) "systick write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
-+
+-    if (!memory_region_access_valid(mr, offset, len, true)) {
-+# hw/char/cmsdk_apb_timer.c
++    if (!memory_region_access_valid(mr, offset, len, true,
-+cmsdk_apb_timer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++                                    MEMTXATTRS_UNSPECIFIED)) {
-+cmsdk_apb_timer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
-+cmsdk_apb_timer_reset(void) "CMSDK APB timer: reset"
+         return 0;
      }
 diff --git a/memory.c b/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory.c
 +++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ram_device_mem_ops = {
  bool memory_region_access_valid(MemoryRegion *mr,
                                  hwaddr addr,
                                  unsigned size,
 -                                bool is_write)
 +                                bool is_write,
 +                                MemTxAttrs attrs)
  {
      int access_size_min, access_size_max;
      int access_size, i;
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
  {
      MemTxResult r;
 -    if (!memory_region_access_valid(mr, addr, size, false)) {
 +    if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
          *pval = unassigned_mem_read(mr, addr, size);
          return MEMTX_DECODE_ERROR;
      }
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
                                           unsigned size,
                                           MemTxAttrs attrs)
  {
 -    if (!memory_region_access_valid(mr, addr, size, true)) {
 +    if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
          unassigned_mem_write(mr, addr, data, size);
          return MEMTX_DECODE_ERROR;
      }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 01/18] qdev-properties.h: Explicitly set the default value for arraylen properties
+[Qemu-devel] [PULL 17/25] Make MemoryRegion valid.accepts callback take a MemTxAttrs argument
-In DEFINE_PROP_ARRAY, because we use a PropertyInfo (qdev_prop_arraylen)
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
-which has a .set_default_value member we will set the field to a default
+add MemTxAttrs as an argument to the MemoryRegion valid.accepts
-value. That default value will be zero, by the C rule that struct
+callback. We'll need this for subpage_accepts().
-initialization sets unmentioned members to zero if at least one member
-is initialized. However it's clearer to state it explicitly.
+We could take the approach we used with the read and write
 callbacks and add new a new _with_attrs version, but since there
 are so few implementations of the accepts hook we just change
 them all.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1499788408-10096-2-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-9-peter.maydell@linaro.org
 ---
- include/hw/qdev-properties.h | 1 +
+ include/exec/memory.h |  3 ++-
-file changed, 1 insertion(+)
+ exec.c                |  9 ++++++---
  hw/hppa/dino.c        |  3 ++-
  hw/nvram/fw_cfg.c     | 12 ++++++++----
  hw/scsi/esp.c         |  3 ++-
  hw/xen/xen_pt_msi.c   |  3 ++-
  memory.c              |  5 +++--
 files changed, 25 insertions(+), 13 deletions(-)
-diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-properties.h
+--- a/include/exec/memory.h
-+++ b/include/hw/qdev-properties.h
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
+@@ -XXX,XX +XXX,XX @@ struct MemoryRegionOps {
-                           _arrayfield, _arrayprop, _arraytype) {        \
+          * as a machine check exception).
-         .name = (PROP_ARRAY_LEN_PREFIX _name),                          \
+          */
-         .info = &(qdev_prop_arraylen),                                  \
+         bool (*accepts)(void *opaque, hwaddr addr,
-+        .defval.u = 0,                                                  \
+-                        unsigned size, bool is_write);
-         .offset = offsetof(_state, _field)                              \
++                        unsigned size, bool is_write,
-             + type_check(uint32_t, typeof_field(_state, _field)),       \
++                        MemTxAttrs attrs);
-         .arrayinfo = &(_arrayprop),                                     \
+     } valid;
      /* Internal implementation constraints: */
      struct {
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
  }
  static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
 -                                 unsigned size, bool is_write)
 +                                 unsigned size, bool is_write,
 +                                 MemTxAttrs attrs)
  {
      return is_write;
  }
@@ -XXX,XX +XXX,XX @@ static MemTxResult subpage_write(void *opaque, hwaddr addr,
  }
  static bool subpage_accepts(void *opaque, hwaddr addr,
 -                            unsigned len, bool is_write)
 +                            unsigned len, bool is_write,
 +                            MemTxAttrs attrs)
  {
      subpage_t *subpage = opaque;
  #if defined(DEBUG_SUBPAGE)
@@ -XXX,XX +XXX,XX @@ static void readonly_mem_write(void *opaque, hwaddr addr,
  }
  static bool readonly_mem_accepts(void *opaque, hwaddr addr,
 -                                 unsigned size, bool is_write)
 +                                 unsigned size, bool is_write,
 +                                 MemTxAttrs attrs)
  {
      return is_write;
  }
 diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/hppa/dino.c
 +++ b/hw/hppa/dino.c
@@ -XXX,XX +XXX,XX @@ static void gsc_to_pci_forwarding(DinoState *s)
  }
  static bool dino_chip_mem_valid(void *opaque, hwaddr addr,
 -                                unsigned size, bool is_write)
 +                                unsigned size, bool is_write,
 +                                MemTxAttrs attrs)
  {
      switch (addr) {
      case DINO_IAR0:
 diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/nvram/fw_cfg.c
 +++ b/hw/nvram/fw_cfg.c
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
  }
  static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
 -                                  unsigned size, bool is_write)
 +                                 unsigned size, bool is_write,
 +                                 MemTxAttrs attrs)
  {
      return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
                           (size == 8 && addr == 0));
  }
  static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
 -                                  unsigned size, bool is_write)
 +                                  unsigned size, bool is_write,
 +                                  MemTxAttrs attrs)
  {
      return addr == 0;
  }
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
  }
  static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
 -                                 unsigned size, bool is_write)
 +                                 unsigned size, bool is_write,
 +                                 MemTxAttrs attrs)
  {
      return is_write && size == 2;
  }
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_comb_write(void *opaque, hwaddr addr,
  }
  static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
 -                                  unsigned size, bool is_write)
 +                              unsigned size, bool is_write,
 +                              MemTxAttrs attrs)
  {
      return (size == 1) || (is_write && size == 2);
  }
 diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/scsi/esp.c
 +++ b/hw/scsi/esp.c
@@ -XXX,XX +XXX,XX @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
  }
  static bool esp_mem_accepts(void *opaque, hwaddr addr,
 -                            unsigned size, bool is_write)
 +                            unsigned size, bool is_write,
 +                            MemTxAttrs attrs)
  {
      return (size == 1) || (is_write && size == 4);
  }
 diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/xen/xen_pt_msi.c
 +++ b/hw/xen/xen_pt_msi.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pci_msix_read(void *opaque, hwaddr addr,
  }
  static bool pci_msix_accepts(void *opaque, hwaddr addr,
 -                             unsigned size, bool is_write)
 +                             unsigned size, bool is_write,
 +                             MemTxAttrs attrs)
  {
      return !(addr & (size - 1));
  }
 diff --git a/memory.c b/memory.c
 index XXXXXXX..XXXXXXX 100644
 --- a/memory.c
 +++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static void unassigned_mem_write(void *opaque, hwaddr addr,
  }
  static bool unassigned_mem_accepts(void *opaque, hwaddr addr,
 -                                   unsigned size, bool is_write)
 +                                   unsigned size, bool is_write,
 +                                   MemTxAttrs attrs)
  {
      return false;
  }
@@ -XXX,XX +XXX,XX @@ bool memory_region_access_valid(MemoryRegion *mr,
      access_size = MAX(MIN(size, access_size_max), access_size_min);
      for (i = 0; i < size; i += access_size) {
          if (!mr->ops->valid.accepts(mr->opaque, addr + i, access_size,
 -                                    is_write)) {
 +                                    is_write, attrs)) {
              return false;
          }
      }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 16/18] hw/arm/mps2: Add SCC
+[Qemu-devel] [PULL 18/25] Make flatview_access_valid() take a MemTxAttrs argument
-Add the SCC to the MPS2 board models.
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
 add MemTxAttrs as an argument to flatview_access_valid().
 Its callers now all have an attrs value to hand, so we can
 correct our earlier temporary use of MEMTXATTRS_UNSPECIFIED.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1500029487-14822-8-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-10-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 17 ++++++++++++++++-
+ exec.c | 12 +++++-------
-file changed, 16 insertions(+), 1 deletion(-)
+file changed, 5 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/exec.c
-+++ b/hw/arm/mps2.c
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
- #include "hw/misc/unimp.h"
+ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
- #include "hw/char/cmsdk-apb-uart.h"
+                                   const uint8_t *buf, int len);
- #include "hw/timer/cmsdk-apb-timer.h"
+ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
-+#include "hw/misc/mps2-scc.h"
+-                                  bool is_write);
++                                  bool is_write, MemTxAttrs attrs);
- typedef enum MPS2FPGAType {
-     FPGA_AN385,
+ static MemTxResult subpage_read(void *opaque, hwaddr addr, uint64_t *data,
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+                                 unsigned len, MemTxAttrs attrs)
-     MachineClass parent;
+@@ -XXX,XX +XXX,XX @@ static bool subpage_accepts(void *opaque, hwaddr addr,
-     MPS2FPGAType fpga_type;
+ #endif
-     const char *cpu_model;
-+    uint32_t scc_id;
+     return flatview_access_valid(subpage->fv, addr + subpage->base,
- } MPS2MachineClass;
+-                                 len, is_write);
++                                 len, is_write, attrs);
  typedef struct {
@@ -XXX,XX +XXX,XX @@ typedef struct {
      MemoryRegion blockram_m2;
      MemoryRegion blockram_m3;
      MemoryRegion sram;
 +    MPS2SCC scc;
  } MPS2MachineState;
  #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      MPS2MachineState *mms = MPS2_MACHINE(machine);
      MPS2MachineClass *mmc = MPS2_MACHINE_GET_CLASS(machine);
      MemoryRegion *system_memory = get_system_memory();
 -    DeviceState *armv7m;
 +    DeviceState *armv7m, *sccdev;
      if (!machine->cpu_model) {
          machine->cpu_model = mmc->cpu_model;
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
      cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
 +    object_initialize(&mms->scc, sizeof(mms->scc), TYPE_MPS2_SCC);
 +    sccdev = DEVICE(&mms->scc);
 +    qdev_set_parent_bus(armv7m, sysbus_get_default());
 +    qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
 +    qdev_prop_set_uint32(sccdev, "scc-aid", 0x02000008);
 +    qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
 +    object_property_set_bool(OBJECT(&mms->scc), true, "realized",
 +                             &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(sccdev), 0, 0x4002f000);
 +
      system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
      armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
@@ -XXX,XX +XXX,XX @@ static void mps2_an385_class_init(ObjectClass *oc, void *data)
      mc->desc = "ARM MPS2 with AN385 FPGA image for Cortex-M3";
      mmc->fpga_type = FPGA_AN385;
      mmc->cpu_model = "cortex-m3";
 +    mmc->scc_id = 0x41040000 | (385 << 4);
  }
- static void mps2_an511_class_init(ObjectClass *oc, void *data)
+ static const MemoryRegionOps subpage_ops = {
-@@ -XXX,XX +XXX,XX @@ static void mps2_an511_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void cpu_notify_map_clients(void)
      mc->desc = "ARM MPS2 with AN511 DesignStart FPGA image for Cortex-M3";
      mmc->fpga_type = FPGA_AN511;
      mmc->cpu_model = "cortex-m3";
 +    mmc->scc_id = 0x4104000 | (511 << 4);
  }
- static const TypeInfo mps2_info = {
+ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
 -                                  bool is_write)
 +                                  bool is_write, MemTxAttrs attrs)
  {
      MemoryRegion *mr;
      hwaddr l, xlat;
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
          mr = flatview_translate(fv, addr, &xlat, &l, is_write);
          if (!memory_access_is_direct(mr, is_write)) {
              l = memory_access_size(mr, l, addr);
 -            /* When our callers all have attrs we'll pass them through here */
 -            if (!memory_region_access_valid(mr, xlat, l, is_write,
 -                                            MEMTXATTRS_UNSPECIFIED)) {
 +            if (!memory_region_access_valid(mr, xlat, l, is_write, attrs)) {
                  return false;
              }
          }
@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr,
      rcu_read_lock();
      fv = address_space_to_flatview(as);
 -    result = flatview_access_valid(fv, addr, len, is_write);
 +    result = flatview_access_valid(fv, addr, len, is_write, attrs);
      rcu_read_unlock();
      return result;
  }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 02/18] qdev: support properties which don't set a default value
+[Qemu-devel] [PULL 19/25] Make flatview_translate() take a MemTxAttrs argument
-In some situations it's useful to have a qdev property which doesn't
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
-automatically set its default value when qdev_property_add_static is
+add MemTxAttrs as an argument to flatview_translate(); all its
-called (for instance when the default value is not constant).
+callers now have attrs available.
-Support this by adding a flag to the Property struct indicating
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-whether to set the default value.  This replaces the existing test
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-for whether the PropertyInfo set_default_value function pointer is
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-NULL, and we set the .set_default field to true for all those cases
+Message-id: 20180521140402.23318-11-peter.maydell@linaro.org
-of struct Property which use a PropertyInfo with a non-NULL
+---
-set_default_value, so behaviour remains the same as before.
+ include/exec/memory.h |  7 ++++---
  exec.c                | 17 +++++++++--------
 files changed, 13 insertions(+), 11 deletions(-)
-This gives us the semantics of:
+diff --git a/include/exec/memory.h b/include/exec/memory.h
  * if .set_default is true, then .info->set_default_value must
    be not NULL, and .defval is used as the the default value of
    the property
  * otherwise, the property system does not set any default, and
    the field will retain whatever initial value it was given by
    the device's .instance_init method
 We define two new macros DEFINE_PROP_SIGNED_NODEFAULT and
 DEFINE_PROP_UNSIGNED_NODEFAULT, to cover the most plausible use cases
 of wanting to set an integer property with no default value.
 Suggested-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Markus Armbruster <armbru@redhat.com>
 Message-id: 1499788408-10096-3-git-send-email-peter.maydell@linaro.org
 ---
  include/hw/qdev-core.h       | 10 ++++++++++
  include/hw/qdev-properties.h | 20 ++++++++++++++++++++
  hw/core/qdev.c               |  2 +-
 files changed, 31 insertions(+), 1 deletion(-)
 diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-core.h
+--- a/include/exec/memory.h
-+++ b/include/hw/qdev-core.h
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ struct BusState {
+@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-     QLIST_ENTRY(BusState) sibling;
+  */
- };
+ MemoryRegion *flatview_translate(FlatView *fv,
+                                  hwaddr addr, hwaddr *xlat,
-+/**
+-                                 hwaddr *len, bool is_write);
-+ * Property:
++                                 hwaddr *len, bool is_write,
-+ * @set_default: true if the default value should be set from @defval,
++                                 MemTxAttrs attrs);
-+ *    in which case @info->set_default_value must not be NULL
-+ *    (if false then no default value is set by the property system
+ static inline MemoryRegion *address_space_translate(AddressSpace *as,
-+ *     and the field retains whatever value it was given by instance_init).
+                                                     hwaddr addr, hwaddr *xlat,
-+ * @defval: default value for the property. This is used only if @set_default
+@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate(AddressSpace *as,
-+ *     is true.
+                                                     MemTxAttrs attrs)
-+ */
+ {
- struct Property {
+     return flatview_translate(address_space_to_flatview(as),
-     const char   *name;
+-                              addr, xlat, len, is_write);
-     const PropertyInfo *info;
++                              addr, xlat, len, is_write, attrs);
-     ptrdiff_t    offset;
+ }
-     uint8_t      bitnr;
-+    bool         set_default;
+ /* address_space_access_valid: check for validity of accessing an address
-     union {
+@@ -XXX,XX +XXX,XX @@ MemTxResult address_space_read(AddressSpace *as, hwaddr addr,
-         int64_t i;
+             rcu_read_lock();
-         uint64_t u;
+             fv = address_space_to_flatview(as);
-diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
+             l = len;
 -            mr = flatview_translate(fv, addr, &addr1, &l, false);
 +            mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);
              if (len == l && memory_access_is_direct(mr, false)) {
                  ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
                  memcpy(buf, ptr, len);
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-properties.h
+--- a/exec.c
-+++ b/include/hw/qdev-properties.h
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
+@@ -XXX,XX +XXX,XX @@ iotlb_fail:
-         .info      = &(_prop),                                          \
-         .offset    = offsetof(_state, _field)                           \
+ /* Called from RCU critical section */
-             + type_check(_type,typeof_field(_state, _field)),           \
+ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,
-+        .set_default = true,                                            \
+-                                 hwaddr *plen, bool is_write)
-         .defval.i  = (_type)_defval,                                    \
++                                 hwaddr *plen, bool is_write,
 +                                 MemTxAttrs attrs)
  {
      MemoryRegion *mr;
      MemoryRegionSection section;
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write_continue(FlatView *fv, hwaddr addr,
          }
-+#define DEFINE_PROP_SIGNED_NODEFAULT(_name, _state, _field, _prop, _type) { \
+         l = len;
-+        .name      = (_name),                                           \
+-        mr = flatview_translate(fv, addr, &addr1, &l, true);
-+        .info      = &(_prop),                                          \
++        mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);
-+        .offset    = offsetof(_state, _field)                           \
+     }
-+            + type_check(_type, typeof_field(_state, _field)),          \
-+        }
+     return result;
-+
+@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
- #define DEFINE_PROP_BIT(_name, _state, _field, _bit, _defval) {  \
+     MemTxResult result = MEMTX_OK;
-         .name      = (_name),                                    \
-         .info      = &(qdev_prop_bit),                           \
+     l = len;
-         .bitnr    = (_bit),                                      \
+-    mr = flatview_translate(fv, addr, &addr1, &l, true);
-         .offset    = offsetof(_state, _field)                    \
++    mr = flatview_translate(fv, addr, &addr1, &l, true, attrs);
-             + type_check(uint32_t,typeof_field(_state, _field)), \
+     result = flatview_write_continue(fv, addr, attrs, buf, len,
-+        .set_default = true,                                     \
+                                      addr1, l, mr);
-         .defval.u  = (bool)_defval,                              \
@@ -XXX,XX +XXX,XX @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
          }
-@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
+         l = len;
-         .info      = &(_prop),                                          \
+-        mr = flatview_translate(fv, addr, &addr1, &l, false);
-         .offset    = offsetof(_state, _field)                           \
++        mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);
-             + type_check(_type, typeof_field(_state, _field)),          \
+     }
-+        .set_default = true,                                            \
-         .defval.u  = (_type)_defval,                                    \
+     return result;
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
      MemoryRegion *mr;
      l = len;
 -    mr = flatview_translate(fv, addr, &addr1, &l, false);
 +    mr = flatview_translate(fv, addr, &addr1, &l, false, attrs);
      return flatview_read_continue(fv, addr, attrs, buf, len,
                                    addr1, l, mr);
  }
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
      while (len > 0) {
          l = len;
 -        mr = flatview_translate(fv, addr, &xlat, &l, is_write);
 +        mr = flatview_translate(fv, addr, &xlat, &l, is_write, attrs);
          if (!memory_access_is_direct(mr, is_write)) {
              l = memory_access_size(mr, l, addr);
              if (!memory_region_access_valid(mr, xlat, l, is_write, attrs)) {
@@ -XXX,XX +XXX,XX @@ flatview_extend_translation(FlatView *fv, hwaddr addr,
          len = target_len;
          this_mr = flatview_translate(fv, addr, &xlat,
 -                                                   &len, is_write);
 +                                     &len, is_write, attrs);
          if (this_mr != mr || xlat != base + done) {
              return done;
          }
+@@ -XXX,XX +XXX,XX @@ void *address_space_map(AddressSpace *as,
-+#define DEFINE_PROP_UNSIGNED_NODEFAULT(_name, _state, _field, _prop, _type) { \
+     l = len;
-+        .name      = (_name),                                           \
+     rcu_read_lock();
-+        .info      = &(_prop),                                          \
+     fv = address_space_to_flatview(as);
-+        .offset    = offsetof(_state, _field)                           \
+-    mr = flatview_translate(fv, addr, &xlat, &l, is_write);
-+            + type_check(_type, typeof_field(_state, _field)),          \
++    mr = flatview_translate(fv, addr, &xlat, &l, is_write, attrs);
-+        }
-+
+     if (!memory_access_is_direct(mr, is_write)) {
- #define DEFINE_PROP_BIT64(_name, _state, _field, _bit, _defval) {       \
+         if (atomic_xchg(&bounce.in_use, true)) {
          .name      = (_name),                                           \
          .info      = &(qdev_prop_bit64),                                \
          .bitnr    = (_bit),                                             \
          .offset    = offsetof(_state, _field)                           \
              + type_check(uint64_t, typeof_field(_state, _field)),       \
 +        .set_default = true,                                            \
          .defval.u  = (bool)_defval,                                     \
          }
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
          .info      = &(qdev_prop_bool),                          \
          .offset    = offsetof(_state, _field)                    \
              + type_check(bool, typeof_field(_state, _field)),    \
 +        .set_default = true,                                     \
          .defval.u    = (bool)_defval,                            \
          }
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
                            _arrayfield, _arrayprop, _arraytype) {        \
          .name = (PROP_ARRAY_LEN_PREFIX _name),                          \
          .info = &(qdev_prop_arraylen),                                  \
 +        .set_default = true,                                            \
          .defval.u = 0,                                                  \
          .offset = offsetof(_state, _field)                              \
              + type_check(uint32_t, typeof_field(_state, _field)),       \
 diff --git a/hw/core/qdev.c b/hw/core/qdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/qdev.c
 +++ b/hw/core/qdev.c
@@ -XXX,XX +XXX,XX @@ void qdev_property_add_static(DeviceState *dev, Property *prop,
                                      prop->info->description,
                                      &error_abort);
 -    if (prop->info->set_default_value) {
 +    if (prop->set_default) {
          prop->info->set_default_value(obj, prop);
      }
  }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 11/18] hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART
+[Qemu-devel] [PULL 20/25] Make address_space_get_iotlb_entry() take a MemTxAttrs argument
-Implement a model of the simple "APB UART" provided in
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
-the Cortex-M System Design Kit (CMSDK).
+add MemTxAttrs as an argument to address_space_get_iotlb_entry().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1500029487-14822-3-git-send-email-peter.maydell@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180521140402.23318-12-peter.maydell@linaro.org
 ---
- hw/char/Makefile.objs            |   1 +
+ include/exec/memory.h | 2 +-
- include/hw/char/cmsdk-apb-uart.h |  78 ++++++++
+ exec.c                | 2 +-
- hw/char/cmsdk-apb-uart.c         | 403 +++++++++++++++++++++++++++++++++++++++
+ hw/virtio/vhost.c     | 3 ++-
- default-configs/arm-softmmu.mak  |   2 +
+files changed, 4 insertions(+), 3 deletions(-)
  hw/char/trace-events             |   9 +
 files changed, 493 insertions(+)
  create mode 100644 include/hw/char/cmsdk-apb-uart.h
  create mode 100644 hw/char/cmsdk-apb-uart.c
-diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
+diff --git a/include/exec/memory.h b/include/exec/memory.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/Makefile.objs
+--- a/include/exec/memory.h
-+++ b/hw/char/Makefile.objs
++++ b/include/exec/memory.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic-uart.o
+@@ -XXX,XX +XXX,XX @@ void address_space_cache_destroy(MemoryRegionCache *cache);
- obj-$(CONFIG_STM32F2XX_USART) += stm32f2xx_usart.o
+  * entry. Should be called from an RCU critical section.
- obj-$(CONFIG_RASPI) += bcm2835_aux.o
+  */
+ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-+common-obj-$(CONFIG_CMSDK_APB_UART) += cmsdk-apb-uart.o
+-                                            bool is_write);
- common-obj-$(CONFIG_ETRAXFS) += etraxfs_ser.o
++                                            bool is_write, MemTxAttrs attrs);
- common-obj-$(CONFIG_ISA_DEBUG) += debugcon.o
- common-obj-$(CONFIG_GRLIB) += grlib_apbuart.o
+ /* address_space_translate: translate an address range into an address space
-diff --git a/include/hw/char/cmsdk-apb-uart.h b/include/hw/char/cmsdk-apb-uart.h
+  * into a MemoryRegion and an address range into that section.  Should be
-new file mode 100644
+diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/char/cmsdk-apb-uart.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM CMSDK APB UART emulation
 + *
 + * Copyright (c) 2017 Linaro Limited
 + * Written by Peter Maydell
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +#ifndef CMSDK_APB_UART_H
 +#define CMSDK_APB_UART_H
 +
 +#include "hw/sysbus.h"
 +#include "chardev/char-fe.h"
 +
 +#define TYPE_CMSDK_APB_UART "cmsdk-apb-uart"
 +#define CMSDK_APB_UART(obj) OBJECT_CHECK(CMSDKAPBUART, (obj), \
 +                                         TYPE_CMSDK_APB_UART)
 +
 +typedef struct {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion iomem;
 +    CharBackend chr;
 +    qemu_irq txint;
 +    qemu_irq rxint;
 +    qemu_irq txovrint;
 +    qemu_irq rxovrint;
 +    qemu_irq uartint;
 +    guint watch_tag;
 +    uint32_t pclk_frq;
 +
 +    uint32_t state;
 +    uint32_t ctrl;
 +    uint32_t intstatus;
 +    uint32_t bauddiv;
 +    /* This UART has no FIFO, only a 1-character buffer for each of Tx and Rx */
 +    uint8_t txbuf;
 +    uint8_t rxbuf;
 +} CMSDKAPBUART;
 +
 +/**
 + * cmsdk_apb_uart_create - convenience function to create TYPE_CMSDK_APB_UART
 + * @addr: location in system memory to map registers
 + * @chr: Chardev backend to connect UART to, or NULL if no backend
 + * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
 + */
 +static inline DeviceState *cmsdk_apb_uart_create(hwaddr addr,
 +                                                 qemu_irq txint,
 +                                                 qemu_irq rxint,
 +                                                 qemu_irq txovrint,
 +                                                 qemu_irq rxovrint,
 +                                                 qemu_irq uartint,
 +                                                 Chardev *chr,
 +                                                 uint32_t pclk_frq)
 +{
 +    DeviceState *dev;
 +    SysBusDevice *s;
 +
 +    dev = qdev_create(NULL, TYPE_CMSDK_APB_UART);
 +    s = SYS_BUS_DEVICE(dev);
 +    qdev_prop_set_chr(dev, "chardev", chr);
 +    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
 +    qdev_init_nofail(dev);
 +    sysbus_mmio_map(s, 0, addr);
 +    sysbus_connect_irq(s, 0, txint);
 +    sysbus_connect_irq(s, 1, rxint);
 +    sysbus_connect_irq(s, 2, txovrint);
 +    sysbus_connect_irq(s, 3, rxovrint);
 +    sysbus_connect_irq(s, 4, uartint);
 +    return dev;
 +}
 +
 +#endif
 diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM CMSDK APB UART emulation
 + *
 + * Copyright (c) 2017 Linaro Limited
 + * Written by Peter Maydell
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +/* This is a model of the "APB UART" which is part of the Cortex-M
 + * System Design Kit (CMSDK) and documented in the Cortex-M System
 + * Design Kit Technical Reference Manual (ARM DDI0479C):
 + * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +#include "trace.h"
 +#include "hw/sysbus.h"
 +#include "hw/registerfields.h"
 +#include "chardev/char-fe.h"
 +#include "chardev/char-serial.h"
 +#include "hw/char/cmsdk-apb-uart.h"
 +
 +REG32(DATA, 0)
 +REG32(STATE, 4)
 +    FIELD(STATE, TXFULL, 0, 1)
 +    FIELD(STATE, RXFULL, 1, 1)
 +    FIELD(STATE, TXOVERRUN, 2, 1)
 +    FIELD(STATE, RXOVERRUN, 3, 1)
 +REG32(CTRL, 8)
 +    FIELD(CTRL, TX_EN, 0, 1)
 +    FIELD(CTRL, RX_EN, 1, 1)
 +    FIELD(CTRL, TX_INTEN, 2, 1)
 +    FIELD(CTRL, RX_INTEN, 3, 1)
 +    FIELD(CTRL, TXO_INTEN, 4, 1)
 +    FIELD(CTRL, RXO_INTEN, 5, 1)
 +    FIELD(CTRL, HSTEST, 6, 1)
 +REG32(INTSTATUS, 0xc)
 +    FIELD(INTSTATUS, TX, 0, 1)
 +    FIELD(INTSTATUS, RX, 1, 1)
 +    FIELD(INTSTATUS, TXO, 2, 1)
 +    FIELD(INTSTATUS, RXO, 3, 1)
 +REG32(BAUDDIV, 0x10)
 +REG32(PID4, 0xFD0)
 +REG32(PID5, 0xFD4)
 +REG32(PID6, 0xFD8)
 +REG32(PID7, 0xFDC)
 +REG32(PID0, 0xFE0)
 +REG32(PID1, 0xFE4)
 +REG32(PID2, 0xFE8)
 +REG32(PID3, 0xFEC)
 +REG32(CID0, 0xFF0)
 +REG32(CID1, 0xFF4)
 +REG32(CID2, 0xFF8)
 +REG32(CID3, 0xFFC)
 +
 +/* PID/CID values */
 +static const int uart_id[] = {
 +    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
 +    0x21, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
 +    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 +};
 +
 +static bool uart_baudrate_ok(CMSDKAPBUART *s)
 +{
 +    /* The minimum permitted bauddiv setting is 16, so we just ignore
 +     * settings below that (usually this means the device has just
 +     * been reset and not yet programmed).
 +     */
 +    return s->bauddiv >= 16 && s->bauddiv <= s->pclk_frq;
 +}
 +
 +static void uart_update_parameters(CMSDKAPBUART *s)
 +{
 +    QEMUSerialSetParams ssp;
 +
 +    /* This UART is always 8N1 but the baud rate is programmable. */
 +    if (!uart_baudrate_ok(s)) {
 +        return;
 +    }
 +
 +    ssp.data_bits = 8;
 +    ssp.parity = 'N';
 +    ssp.stop_bits = 1;
 +    ssp.speed = s->pclk_frq / s->bauddiv;
 +    qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
 +    trace_cmsdk_apb_uart_set_params(ssp.speed);
 +}
 +
 +static void cmsdk_apb_uart_update(CMSDKAPBUART *s)
 +{
 +    /* update outbound irqs, including handling the way the rxo and txo
 +     * interrupt status bits are just logical AND of the overrun bit in
 +     * STATE and the overrun interrupt enable bit in CTRL.
 +     */
 +    uint32_t omask = (R_INTSTATUS_RXO_MASK | R_INTSTATUS_TXO_MASK);
 +    s->intstatus &= ~omask;
 +    s->intstatus |= (s->state & (s->ctrl >> 2) & omask);
 +
 +    qemu_set_irq(s->txint, !!(s->intstatus & R_INTSTATUS_TX_MASK));
 +    qemu_set_irq(s->rxint, !!(s->intstatus & R_INTSTATUS_RX_MASK));
 +    qemu_set_irq(s->txovrint, !!(s->intstatus & R_INTSTATUS_TXO_MASK));
 +    qemu_set_irq(s->rxovrint, !!(s->intstatus & R_INTSTATUS_RXO_MASK));
 +    qemu_set_irq(s->uartint, !!(s->intstatus));
 +}
 +
 +static int uart_can_receive(void *opaque)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +
 +    /* We can take a char if RX is enabled and the buffer is empty */
 +    if (s->ctrl & R_CTRL_RX_EN_MASK && !(s->state & R_STATE_RXFULL_MASK)) {
 +        return 1;
 +    }
 +    return 0;
 +}
 +
 +static void uart_receive(void *opaque, const uint8_t *buf, int size)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +
 +    trace_cmsdk_apb_uart_receive(*buf);
 +
 +    /* In fact uart_can_receive() ensures that we can't be
 +     * called unless RX is enabled and the buffer is empty,
 +     * but we include this logic as documentation of what the
 +     * hardware does if a character arrives in these circumstances.
 +     */
 +    if (!(s->ctrl & R_CTRL_RX_EN_MASK)) {
 +        /* Just drop the character on the floor */
 +        return;
 +    }
 +
 +    if (s->state & R_STATE_RXFULL_MASK) {
 +        s->state |= R_STATE_RXOVERRUN_MASK;
 +    }
 +
 +    s->rxbuf = *buf;
 +    s->state |= R_STATE_RXFULL_MASK;
 +    if (s->ctrl & R_CTRL_RX_INTEN_MASK) {
 +        s->intstatus |= R_INTSTATUS_RX_MASK;
 +    }
 +    cmsdk_apb_uart_update(s);
 +}
 +
 +static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +    uint64_t r;
 +
 +    switch (offset) {
 +    case A_DATA:
 +        r = s->rxbuf;
 +        s->state &= ~R_STATE_RXFULL_MASK;
 +        cmsdk_apb_uart_update(s);
 +        break;
 +    case A_STATE:
 +        r = s->state;
 +        break;
 +    case A_CTRL:
 +        r = s->ctrl;
 +        break;
 +    case A_INTSTATUS:
 +        r = s->intstatus;
 +        break;
 +    case A_BAUDDIV:
 +        r = s->bauddiv;
 +        break;
 +    case A_PID4 ... A_CID3:
 +        r = uart_id[(offset - A_PID4) / 4];
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB UART read: bad offset %x\n", (int) offset);
 +        r = 0;
 +        break;
 +    }
 +    trace_cmsdk_apb_uart_read(offset, r, size);
 +    return r;
 +}
 +
 +/* Try to send tx data, and arrange to be called back later if
 + * we can't (ie the char backend is busy/blocking).
 + */
 +static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +    int ret;
 +
 +    s->watch_tag = 0;
 +
 +    if (!(s->ctrl & R_CTRL_TX_EN_MASK) || !(s->state & R_STATE_TXFULL_MASK)) {
 +        return FALSE;
 +    }
 +
 +    ret = qemu_chr_fe_write(&s->chr, &s->txbuf, 1);
 +    if (ret <= 0) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +        if (!s->watch_tag) {
 +            /* Most common reason to be here is "no chardev backend":
 +             * just insta-drain the buffer, so the serial output
 +             * goes into a void, rather than blocking the guest.
 +             */
 +            goto buffer_drained;
 +        }
 +        /* Transmit pending */
 +        trace_cmsdk_apb_uart_tx_pending();
 +        return FALSE;
 +    }
 +
 +buffer_drained:
 +    /* Character successfully sent */
 +    trace_cmsdk_apb_uart_tx(s->txbuf);
 +    s->state &= ~R_STATE_TXFULL_MASK;
 +    /* Going from TXFULL set to clear triggers the tx interrupt */
 +    if (s->ctrl & R_CTRL_TX_INTEN_MASK) {
 +        s->intstatus |= R_INTSTATUS_TX_MASK;
 +    }
 +    cmsdk_apb_uart_update(s);
 +    return FALSE;
 +}
 +
 +static void uart_cancel_transmit(CMSDKAPBUART *s)
 +{
 +    if (s->watch_tag) {
 +        g_source_remove(s->watch_tag);
 +        s->watch_tag = 0;
 +    }
 +}
 +
 +static void uart_write(void *opaque, hwaddr offset, uint64_t value,
 +                       unsigned size)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +
 +    trace_cmsdk_apb_uart_write(offset, value, size);
 +
 +    switch (offset) {
 +    case A_DATA:
 +        s->txbuf = value;
 +        if (s->state & R_STATE_TXFULL_MASK) {
 +            /* Buffer already full -- note the overrun and let the
 +             * existing pending transmit callback handle the new char.
 +             */
 +            s->state |= R_STATE_TXOVERRUN_MASK;
 +            cmsdk_apb_uart_update(s);
 +        } else {
 +            s->state |= R_STATE_TXFULL_MASK;
 +            uart_transmit(NULL, G_IO_OUT, s);
 +        }
 +        break;
 +    case A_STATE:
 +        /* Bits 0 and 1 are read only; bits 2 and 3 are W1C */
 +        s->state &= ~(value &
 +                      (R_STATE_TXOVERRUN_MASK | R_STATE_RXOVERRUN_MASK));
 +        cmsdk_apb_uart_update(s);
 +        break;
 +    case A_CTRL:
 +        s->ctrl = value & 0x7f;
 +        if ((s->ctrl & R_CTRL_TX_EN_MASK) && !uart_baudrate_ok(s)) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "CMSDK APB UART: Tx enabled with invalid baudrate\n");
 +        }
 +        cmsdk_apb_uart_update(s);
 +        break;
 +    case A_INTSTATUS:
 +        /* All bits are W1C. Clearing the overrun interrupt bits really
 +         * clears the overrun status bits in the STATE register (which
 +         * is then reflected into the intstatus value by the update function).
 +         */
 +        s->state &= ~(value & (R_INTSTATUS_TXO_MASK | R_INTSTATUS_RXO_MASK));
 +        cmsdk_apb_uart_update(s);
 +        break;
 +    case A_BAUDDIV:
 +        s->bauddiv = value & 0xFFFFF;
 +        uart_update_parameters(s);
 +        break;
 +    case A_PID4 ... A_CID3:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB UART write: write to RO offset 0x%x\n",
 +                      (int)offset);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "CMSDK APB UART write: bad offset 0x%x\n", (int) offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps uart_ops = {
 +    .read = uart_read,
 +    .write = uart_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void cmsdk_apb_uart_reset(DeviceState *dev)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(dev);
 +
 +    trace_cmsdk_apb_uart_reset();
 +    uart_cancel_transmit(s);
 +    s->state = 0;
 +    s->ctrl = 0;
 +    s->intstatus = 0;
 +    s->bauddiv = 0;
 +    s->txbuf = 0;
 +    s->rxbuf = 0;
 +}
 +
 +static void cmsdk_apb_uart_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    CMSDKAPBUART *s = CMSDK_APB_UART(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &uart_ops, s, "uart", 0x1000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->txint);
 +    sysbus_init_irq(sbd, &s->rxint);
 +    sysbus_init_irq(sbd, &s->txovrint);
 +    sysbus_init_irq(sbd, &s->rxovrint);
 +    sysbus_init_irq(sbd, &s->uartint);
 +}
 +
 +static void cmsdk_apb_uart_realize(DeviceState *dev, Error **errp)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(dev);
 +
 +    if (s->pclk_frq == 0) {
 +        error_setg(errp, "CMSDK APB UART: pclk-frq property must be set");
 +        return;
 +    }
 +
 +    /* This UART has no flow control, so we do not need to register
 +     * an event handler to deal with CHR_EVENT_BREAK.
 +     */
 +    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
 +                             NULL, s, NULL, true);
 +}
 +
 +static int cmsdk_apb_uart_post_load(void *opaque, int version_id)
 +{
 +    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
 +
 +    /* If we have a pending character, arrange to resend it. */
 +    if (s->state & R_STATE_TXFULL_MASK) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +    }
 +    uart_update_parameters(s);
 +    return 0;
 +}
 +
 +static const VMStateDescription cmsdk_apb_uart_vmstate = {
 +    .name = "cmsdk-apb-uart",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .post_load = cmsdk_apb_uart_post_load,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(state, CMSDKAPBUART),
 +        VMSTATE_UINT32(ctrl, CMSDKAPBUART),
 +        VMSTATE_UINT32(intstatus, CMSDKAPBUART),
 +        VMSTATE_UINT32(bauddiv, CMSDKAPBUART),
 +        VMSTATE_UINT8(txbuf, CMSDKAPBUART),
 +        VMSTATE_UINT8(rxbuf, CMSDKAPBUART),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property cmsdk_apb_uart_properties[] = {
 +    DEFINE_PROP_CHR("chardev", CMSDKAPBUART, chr),
 +    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBUART, pclk_frq, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void cmsdk_apb_uart_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = cmsdk_apb_uart_realize;
 +    dc->vmsd = &cmsdk_apb_uart_vmstate;
 +    dc->reset = cmsdk_apb_uart_reset;
 +    dc->props = cmsdk_apb_uart_properties;
 +}
 +
 +static const TypeInfo cmsdk_apb_uart_info = {
 +    .name = TYPE_CMSDK_APB_UART,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(CMSDKAPBUART),
 +    .instance_init = cmsdk_apb_uart_init,
 +    .class_init = cmsdk_apb_uart_class_init,
 +};
 +
 +static void cmsdk_apb_uart_register_types(void)
 +{
 +    type_register_static(&cmsdk_apb_uart_info);
 +}
 +
 +type_init(cmsdk_apb_uart_register_types);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
+--- a/exec.c
-+++ b/default-configs/arm-softmmu.mak
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_ADC=y
+@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
- CONFIG_STM32F2XX_SPI=y
- CONFIG_STM32F205_SOC=y
+ /* Called from RCU critical section */
+ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-+CONFIG_CMSDK_APB_UART=y
+-                                            bool is_write)
-+
++                                            bool is_write, MemTxAttrs attrs)
- CONFIG_VERSATILE_PCI=y
+ {
- CONFIG_VERSATILE_I2C=y
+     MemoryRegionSection section;
+     hwaddr xlat, page_mask;
-diff --git a/hw/char/trace-events b/hw/char/trace-events
+diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/trace-events
+--- a/hw/virtio/vhost.c
-+++ b/hw/char/trace-events
++++ b/hw/virtio/vhost.c
-@@ -XXX,XX +XXX,XX @@ pl011_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+@@ -XXX,XX +XXX,XX @@ int vhost_device_iotlb_miss(struct vhost_dev *dev, uint64_t iova, int write)
- pl011_can_receive(uint32_t lcr, int read_count, int r) "LCR %08x read_count %d returning %d"
+     trace_vhost_iotlb_miss(dev, 1);
- pl011_put_fifo(uint32_t c, int read_count) "new char 0x%x read_count now %d"
- pl011_put_fifo_full(void) "FIFO now full, RXFF set"
+     iotlb = address_space_get_iotlb_entry(dev->vdev->dma_as,
-+
+-                                          iova, write);
-+# hw/char/cmsdk_apb_uart.c
++                                          iova, write,
-+cmsdk_apb_uart_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB UART read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++                                          MEMTXATTRS_UNSPECIFIED);
-+cmsdk_apb_uart_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB UART write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+     if (iotlb.target_as != NULL) {
-+cmsdk_apb_uart_reset(void) "CMSDK APB UART: reset"
+         ret = vhost_memory_region_lookup(dev, iotlb.translated_addr,
-+cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backend"
+                                          &uaddr, &len);
 +cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
 +cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
 +cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 10/18] hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models
+[Qemu-devel] [PULL 21/25] Make flatview_do_translate() take a MemTxAttrs argument
-Model the ARM MPS2/MPS2+ FPGA based development board.
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
+add MemTxAttrs as an argument to flatview_do_translate().
 The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
 FPGA but is otherwise the same as the 2). Since the CPU itself
 and most of the devices are in the FPGA, the details of the board
 as seen by the guest depend significantly on the FPGA image.
 We model the following FPGA images:
  "mps2_an385" -- Cortex-M3 as documented in ARM Application Note AN385
  "mps2_an511" -- Cortex-M3 'DesignStart' as documented in AN511
 They are fairly similar but differ in the details for some
 peripherals.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1500029487-14822-2-git-send-email-peter.maydell@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180521140402.23318-13-peter.maydell@linaro.org
 ---
- hw/arm/Makefile.objs            |   1 +
+ exec.c | 9 ++++++---
- hw/arm/mps2.c                   | 270 ++++++++++++++++++++++++++++++++++++++++
+file changed, 6 insertions(+), 3 deletions(-)
  default-configs/arm-softmmu.mak |   1 +
 files changed, 272 insertions(+)
  create mode 100644 hw/arm/mps2.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/exec.c
-+++ b/hw/arm/Makefile.objs
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
+@@ -XXX,XX +XXX,XX @@ unassigned:
- obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
+  * @is_write: whether the translation operation is for write
- obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
+  * @is_mmio: whether this can be MMIO, set true if it can
- obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
+  * @target_as: the address space targeted by the IOMMU
-+obj-$(CONFIG_MPS2) += mps2.o
++ * @attrs: memory transaction attributes
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+  *
-new file mode 100644
+  * This function is called from RCU critical section
-index XXXXXXX..XXXXXXX
+  */
---- /dev/null
+@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
-+++ b/hw/arm/mps2.c
+                                                  hwaddr *page_mask_out,
-@@ -XXX,XX +XXX,XX @@
+                                                  bool is_write,
-+/*
+                                                  bool is_mmio,
-+ * ARM V2M MPS2 board emulation.
+-                                                 AddressSpace **target_as)
-+ *
++                                                 AddressSpace **target_as,
-+ * Copyright (c) 2017 Linaro Limited
++                                                 MemTxAttrs attrs)
-+ * Written by Peter Maydell
+ {
-+ *
+     MemoryRegionSection *section;
-+ *  This program is free software; you can redistribute it and/or modify
+     IOMMUMemoryRegion *iommu_mr;
-+ *  it under the terms of the GNU General Public License version 2 or
+@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-+ *  (at your option) any later version.
+      * but page mask.
-+ */
+      */
-+
+     section = flatview_do_translate(address_space_to_flatview(as), addr, &xlat,
-+/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
+-                                    NULL, &page_mask, is_write, false, &as);
-+ * FPGA but is otherwise the same as the 2). Since the CPU itself
++                                    NULL, &page_mask, is_write, false, &as,
-+ * and most of the devices are in the FPGA, the details of the board
++                                    attrs);
-+ * as seen by the guest depend significantly on the FPGA image.
-+ * We model the following FPGA images:
+     /* Illegal translation */
-+ *  "mps2-an385" -- Cortex-M3 as documented in ARM Application Note AN385
+     if (section.mr == &io_mem_unassigned) {
-+ *  "mps2-an511" -- Cortex-M3 'DesignStart' as documented in AN511
+@@ -XXX,XX +XXX,XX @@ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,
-+ *
-+ * Links to the TRM for the board itself and to the various Application
+     /* This can be MMIO, so setup MMIO bit. */
-+ * Notes which document the FPGA images can be found here:
+     section = flatview_do_translate(fv, addr, xlat, plen, NULL,
-+ *   https://developer.arm.com/products/system-design/development-boards/cortex-m-prototyping-system
+-                                    is_write, true, &as);
-+ */
++                                    is_write, true, &as, attrs);
-+
+     mr = section.mr;
-+#include "qemu/osdep.h"
-+#include "qapi/error.h"
+     if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
 +#include "qemu/error-report.h"
 +#include "hw/arm/arm.h"
 +#include "hw/arm/armv7m.h"
 +#include "hw/boards.h"
 +#include "exec/address-spaces.h"
 +#include "hw/misc/unimp.h"
 +
 +typedef enum MPS2FPGAType {
 +    FPGA_AN385,
 +    FPGA_AN511,
 +} MPS2FPGAType;
 +
 +typedef struct {
 +    MachineClass parent;
 +    MPS2FPGAType fpga_type;
 +    const char *cpu_model;
 +} MPS2MachineClass;
 +
 +typedef struct {
 +    MachineState parent;
 +
 +    ARMv7MState armv7m;
 +    MemoryRegion psram;
 +    MemoryRegion ssram1;
 +    MemoryRegion ssram1_m;
 +    MemoryRegion ssram23;
 +    MemoryRegion ssram23_m;
 +    MemoryRegion blockram;
 +    MemoryRegion blockram_m1;
 +    MemoryRegion blockram_m2;
 +    MemoryRegion blockram_m3;
 +    MemoryRegion sram;
 +} MPS2MachineState;
 +
 +#define TYPE_MPS2_MACHINE "mps2"
 +#define TYPE_MPS2_AN385_MACHINE MACHINE_TYPE_NAME("mps2-an385")
 +#define TYPE_MPS2_AN511_MACHINE MACHINE_TYPE_NAME("mps2-an511")
 +
 +#define MPS2_MACHINE(obj)                                       \
 +    OBJECT_CHECK(MPS2MachineState, obj, TYPE_MPS2_MACHINE)
 +#define MPS2_MACHINE_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(MPS2MachineClass, obj, TYPE_MPS2_MACHINE)
 +#define MPS2_MACHINE_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(MPS2MachineClass, klass, TYPE_MPS2_MACHINE)
 +
 +/* Main SYSCLK frequency in Hz */
 +#define SYSCLK_FRQ 25000000
 +
 +/* Initialize the auxiliary RAM region @mr and map it into
 + * the memory map at @base.
 + */
 +static void make_ram(MemoryRegion *mr, const char *name,
 +                     hwaddr base, hwaddr size)
 +{
 +    memory_region_init_ram(mr, NULL, name, size, &error_fatal);
 +    memory_region_add_subregion(get_system_memory(), base, mr);
 +}
 +
 +/* Create an alias of an entire original MemoryRegion @orig
 + * located at @base in the memory map.
 + */
 +static void make_ram_alias(MemoryRegion *mr, const char *name,
 +                           MemoryRegion *orig, hwaddr base)
 +{
 +    memory_region_init_alias(mr, NULL, name, orig, 0,
 +                             memory_region_size(orig));
 +    memory_region_add_subregion(get_system_memory(), base, mr);
 +}
 +
 +static void mps2_common_init(MachineState *machine)
 +{
 +    MPS2MachineState *mms = MPS2_MACHINE(machine);
 +    MPS2MachineClass *mmc = MPS2_MACHINE_GET_CLASS(machine);
 +    MemoryRegion *system_memory = get_system_memory();
 +    DeviceState *armv7m;
 +
 +    if (!machine->cpu_model) {
 +        machine->cpu_model = mmc->cpu_model;
 +    }
 +
 +    if (strcmp(machine->cpu_model, mmc->cpu_model) != 0) {
 +        error_report("This board can only be used with CPU %s", mmc->cpu_model);
 +        exit(1);
 +    }
 +
 +    /* The FPGA images have an odd combination of different RAMs,
 +     * because in hardware they are different implementations and
 +     * connected to different buses, giving varying performance/size
 +     * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
 +     * call the 16MB our "system memory", as it's the largest lump.
 +     *
 +     * Common to both boards:
 +     *  0x21000000..0x21ffffff : PSRAM (16MB)
 +     * AN385 only:
 +     *  0x00000000 .. 0x003fffff : ZBT SSRAM1
 +     *  0x00400000 .. 0x007fffff : mirror of ZBT SSRAM1
 +     *  0x20000000 .. 0x203fffff : ZBT SSRAM 2&3
 +     *  0x20400000 .. 0x207fffff : mirror of ZBT SSRAM 2&3
 +     *  0x01000000 .. 0x01003fff : block RAM (16K)
 +     *  0x01004000 .. 0x01007fff : mirror of above
 +     *  0x01008000 .. 0x0100bfff : mirror of above
 +     *  0x0100c000 .. 0x0100ffff : mirror of above
 +     * AN511 only:
 +     *  0x00000000 .. 0x0003ffff : FPGA block RAM
 +     *  0x00400000 .. 0x007fffff : ZBT SSRAM1
 +     *  0x20000000 .. 0x2001ffff : SRAM
 +     *  0x20400000 .. 0x207fffff : ZBT SSRAM 2&3
 +     *
 +     * The AN385 has a feature where the lowest 16K can be mapped
 +     * either to the bottom of the ZBT SSRAM1 or to the block RAM.
 +     * This is of no use for QEMU so we don't implement it (as if
 +     * zbt_boot_ctrl is always zero).
 +     */
 +    memory_region_allocate_system_memory(&mms->psram,
 +                                         NULL, "mps.ram", 0x1000000);
 +    memory_region_add_subregion(system_memory, 0x21000000, &mms->psram);
 +
 +    switch (mmc->fpga_type) {
 +    case FPGA_AN385:
 +        make_ram(&mms->ssram1, "mps.ssram1", 0x0, 0x400000);
 +        make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", &mms->ssram1, 0x400000);
 +        make_ram(&mms->ssram23, "mps.ssram23", 0x20000000, 0x400000);
 +        make_ram_alias(&mms->ssram23_m, "mps.ssram23_m",
 +                       &mms->ssram23, 0x20400000);
 +        make_ram(&mms->blockram, "mps.blockram", 0x01000000, 0x4000);
 +        make_ram_alias(&mms->blockram_m1, "mps.blockram_m1",
 +                       &mms->blockram, 0x01004000);
 +        make_ram_alias(&mms->blockram_m2, "mps.blockram_m2",
 +                       &mms->blockram, 0x01008000);
 +        make_ram_alias(&mms->blockram_m3, "mps.blockram_m3",
 +                       &mms->blockram, 0x0100c000);
 +        break;
 +    case FPGA_AN511:
 +        make_ram(&mms->blockram, "mps.blockram", 0x0, 0x40000);
 +        make_ram(&mms->ssram1, "mps.ssram1", 0x00400000, 0x00800000);
 +        make_ram(&mms->sram, "mps.sram", 0x20000000, 0x20000);
 +        make_ram(&mms->ssram23, "mps.ssram23", 0x20400000, 0x400000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    object_initialize(&mms->armv7m, sizeof(mms->armv7m), TYPE_ARMV7M);
 +    armv7m = DEVICE(&mms->armv7m);
 +    qdev_set_parent_bus(armv7m, sysbus_get_default());
 +    switch (mmc->fpga_type) {
 +    case FPGA_AN385:
 +        qdev_prop_set_uint32(armv7m, "num-irq", 32);
 +        break;
 +    case FPGA_AN511:
 +        qdev_prop_set_uint32(armv7m, "num-irq", 64);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    qdev_prop_set_string(armv7m, "cpu-model", machine->cpu_model);
 +    object_property_set_link(OBJECT(&mms->armv7m), OBJECT(system_memory),
 +                             "memory", &error_abort);
 +    object_property_set_bool(OBJECT(&mms->armv7m), true, "realized",
 +                             &error_fatal);
 +
 +    create_unimplemented_device("zbtsmram mirror", 0x00400000, 0x00400000);
 +    create_unimplemented_device("RESERVED 1", 0x00800000, 0x00800000);
 +    create_unimplemented_device("Block RAM", 0x01000000, 0x00010000);
 +    create_unimplemented_device("RESERVED 2", 0x01010000, 0x1EFF0000);
 +    create_unimplemented_device("RESERVED 3", 0x20800000, 0x00800000);
 +    create_unimplemented_device("PSRAM", 0x21000000, 0x01000000);
 +    /* These three ranges all cover multiple devices; we may implement
 +     * some of them below (in which case the real device takes precedence
 +     * over the unimplemented-region mapping).
 +     */
 +    create_unimplemented_device("CMSDK APB peripheral region @0x40000000",
 +                                0x40000000, 0x00010000);
 +    create_unimplemented_device("CMSDK peripheral region @0x40010000",
 +                                0x40010000, 0x00010000);
 +    create_unimplemented_device("Extra peripheral region @0x40020000",
 +                                0x40020000, 0x00010000);
 +    create_unimplemented_device("RESERVED 4", 0x40030000, 0x001D0000);
 +    create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
 +    create_unimplemented_device("VGA", 0x41000000, 0x0200000);
 +
 +    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 +
 +    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +                       0x400000);
 +}
 +
 +static void mps2_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
 +    mc->init = mps2_common_init;
 +    mc->max_cpus = 1;
 +}
 +
 +static void mps2_an385_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
 +
 +    mc->desc = "ARM MPS2 with AN385 FPGA image for Cortex-M3";
 +    mmc->fpga_type = FPGA_AN385;
 +    mmc->cpu_model = "cortex-m3";
 +}
 +
 +static void mps2_an511_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
 +
 +    mc->desc = "ARM MPS2 with AN511 DesignStart FPGA image for Cortex-M3";
 +    mmc->fpga_type = FPGA_AN511;
 +    mmc->cpu_model = "cortex-m3";
 +}
 +
 +static const TypeInfo mps2_info = {
 +    .name = TYPE_MPS2_MACHINE,
 +    .parent = TYPE_MACHINE,
 +    .abstract = true,
 +    .instance_size = sizeof(MPS2MachineState),
 +    .class_size = sizeof(MPS2MachineClass),
 +    .class_init = mps2_class_init,
 +};
 +
 +static const TypeInfo mps2_an385_info = {
 +    .name = TYPE_MPS2_AN385_MACHINE,
 +    .parent = TYPE_MPS2_MACHINE,
 +    .class_init = mps2_an385_class_init,
 +};
 +
 +static const TypeInfo mps2_an511_info = {
 +    .name = TYPE_MPS2_AN511_MACHINE,
 +    .parent = TYPE_MPS2_MACHINE,
 +    .class_init = mps2_an511_class_init,
 +};
 +
 +static void mps2_machine_init(void)
 +{
 +    type_register_static(&mps2_info);
 +    type_register_static(&mps2_an385_info);
 +    type_register_static(&mps2_an511_info);
 +}
 +
 +type_init(mps2_machine_init);
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_ONENAND=y
  CONFIG_TUSB6010=y
  CONFIG_IMX=y
  CONFIG_MAINSTONE=y
 +CONFIG_MPS2=y
  CONFIG_NSERIES=y
  CONFIG_RASPI=y
  CONFIG_REALVIEW=y
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 12/18] hw/arm/mps2: Add UARTs
+[Qemu-devel] [PULL 22/25] Make address_space_translate_iommu take a MemTxAttrs argument
-Add the UARTs to the MPS2 board models.
+As part of plumbing MemTxAttrs down to the IOMMU translate method,
+add MemTxAttrs as an argument to address_space_translate_iommu().
 Unfortunately the details of the wiring of the interrupts through
 various OR gates differ between AN511 and AN385 so this can't
 be purely a data-driven difference.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1500029487-14822-4-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180521140402.23318-14-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c            | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
+ exec.c | 8 +++++---
- hw/char/cmsdk-apb-uart.c |  2 +-
+file changed, 5 insertions(+), 3 deletions(-)
 files changed, 89 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/exec.c
-+++ b/hw/arm/mps2.c
++++ b/exec.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x
- #include "qemu/error-report.h"
+  * @is_write: whether the translation operation is for write
- #include "hw/arm/arm.h"
+  * @is_mmio: whether this can be MMIO, set true if it can
- #include "hw/arm/armv7m.h"
+  * @target_as: the address space targeted by the IOMMU
-+#include "hw/or-irq.h"
++ * @attrs: transaction attributes
- #include "hw/boards.h"
+  *
- #include "exec/address-spaces.h"
+  * This function is called from RCU critical section.  It is the common
-+#include "sysemu/sysemu.h"
+  * part of flatview_do_translate and address_space_translate_cached.
- #include "hw/misc/unimp.h"
+@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection address_space_translate_iommu(IOMMUMemoryRegion *iomm
-+#include "hw/char/cmsdk-apb-uart.h"
+                                                          hwaddr *page_mask_out,
+                                                          bool is_write,
- typedef enum MPS2FPGAType {
+                                                          bool is_mmio,
-     FPGA_AN385,
+-                                                         AddressSpace **target_as)
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
++                                                         AddressSpace **target_as,
-     create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
++                                                         MemTxAttrs attrs)
-     create_unimplemented_device("VGA", 0x41000000, 0x0200000);
+ {
+     MemoryRegionSection *section;
-+    switch (mmc->fpga_type) {
+     hwaddr page_mask = (hwaddr)-1;
-+    case FPGA_AN385:
+@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
-+    {
+         return address_space_translate_iommu(iommu_mr, xlat,
-+        /* The overflow IRQs for UARTs 0, 1 and 2 are ORed together.
+                                              plen_out, page_mask_out,
-+         * Overflow for UARTs 4 and 5 doesn't trigger any interrupt.
+                                              is_write, is_mmio,
-+         */
+-                                             target_as);
-+        Object *orgate;
++                                             target_as, attrs);
-+        DeviceState *orgate_dev;
+     }
-+        int i;
+     if (page_mask_out) {
-+
+         /* Not behind an IOMMU, use default page size. */
-+        orgate = object_new(TYPE_OR_IRQ);
+@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate_cached(
-+        object_property_set_int(orgate, 6, "num-lines", &error_fatal);
-+        object_property_set_bool(orgate, true, "realized", &error_fatal);
+     section = address_space_translate_iommu(iommu_mr, xlat, plen,
-+        orgate_dev = DEVICE(orgate);
+                                             NULL, is_write, true,
-+        qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
+-                                            &target_as);
-+
++                                            &target_as, attrs);
-+        for (i = 0; i < 5; i++) {
+     return section.mr;
 +            static const hwaddr uartbase[] = {0x40004000, 0x40005000,
 +                                              0x40006000, 0x40007000,
 +                                              0x40009000};
 +            Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
 +            /* RX irq number; TX irq is always one greater */
 +            static const int uartirq[] = {0, 2, 4, 18, 20};
 +            qemu_irq txovrint = NULL, rxovrint = NULL;
 +
 +            if (i < 3) {
 +                txovrint = qdev_get_gpio_in(orgate_dev, i * 2);
 +                rxovrint = qdev_get_gpio_in(orgate_dev, i * 2 + 1);
 +            }
 +
 +            cmsdk_apb_uart_create(uartbase[i],
 +                                  qdev_get_gpio_in(armv7m, uartirq[i] + 1),
 +                                  qdev_get_gpio_in(armv7m, uartirq[i]),
 +                                  txovrint, rxovrint,
 +                                  NULL,
 +                                  uartchr, SYSCLK_FRQ);
 +        }
 +        break;
 +    }
 +    case FPGA_AN511:
 +    {
 +        /* The overflow IRQs for all UARTs are ORed together.
 +         * Tx and Rx IRQs for each UART are ORed together.
 +         */
 +        Object *orgate;
 +        DeviceState *orgate_dev;
 +        int i;
 +
 +        orgate = object_new(TYPE_OR_IRQ);
 +        object_property_set_int(orgate, 10, "num-lines", &error_fatal);
 +        object_property_set_bool(orgate, true, "realized", &error_fatal);
 +        orgate_dev = DEVICE(orgate);
 +        qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
 +
 +        for (i = 0; i < 5; i++) {
 +            /* system irq numbers for the combined tx/rx for each UART */
 +            static const int uart_txrx_irqno[] = {0, 2, 45, 46, 56};
 +            static const hwaddr uartbase[] = {0x40004000, 0x40005000,
 +                                              0x4002c000, 0x4002d000,
 +                                              0x4002e000};
 +            Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
 +            Object *txrx_orgate;
 +            DeviceState *txrx_orgate_dev;
 +
 +            txrx_orgate = object_new(TYPE_OR_IRQ);
 +            object_property_set_int(txrx_orgate, 2, "num-lines", &error_fatal);
 +            object_property_set_bool(txrx_orgate, true, "realized",
 +                                     &error_fatal);
 +            txrx_orgate_dev = DEVICE(txrx_orgate);
 +            qdev_connect_gpio_out(txrx_orgate_dev, 0,
 +                                  qdev_get_gpio_in(armv7m, uart_txrx_irqno[i]));
 +            cmsdk_apb_uart_create(uartbase[i],
 +                                  qdev_get_gpio_in(txrx_orgate_dev, 0),
 +                                  qdev_get_gpio_in(txrx_orgate_dev, 1),
 +                                  qdev_get_gpio_in(orgate_dev, 0),
 +                                  qdev_get_gpio_in(orgate_dev, 1),
 +                                  NULL,
 +                                  uartchr, SYSCLK_FRQ);
 +        }
 +        break;
 +    }
 +    default:
 +        g_assert_not_reached();
 +    }
 +
      system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
      armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/cmsdk-apb-uart.c
 +++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_uart_realize(DeviceState *dev, Error **errp)
       * an event handler to deal with CHR_EVENT_BREAK.
       */
      qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
 -                             NULL, s, NULL, true);
 +                             NULL, NULL, s, NULL, true);
  }
- static int cmsdk_apb_uart_post_load(void *opaque, int version_id)
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 03/18] target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions
+[Qemu-devel] [PULL 23/25] vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
-The Cortex-M3 and M4 CPUs always have 8 PMSA MPU regions (this isn't
+Provide a VMSTATE_BOOL_SUB_ARRAY to go with VMSTATE_UINT8_SUB_ARRAY
-a configurable option for the hardware).  Make the default value of
+and friends.
 the pmsav7-dregion property be set per-cpu, so we don't need to have
 every user of these CPUs set it manually.  (The existing default of
 is correct for the other PMSAv7 core, the Cortex-R5.)
 This fixes a bug where we were creating the M3 and M4 with
 too many regions; most guest software would not notice or
 care, though, since it would just not use the registers
 associated with the unexpected extra regions.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1499788408-10096-4-git-send-email-peter.maydell@linaro.org
+Message-id: 20180521140402.23318-23-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 12 +++++++++++-
+ include/migration/vmstate.h | 3 +++
-file changed, 11 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/include/migration/vmstate.h
-+++ b/target/arm/cpu.c
++++ b/include/migration/vmstate.h
-@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_pmu_property =
+@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
- static Property arm_cpu_has_mpu_property =
+ #define VMSTATE_BOOL_ARRAY(_f, _s, _n)                               \
-             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
+     VMSTATE_BOOL_ARRAY_V(_f, _s, _n, 0)
-+/* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,
++#define VMSTATE_BOOL_SUB_ARRAY(_f, _s, _start, _num)                \
-+ * because the CPU initfn will have already set cpu->pmsav7_dregion to
++    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_bool, bool)
-+ * the right value for that particular CPU type, and we don't want
++
-+ * to override that with an incorrect constant value.
+ #define VMSTATE_UINT16_ARRAY_V(_f, _s, _n, _v)                         \
-+ */
+     VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_uint16, uint16_t)
  static Property arm_cpu_pmsav7_dregion_property =
 -            DEFINE_PROP_UINT32("pmsav7-dregion", ARMCPU, pmsav7_dregion, 16);
 +            DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
 +                                           pmsav7_dregion,
 +                                           qdev_prop_uint32, uint32_t);
  static void arm_cpu_post_init(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_V7);
      set_feature(&cpu->env, ARM_FEATURE_M);
      cpu->midr = 0x410fc231;
 +    cpu->pmsav7_dregion = 8;
  }
  static void cortex_m4_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M);
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
      cpu->midr = 0x410fc240; /* r0p0 */
 +    cpu->pmsav7_dregion = 8;
  }
  static void arm_v7m_class_init(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      cpu->id_isar4 = 0x0010142;
      cpu->id_isar5 = 0x0;
      cpu->mp_is_up = true;
 +    cpu->pmsav7_dregion = 16;
      define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
  }
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 05/18] target/arm/translate: make DISAS_UPDATE match declared semantics
+[Qemu-devel] [PULL 24/25] ARM: ACPI: Fix use-after-free due to memory realloc
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Shannon Zhao <zhaoshenglong@huawei.com>
-DISAS_UPDATE should be used when the wider CPU state other than just
+acpi_data_push uses g_array_set_size to resize the memory size. If there
-the PC has been updated and we should therefore exit the TCG runtime
+is no enough contiguous memory, the address will be changed. So previous
-and return to the main execution loop rather assuming DISAS_JUMP would
+pointer could not be used any more. It must update the pointer and use
-do that.
+the new one.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Also, previous codes wrongly use le32 conversion of iort->node_offset
-Reviewed-by: Richard Henderson <rth@twiddle.net>
+for subsequent computations that will result incorrect value if host is
-Message-id: 20170713141928.25419-3-alex.bennee@linaro.org
+not litlle endian. So use the non-converted one instead.
 Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1527663951-14552-1-git-send-email-zhaoshenglong@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 14 +++++++-------
+ hw/arm/virt-acpi-build.c | 20 +++++++++++++++-----
- target/arm/translate.c     |  6 +++---
+file changed, 15 insertions(+), 5 deletions(-)
 files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/arm/virt-acpi-build.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
+@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
-         case DISAS_NEXT:
+     AcpiIortItsGroup *its;
-             gen_goto_tb(dc, 1, dc->pc);
+     AcpiIortTable *iort;
-             break;
+     AcpiIortSmmu3 *smmu;
--        default:
+-    size_t node_size, iort_length, smmu_offset = 0;
--        case DISAS_UPDATE:
++    size_t node_size, iort_node_offset, iort_length, smmu_offset = 0;
--            gen_a64_set_pc_im(dc->pc);
+     AcpiIortRC *rc;
--            /* fall through */
-         case DISAS_JUMP:
+     iort = acpi_data_push(table_data, sizeof(*iort));
-             tcg_gen_lookup_and_goto_ptr(cpu_pc);
+@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
-             break;
--        case DISAS_EXIT:
+     iort_length = sizeof(*iort);
--            tcg_gen_exit_tb(0);
+     iort->node_count = cpu_to_le32(nb_nodes);
--            break;
+-    iort->node_offset = cpu_to_le32(sizeof(*iort));
-         case DISAS_TB_JUMP:
++    /*
-         case DISAS_EXC:
++     * Use a copy in case table_data->data moves during acpi_data_push
-         case DISAS_SWI:
++     * operations.
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
++     */
-              */
++    iort_node_offset = sizeof(*iort);
-             tcg_gen_exit_tb(0);
++    iort->node_offset = cpu_to_le32(iort_node_offset);
-             break;
-+        case DISAS_UPDATE:
+     /* ITS group node */
-+            gen_a64_set_pc_im(dc->pc);
+     node_size =  sizeof(*its) + sizeof(uint32_t);
-+            /* fall through */
+@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
-+        case DISAS_EXIT:
+         int irq =  vms->irqmap[VIRT_SMMU];
-+        default:
-+            tcg_gen_exit_tb(0);
+         /* SMMUv3 node */
-+            break;
+-        smmu_offset = iort->node_offset + node_size;
-         }
++        smmu_offset = iort_node_offset + node_size;
          node_size = sizeof(*smmu) + sizeof(*idmap);
          iort_length += node_size;
          smmu = acpi_data_push(table_data, node_size);
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
          idmap->id_count = cpu_to_le32(0xFFFF);
          idmap->output_base = 0;
          /* output IORT node is the ITS group node (the first node) */
 -        idmap->output_reference = cpu_to_le32(iort->node_offset);
 +        idmap->output_reference = cpu_to_le32(iort_node_offset);
      }
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+     /* Root Complex Node */
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
---- a/target/arm/translate.c
+         idmap->output_reference = cpu_to_le32(smmu_offset);
-+++ b/target/arm/translate.c
+     } else {
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
+         /* output IORT node is the ITS group node (the first node) */
-         case DISAS_NEXT:
+-        idmap->output_reference = cpu_to_le32(iort->node_offset);
-             gen_goto_tb(dc, 1, dc->pc);
++        idmap->output_reference = cpu_to_le32(iort_node_offset);
-             break;
+     }
--        case DISAS_UPDATE:
--            gen_set_pc_im(dc, dc->pc);
++    /*
--            /* fall through */
++     * Update the pointer address in case table_data->data moves during above
-         case DISAS_JUMP:
++     * acpi_data_push operations.
-             gen_goto_ptr();
++     */
-             break;
++    iort = (AcpiIortTable *)(table_data->data + iort_start);
-+        case DISAS_UPDATE:
+     iort->length = cpu_to_le32(iort_length);
-+            gen_set_pc_im(dc, dc->pc);
-+            /* fall through */
+     build_header(linker, table_data, (void *)(table_data->data + iort_start),
          default:
              /* indicate that the hash table must be used to find the next TB */
              tcg_gen_exit_tb(0);
 --
-.7.4
+.17.1

-[Qemu-devel] [PULL 08/18] target/arm: use gen_goto_tb for ISB handling
+[Qemu-devel] [PULL 25/25] KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Shannon Zhao <zhaoshenglong@huawei.com>
-While an ISB will ensure any raised IRQs happen on the next
+kvm_irqchip_create called by kvm_init will call kvm_init_irq_routing to
-instruction it doesn't cause any to get raised by itself. We can
+initialize global capability variables. If we call kvm_init_irq_routing in
-therefore use a simple tb exit for ISB instructions and rely on the
+GIC realize function, previous allocated memory will leak.
 exit_request check at the top of each TB to deal with exiting if
 needed.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Fix this by deleting the unnecessary call.
-Reviewed-by: Richard Henderson <rth@twiddle.net>
-Message-id: 20170713141928.25419-6-alex.bennee@linaro.org
+Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1527750994-14360-1-git-send-email-zhaoshenglong@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ hw/intc/arm_gic_kvm.c   | 1 -
- target/arm/translate.c     | 4 ++--
+ hw/intc/arm_gicv3_kvm.c | 1 -
-files changed, 3 insertions(+), 3 deletions(-)
+files changed, 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/intc/arm_gic_kvm.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/intc/arm_gic_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
-          * a self-modified code correctly and also to take
-          * any pending interrupts immediately.
+     if (kvm_has_gsi_routing()) {
-          */
+         /* set up irq routing */
--        s->is_jmp = DISAS_UPDATE;
+-        kvm_init_irq_routing(kvm_state);
-+        gen_goto_tb(s, 0, s->pc);
+         for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {
-         return;
+             kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
-     default:
+         }
-         unallocated_encoding(s);
+diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/hw/intc/arm_gicv3_kvm.c
-+++ b/target/arm/translate.c
++++ b/hw/intc/arm_gicv3_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
-                  * self-modifying code correctly and also to take
-                  * any pending interrupts immediately.
+     if (kvm_has_gsi_routing()) {
-                  */
+         /* set up irq routing */
--                gen_lookup_tb(s);
+-        kvm_init_irq_routing(kvm_state);
-+                gen_goto_tb(s, 0, s->pc & ~1);
+         for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {
-                 return;
+             kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
-             default:
+         }
                  goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                               * and also to take any pending interrupts
                               * immediately.
                               */
 -                            gen_lookup_tb(s);
 +                            gen_goto_tb(s, 0, s->pc & ~1);
                              break;
                          default:
                              goto illegal_op;
 --
-.7.4
+.17.1

ARM queue for 2.10 soft freeze...

thanks
-- PMM

The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:

Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170717

for you to fetch changes up to e5a6a6e64e82a132cebef023d867085b0a2993d7:

MAINTAINERS: Add entries for MPS2 board (2017-07-17 13:36:09 +0100)

----------------------------------------------------------------
target-arm queue:
 * new model of the ARM MPS2/MPS2+ FPGA based development board
 * clean up DISAS_* exit conditions and fix various regressions
   since commits e75449a346 8a6b28c7b5 (in particular including
   ones which broke OP-TEE guests)
 * make Cortex-M3 and M4 correctly default to 8 PMSA regions

----------------------------------------------------------------
Alex Bennée (6):
      include/exec/exec-all: document common exit conditions
      target/arm/translate: make DISAS_UPDATE match declared semantics
      target/arm/translate.h: expand comment on DISAS_EXIT
      target/arm/translate: ensure gen_goto_tb sets exit flags
      target/arm: use gen_goto_tb for ISB handling
      target/arm: use DISAS_EXIT for eret handling

Peter Maydell (12):
      qdev-properties.h: Explicitly set the default value for arraylen properties
      qdev: support properties which don't set a default value
      target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions
      hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models
      hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART
      hw/arm/mps2: Add UARTs
      hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device
      hw/arm/mps2: Add timers
      hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller
      hw/arm/mps2: Add SCC
      hw/arm/mps2: Add ethernet
      MAINTAINERS: Add entries for MPS2 board

hw/arm/Makefile.objs               |   1 +
 hw/char/Makefile.objs              |   1 +
 hw/misc/Makefile.objs              |   1 +
 hw/timer/Makefile.objs             |   1 +
 include/exec/exec-all.h            |  29 ++-
 include/hw/char/cmsdk-apb-uart.h   |  78 +++++++
 include/hw/misc/mps2-scc.h         |  43 ++++
 include/hw/qdev-core.h             |  10 +
 include/hw/qdev-properties.h       |  21 ++
 include/hw/timer/cmsdk-apb-timer.h |  59 ++++++
 target/arm/translate.h             |   5 +-
 hw/arm/mps2.c                      | 385 +++++++++++++++++++++++++++++++++++
 hw/char/cmsdk-apb-uart.c           | 403 +++++++++++++++++++++++++++++++++++++
 hw/core/qdev.c                     |   2 +-
 hw/misc/mps2-scc.c                 | 310 ++++++++++++++++++++++++++++
 hw/timer/cmsdk-apb-timer.c         | 253 +++++++++++++++++++++++
 target/arm/cpu.c                   |  12 +-
 target/arm/translate-a64.c         |  19 +-
 target/arm/translate.c             |  22 +-
 MAINTAINERS                        |  14 +-
 default-configs/arm-softmmu.mak    |   6 +
 hw/char/trace-events               |   9 +
 hw/misc/trace-events               |   8 +
 hw/timer/trace-events              |   5 +
 24 files changed, 1673 insertions(+), 24 deletions(-)
 create mode 100644 include/hw/char/cmsdk-apb-uart.h
 create mode 100644 include/hw/misc/mps2-scc.h
 create mode 100644 include/hw/timer/cmsdk-apb-timer.h
 create mode 100644 hw/arm/mps2.c
 create mode 100644 hw/char/cmsdk-apb-uart.c
 create mode 100644 hw/misc/mps2-scc.c
 create mode 100644 hw/timer/cmsdk-apb-timer.c

In DEFINE_PROP_ARRAY, because we use a PropertyInfo (qdev_prop_arraylen)
which has a .set_default_value member we will set the field to a default
value. That default value will be zero, by the C rule that struct
initialization sets unmentioned members to zero if at least one member
is initialized. However it's clearer to state it explicitly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1499788408-10096-2-git-send-email-peter.maydell@linaro.org
---
 include/hw/qdev-properties.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
                           _arrayfield, _arrayprop, _arraytype) {        \
         .name = (PROP_ARRAY_LEN_PREFIX _name),                          \
         .info = &(qdev_prop_arraylen),                                  \
+        .defval.u = 0,                                                  \
         .offset = offsetof(_state, _field)                              \
             + type_check(uint32_t, typeof_field(_state, _field)),       \
         .arrayinfo = &(_arrayprop),                                     \
-- 
2.7.4

In some situations it's useful to have a qdev property which doesn't
automatically set its default value when qdev_property_add_static is
called (for instance when the default value is not constant).

Support this by adding a flag to the Property struct indicating
whether to set the default value.  This replaces the existing test
for whether the PropertyInfo set_default_value function pointer is
NULL, and we set the .set_default field to true for all those cases
of struct Property which use a PropertyInfo with a non-NULL
set_default_value, so behaviour remains the same as before.

This gives us the semantics of:
 * if .set_default is true, then .info->set_default_value must
   be not NULL, and .defval is used as the the default value of
   the property
 * otherwise, the property system does not set any default, and
   the field will retain whatever initial value it was given by
   the device's .instance_init method

We define two new macros DEFINE_PROP_SIGNED_NODEFAULT and
DEFINE_PROP_UNSIGNED_NODEFAULT, to cover the most plausible use cases
of wanting to set an integer property with no default value.

Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 1499788408-10096-3-git-send-email-peter.maydell@linaro.org
---
 include/hw/qdev-core.h       | 10 ++++++++++
 include/hw/qdev-properties.h | 20 ++++++++++++++++++++
 hw/core/qdev.c               |  2 +-
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -XXX,XX +XXX,XX @@ struct BusState {
     QLIST_ENTRY(BusState) sibling;
 };
 
+/**
+ * Property:
+ * @set_default: true if the default value should be set from @defval,
+ *    in which case @info->set_default_value must not be NULL
+ *    (if false then no default value is set by the property system
+ *     and the field retains whatever value it was given by instance_init).
+ * @defval: default value for the property. This is used only if @set_default
+ *     is true.
+ */
 struct Property {
     const char   *name;
     const PropertyInfo *info;
     ptrdiff_t    offset;
     uint8_t      bitnr;
+    bool         set_default;
     union {
         int64_t i;
         uint64_t u;
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
         .info      = &(_prop),                                          \
         .offset    = offsetof(_state, _field)                           \
             + type_check(_type,typeof_field(_state, _field)),           \
+        .set_default = true,                                            \
         .defval.i  = (_type)_defval,                                    \
         }
 
+#define DEFINE_PROP_SIGNED_NODEFAULT(_name, _state, _field, _prop, _type) { \
+        .name      = (_name),                                           \
+        .info      = &(_prop),                                          \
+        .offset    = offsetof(_state, _field)                           \
+            + type_check(_type, typeof_field(_state, _field)),          \
+        }
+
 #define DEFINE_PROP_BIT(_name, _state, _field, _bit, _defval) {  \
         .name      = (_name),                                    \
         .info      = &(qdev_prop_bit),                           \
         .bitnr    = (_bit),                                      \
         .offset    = offsetof(_state, _field)                    \
             + type_check(uint32_t,typeof_field(_state, _field)), \
+        .set_default = true,                                     \
         .defval.u  = (bool)_defval,                              \
         }
 
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
         .info      = &(_prop),                                          \
         .offset    = offsetof(_state, _field)                           \
             + type_check(_type, typeof_field(_state, _field)),          \
+        .set_default = true,                                            \
         .defval.u  = (_type)_defval,                                    \
         }
 
+#define DEFINE_PROP_UNSIGNED_NODEFAULT(_name, _state, _field, _prop, _type) { \
+        .name      = (_name),                                           \
+        .info      = &(_prop),                                          \
+        .offset    = offsetof(_state, _field)                           \
+            + type_check(_type, typeof_field(_state, _field)),          \
+        }
+
 #define DEFINE_PROP_BIT64(_name, _state, _field, _bit, _defval) {       \
         .name      = (_name),                                           \
         .info      = &(qdev_prop_bit64),                                \
         .bitnr    = (_bit),                                             \
         .offset    = offsetof(_state, _field)                           \
             + type_check(uint64_t, typeof_field(_state, _field)),       \
+        .set_default = true,                                            \
         .defval.u  = (bool)_defval,                                     \
         }
 
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
         .info      = &(qdev_prop_bool),                          \
         .offset    = offsetof(_state, _field)                    \
             + type_check(bool, typeof_field(_state, _field)),    \
+        .set_default = true,                                     \
         .defval.u    = (bool)_defval,                            \
         }
 
@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;
                           _arrayfield, _arrayprop, _arraytype) {        \
         .name = (PROP_ARRAY_LEN_PREFIX _name),                          \
         .info = &(qdev_prop_arraylen),                                  \
+        .set_default = true,                                            \
         .defval.u = 0,                                                  \
         .offset = offsetof(_state, _field)                              \
             + type_check(uint32_t, typeof_field(_state, _field)),       \
diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -XXX,XX +XXX,XX @@ void qdev_property_add_static(DeviceState *dev, Property *prop,
                                     prop->info->description,
                                     &error_abort);
 
-    if (prop->info->set_default_value) {
+    if (prop->set_default) {
         prop->info->set_default_value(obj, prop);
     }
 }
-- 
2.7.4

The Cortex-M3 and M4 CPUs always have 8 PMSA MPU regions (this isn't
a configurable option for the hardware).  Make the default value of
the pmsav7-dregion property be set per-cpu, so we don't need to have
every user of these CPUs set it manually.  (The existing default of
16 is correct for the other PMSAv7 core, the Cortex-R5.)

This fixes a bug where we were creating the M3 and M4 with
too many regions; most guest software would not notice or
care, though, since it would just not use the registers
associated with the unexpected extra regions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1499788408-10096-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_pmu_property =
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
+/* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,
+ * because the CPU initfn will have already set cpu->pmsav7_dregion to
+ * the right value for that particular CPU type, and we don't want
+ * to override that with an incorrect constant value.
+ */
 static Property arm_cpu_pmsav7_dregion_property =
-            DEFINE_PROP_UINT32("pmsav7-dregion", ARMCPU, pmsav7_dregion, 16);
+            DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
+                                           pmsav7_dregion,
+                                           qdev_prop_uint32, uint32_t);
 
 static void arm_cpu_post_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_M);
     cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
 }
 
 static void cortex_m4_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
     cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
 }
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     cpu->id_isar4 = 0x0010142;
     cpu->id_isar5 = 0x0;
     cpu->mp_is_up = true;
+    cpu->pmsav7_dregion = 16;
     define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
 }
 
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

As a precursor to later patches attempt to come up with a more
concrete wording for what each of the common exit cases would be.

CC: Emilio G. Cota <cota@braap.org>
CC: Richard Henderson <rth@twiddle.net>
CC: Lluís Vilanova <vilanova@ac.upc.edu>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-2-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/exec-all.h | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ typedef abi_ulong tb_page_addr_t;
 typedef ram_addr_t tb_page_addr_t;
 #endif
 
-/* is_jmp field values */
+/* DisasContext is_jmp field values
+ *
+ * is_jmp starts as DISAS_NEXT. The translator will keep processing
+ * instructions until an exit condition is reached. If we reach the
+ * exit condition and is_jmp is still DISAS_NEXT (because of some
+ * other condition) we simply "jump" to the next address.
+ * The remaining exit cases are:
+ *
+ *   DISAS_JUMP    - Only the PC was modified dynamically (e.g computed)
+ *   DISAS_TB_JUMP - Only the PC was modified statically (e.g. branch)
+ *
+ * In these cases as long as the PC is updated we can chain to the
+ * next TB either by exiting the loop or looking up the next TB via
+ * the loookup helper.
+ *
+ *   DISAS_UPDATE  - CPU State was modified dynamically
+ *
+ * This covers any other CPU state which necessities us exiting the
+ * TCG code to the main run-loop. Typically this includes anything
+ * that might change the interrupt state.
+ *
+ * Individual translators may define additional exit cases to deal
+ * with per-target special conditions.
+ */
 #define DISAS_NEXT    0 /* next instruction can be analyzed */
 #define DISAS_JUMP    1 /* only pc was modified dynamically */
-#define DISAS_UPDATE  2 /* cpu state was modified dynamically */
-#define DISAS_TB_JUMP 3 /* only pc was modified statically */
+#define DISAS_TB_JUMP 2 /* only pc was modified statically */
+#define DISAS_UPDATE  3 /* cpu state was modified dynamically */
 
 #include "qemu/log.h"
 
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

DISAS_UPDATE should be used when the wider CPU state other than just
the PC has been updated and we should therefore exit the TCG runtime
and return to the main execution loop rather assuming DISAS_JUMP would
do that.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-3-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 14 +++++++-------
 target/arm/translate.c     |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, dc->pc);
             break;
-        default:
-        case DISAS_UPDATE:
-            gen_a64_set_pc_im(dc->pc);
-            /* fall through */
         case DISAS_JUMP:
             tcg_gen_lookup_and_goto_ptr(cpu_pc);
             break;
-        case DISAS_EXIT:
-            tcg_gen_exit_tb(0);
-            break;
         case DISAS_TB_JUMP:
         case DISAS_EXC:
         case DISAS_SWI:
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
              */
             tcg_gen_exit_tb(0);
             break;
+        case DISAS_UPDATE:
+            gen_a64_set_pc_im(dc->pc);
+            /* fall through */
+        case DISAS_EXIT:
+        default:
+            tcg_gen_exit_tb(0);
+            break;
         }
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
         case DISAS_NEXT:
             gen_goto_tb(dc, 1, dc->pc);
             break;
-        case DISAS_UPDATE:
-            gen_set_pc_im(dc, dc->pc);
-            /* fall through */
         case DISAS_JUMP:
             gen_goto_ptr();
             break;
+        case DISAS_UPDATE:
+            gen_set_pc_im(dc, dc->pc);
+            /* fall through */
         default:
             /* indicate that the hash table must be used to find the next TB */
             tcg_gen_exit_tb(0);
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

We already have an exit condition, DISAS_UPDATE which will exit the
run-loop. Expand on the difference with DISAS_EXIT in the comments.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-4-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
  */
 #define DISAS_BX_EXCRET 11
 /* For instructions which want an immediate exit to the main loop,
- * as opposed to attempting to use lookup_and_goto_ptr.
+ * as opposed to attempting to use lookup_and_goto_ptr. Unlike
+ * DISAS_UPDATE this doesn't write the PC on exiting the translation
+ * loop so you need to ensure something (gen_a64_set_pc_im or runtime
+ * helper) has done so before we reach return from cpu_tb_exec.
  */
 #define DISAS_EXIT 12
 
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

As the gen_goto_tb function can do both static and dynamic jumps it
should also set the is_jmp field. This matches the behaviour of the
a64 code.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-5-alex.bennee@linaro.org
[tweak to multiline comment formatting]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_goto_ptr(void)
     tcg_temp_free(addr);
 }
 
+/* This will end the TB but doesn't guarantee we'll return to
+ * cpu_loop_exec. Any live exit_requests will be processed as we
+ * enter the next TB.
+ */
 static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
 {
     if (use_goto_tb(s, dest)) {
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)
         gen_set_pc_im(s, dest);
         gen_goto_ptr();
     }
+    s->is_jmp = DISAS_TB_JUMP;
 }
 
 static inline void gen_jmp (DisasContext *s, uint32_t dest)
@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp (DisasContext *s, uint32_t dest)
         gen_bx_im(s, dest);
     } else {
         gen_goto_tb(s, 0, dest);
-        s->is_jmp = DISAS_TB_JUMP;
     }
 }
 
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

While an ISB will ensure any raised IRQs happen on the next
instruction it doesn't cause any to get raised by itself. We can
therefore use a simple tb exit for ISB instructions and rely on the
exit_request check at the top of each TB to deal with exiting if
needed.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-6-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 +-
 target/arm/translate.c     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,
          * a self-modified code correctly and also to take
          * any pending interrupts immediately.
          */
-        s->is_jmp = DISAS_UPDATE;
+        gen_goto_tb(s, 0, s->pc);
         return;
     default:
         unallocated_encoding(s);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  * self-modifying code correctly and also to take
                  * any pending interrupts immediately.
                  */
-                gen_lookup_tb(s);
+                gen_goto_tb(s, 0, s->pc & ~1);
                 return;
             default:
                 goto illegal_op;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
                              * and also to take any pending interrupts
                              * immediately.
                              */
-                            gen_lookup_tb(s);
+                            gen_goto_tb(s, 0, s->pc & ~1);
                             break;
                         default:
                             goto illegal_op;
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

Previously DISAS_JUMP did ensure this but with the optimisation of
8a6b28c7 (optimize indirect branches) we might not leave the loop.
This means if any pending interrupts are cleared by changing IRQ flags
we might never get around to servicing them. You usually notice this
by seeing the lookup_tb_ptr() helper gainfully chaining TBs together
while cpu->interrupt_request remains high and the exit_request has not
been set.

This breaks amongst other things the OPTEE test suite which executes
an eret from the secure world after a non-secure world IRQ has gone
pending which then never gets serviced.

Instead of using the previously implied semantics of DISAS_JUMP we use
DISAS_EXIT which will always exit the run-loop.

CC: Etienne Carriere <etienne.carriere@linaro.org>
CC: Joakim Bech <joakim.bech@linaro.org>
CC: Jaroslaw Pelczar <j.pelczar@samsung.com>
CC: Peter Maydell <peter.maydell@linaro.org>
CC: Emilio G. Cota <cota@braap.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <rth@twiddle.net>
Message-id: 20170713141928.25419-7-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 target/arm/translate.c     | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
             return;
         }
         gen_helper_exception_return(cpu_env);
-        s->is_jmp = DISAS_JUMP;
+        /* Must exit loop to check un-masked IRQs */
+        s->is_jmp = DISAS_EXIT;
         return;
     case 5: /* DRPS */
         if (rn != 0x1f) {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
      */
     gen_helper_cpsr_write_eret(cpu_env, cpsr);
     tcg_temp_free_i32(cpsr);
-    s->is_jmp = DISAS_JUMP;
+    /* Must exit loop to check un-masked IRQs */
+    s->is_jmp = DISAS_EXIT;
 }
 
 /* Generate an old-style exception return. Marks pc as dead. */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                     tmp = load_cpu_field(spsr);
                     gen_helper_cpsr_write_eret(cpu_env, tmp);
                     tcg_temp_free_i32(tmp);
-                    s->is_jmp = DISAS_JUMP;
+                    /* Must exit loop to check un-masked IRQs */
+                    s->is_jmp = DISAS_EXIT;
                 }
             }
             break;
-- 
2.7.4

Model the ARM MPS2/MPS2+ FPGA based development board.

The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
FPGA but is otherwise the same as the 2). Since the CPU itself
and most of the devices are in the FPGA, the details of the board
as seen by the guest depend significantly on the FPGA image.

We model the following FPGA images:
 "mps2_an385" -- Cortex-M3 as documented in ARM Application Note AN385
 "mps2_an511" -- Cortex-M3 'DesignStart' as documented in AN511

They are fairly similar but differ in the details for some
peripherals.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1500029487-14822-2-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/arm/Makefile.objs            |   1 +
 hw/arm/mps2.c                   | 270 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 272 insertions(+)
 create mode 100644 hw/arm/mps2.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
+obj-$(CONFIG_MPS2) += mps2.o
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM V2M MPS2 board emulation.
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger
+ * FPGA but is otherwise the same as the 2). Since the CPU itself
+ * and most of the devices are in the FPGA, the details of the board
+ * as seen by the guest depend significantly on the FPGA image.
+ * We model the following FPGA images:
+ *  "mps2-an385" -- Cortex-M3 as documented in ARM Application Note AN385
+ *  "mps2-an511" -- Cortex-M3 'DesignStart' as documented in AN511
+ *
+ * Links to the TRM for the board itself and to the various Application
+ * Notes which document the FPGA images can be found here:
+ *   https://developer.arm.com/products/system-design/development-boards/cortex-m-prototyping-system
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "hw/arm/arm.h"
+#include "hw/arm/armv7m.h"
+#include "hw/boards.h"
+#include "exec/address-spaces.h"
+#include "hw/misc/unimp.h"
+
+typedef enum MPS2FPGAType {
+    FPGA_AN385,
+    FPGA_AN511,
+} MPS2FPGAType;
+
+typedef struct {
+    MachineClass parent;
+    MPS2FPGAType fpga_type;
+    const char *cpu_model;
+} MPS2MachineClass;
+
+typedef struct {
+    MachineState parent;
+
+    ARMv7MState armv7m;
+    MemoryRegion psram;
+    MemoryRegion ssram1;
+    MemoryRegion ssram1_m;
+    MemoryRegion ssram23;
+    MemoryRegion ssram23_m;
+    MemoryRegion blockram;
+    MemoryRegion blockram_m1;
+    MemoryRegion blockram_m2;
+    MemoryRegion blockram_m3;
+    MemoryRegion sram;
+} MPS2MachineState;
+
+#define TYPE_MPS2_MACHINE "mps2"
+#define TYPE_MPS2_AN385_MACHINE MACHINE_TYPE_NAME("mps2-an385")
+#define TYPE_MPS2_AN511_MACHINE MACHINE_TYPE_NAME("mps2-an511")
+
+#define MPS2_MACHINE(obj)                                       \
+    OBJECT_CHECK(MPS2MachineState, obj, TYPE_MPS2_MACHINE)
+#define MPS2_MACHINE_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(MPS2MachineClass, obj, TYPE_MPS2_MACHINE)
+#define MPS2_MACHINE_CLASS(klass) \
+    OBJECT_CLASS_CHECK(MPS2MachineClass, klass, TYPE_MPS2_MACHINE)
+
+/* Main SYSCLK frequency in Hz */
+#define SYSCLK_FRQ 25000000
+
+/* Initialize the auxiliary RAM region @mr and map it into
+ * the memory map at @base.
+ */
+static void make_ram(MemoryRegion *mr, const char *name,
+                     hwaddr base, hwaddr size)
+{
+    memory_region_init_ram(mr, NULL, name, size, &error_fatal);
+    memory_region_add_subregion(get_system_memory(), base, mr);
+}
+
+/* Create an alias of an entire original MemoryRegion @orig
+ * located at @base in the memory map.
+ */
+static void make_ram_alias(MemoryRegion *mr, const char *name,
+                           MemoryRegion *orig, hwaddr base)
+{
+    memory_region_init_alias(mr, NULL, name, orig, 0,
+                             memory_region_size(orig));
+    memory_region_add_subregion(get_system_memory(), base, mr);
+}
+
+static void mps2_common_init(MachineState *machine)
+{
+    MPS2MachineState *mms = MPS2_MACHINE(machine);
+    MPS2MachineClass *mmc = MPS2_MACHINE_GET_CLASS(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    DeviceState *armv7m;
+
+    if (!machine->cpu_model) {
+        machine->cpu_model = mmc->cpu_model;
+    }
+
+    if (strcmp(machine->cpu_model, mmc->cpu_model) != 0) {
+        error_report("This board can only be used with CPU %s", mmc->cpu_model);
+        exit(1);
+    }
+
+    /* The FPGA images have an odd combination of different RAMs,
+     * because in hardware they are different implementations and
+     * connected to different buses, giving varying performance/size
+     * tradeoffs. For QEMU they're all just RAM, though. We arbitrarily
+     * call the 16MB our "system memory", as it's the largest lump.
+     *
+     * Common to both boards:
+     *  0x21000000..0x21ffffff : PSRAM (16MB)
+     * AN385 only:
+     *  0x00000000 .. 0x003fffff : ZBT SSRAM1
+     *  0x00400000 .. 0x007fffff : mirror of ZBT SSRAM1
+     *  0x20000000 .. 0x203fffff : ZBT SSRAM 2&3
+     *  0x20400000 .. 0x207fffff : mirror of ZBT SSRAM 2&3
+     *  0x01000000 .. 0x01003fff : block RAM (16K)
+     *  0x01004000 .. 0x01007fff : mirror of above
+     *  0x01008000 .. 0x0100bfff : mirror of above
+     *  0x0100c000 .. 0x0100ffff : mirror of above
+     * AN511 only:
+     *  0x00000000 .. 0x0003ffff : FPGA block RAM
+     *  0x00400000 .. 0x007fffff : ZBT SSRAM1
+     *  0x20000000 .. 0x2001ffff : SRAM
+     *  0x20400000 .. 0x207fffff : ZBT SSRAM 2&3
+     *
+     * The AN385 has a feature where the lowest 16K can be mapped
+     * either to the bottom of the ZBT SSRAM1 or to the block RAM.
+     * This is of no use for QEMU so we don't implement it (as if
+     * zbt_boot_ctrl is always zero).
+     */
+    memory_region_allocate_system_memory(&mms->psram,
+                                         NULL, "mps.ram", 0x1000000);
+    memory_region_add_subregion(system_memory, 0x21000000, &mms->psram);
+
+    switch (mmc->fpga_type) {
+    case FPGA_AN385:
+        make_ram(&mms->ssram1, "mps.ssram1", 0x0, 0x400000);
+        make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", &mms->ssram1, 0x400000);
+        make_ram(&mms->ssram23, "mps.ssram23", 0x20000000, 0x400000);
+        make_ram_alias(&mms->ssram23_m, "mps.ssram23_m",
+                       &mms->ssram23, 0x20400000);
+        make_ram(&mms->blockram, "mps.blockram", 0x01000000, 0x4000);
+        make_ram_alias(&mms->blockram_m1, "mps.blockram_m1",
+                       &mms->blockram, 0x01004000);
+        make_ram_alias(&mms->blockram_m2, "mps.blockram_m2",
+                       &mms->blockram, 0x01008000);
+        make_ram_alias(&mms->blockram_m3, "mps.blockram_m3",
+                       &mms->blockram, 0x0100c000);
+        break;
+    case FPGA_AN511:
+        make_ram(&mms->blockram, "mps.blockram", 0x0, 0x40000);
+        make_ram(&mms->ssram1, "mps.ssram1", 0x00400000, 0x00800000);
+        make_ram(&mms->sram, "mps.sram", 0x20000000, 0x20000);
+        make_ram(&mms->ssram23, "mps.ssram23", 0x20400000, 0x400000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    object_initialize(&mms->armv7m, sizeof(mms->armv7m), TYPE_ARMV7M);
+    armv7m = DEVICE(&mms->armv7m);
+    qdev_set_parent_bus(armv7m, sysbus_get_default());
+    switch (mmc->fpga_type) {
+    case FPGA_AN385:
+        qdev_prop_set_uint32(armv7m, "num-irq", 32);
+        break;
+    case FPGA_AN511:
+        qdev_prop_set_uint32(armv7m, "num-irq", 64);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    qdev_prop_set_string(armv7m, "cpu-model", machine->cpu_model);
+    object_property_set_link(OBJECT(&mms->armv7m), OBJECT(system_memory),
+                             "memory", &error_abort);
+    object_property_set_bool(OBJECT(&mms->armv7m), true, "realized",
+                             &error_fatal);
+
+    create_unimplemented_device("zbtsmram mirror", 0x00400000, 0x00400000);
+    create_unimplemented_device("RESERVED 1", 0x00800000, 0x00800000);
+    create_unimplemented_device("Block RAM", 0x01000000, 0x00010000);
+    create_unimplemented_device("RESERVED 2", 0x01010000, 0x1EFF0000);
+    create_unimplemented_device("RESERVED 3", 0x20800000, 0x00800000);
+    create_unimplemented_device("PSRAM", 0x21000000, 0x01000000);
+    /* These three ranges all cover multiple devices; we may implement
+     * some of them below (in which case the real device takes precedence
+     * over the unimplemented-region mapping).
+     */
+    create_unimplemented_device("CMSDK APB peripheral region @0x40000000",
+                                0x40000000, 0x00010000);
+    create_unimplemented_device("CMSDK peripheral region @0x40010000",
+                                0x40010000, 0x00010000);
+    create_unimplemented_device("Extra peripheral region @0x40020000",
+                                0x40020000, 0x00010000);
+    create_unimplemented_device("RESERVED 4", 0x40030000, 0x001D0000);
+    create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
+    create_unimplemented_device("VGA", 0x41000000, 0x0200000);
+
+    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+
+    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+                       0x400000);
+}
+
+static void mps2_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->init = mps2_common_init;
+    mc->max_cpus = 1;
+}
+
+static void mps2_an385_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
+
+    mc->desc = "ARM MPS2 with AN385 FPGA image for Cortex-M3";
+    mmc->fpga_type = FPGA_AN385;
+    mmc->cpu_model = "cortex-m3";
+}
+
+static void mps2_an511_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    MPS2MachineClass *mmc = MPS2_MACHINE_CLASS(oc);
+
+    mc->desc = "ARM MPS2 with AN511 DesignStart FPGA image for Cortex-M3";
+    mmc->fpga_type = FPGA_AN511;
+    mmc->cpu_model = "cortex-m3";
+}
+
+static const TypeInfo mps2_info = {
+    .name = TYPE_MPS2_MACHINE,
+    .parent = TYPE_MACHINE,
+    .abstract = true,
+    .instance_size = sizeof(MPS2MachineState),
+    .class_size = sizeof(MPS2MachineClass),
+    .class_init = mps2_class_init,
+};
+
+static const TypeInfo mps2_an385_info = {
+    .name = TYPE_MPS2_AN385_MACHINE,
+    .parent = TYPE_MPS2_MACHINE,
+    .class_init = mps2_an385_class_init,
+};
+
+static const TypeInfo mps2_an511_info = {
+    .name = TYPE_MPS2_AN511_MACHINE,
+    .parent = TYPE_MPS2_MACHINE,
+    .class_init = mps2_an511_class_init,
+};
+
+static void mps2_machine_init(void)
+{
+    type_register_static(&mps2_info);
+    type_register_static(&mps2_an385_info);
+    type_register_static(&mps2_an511_info);
+}
+
+type_init(mps2_machine_init);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_ONENAND=y
 CONFIG_TUSB6010=y
 CONFIG_IMX=y
 CONFIG_MAINSTONE=y
+CONFIG_MPS2=y
 CONFIG_NSERIES=y
 CONFIG_RASPI=y
 CONFIG_REALVIEW=y
-- 
2.7.4

Implement a model of the simple "APB UART" provided in
the Cortex-M System Design Kit (CMSDK).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1500029487-14822-3-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/char/Makefile.objs            |   1 +
 include/hw/char/cmsdk-apb-uart.h |  78 ++++++++
 hw/char/cmsdk-apb-uart.c         | 403 +++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak  |   2 +
 hw/char/trace-events             |   9 +
 5 files changed, 493 insertions(+)
 create mode 100644 include/hw/char/cmsdk-apb-uart.h
 create mode 100644 hw/char/cmsdk-apb-uart.c

diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Makefile.objs
+++ b/hw/char/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic-uart.o
 obj-$(CONFIG_STM32F2XX_USART) += stm32f2xx_usart.o
 obj-$(CONFIG_RASPI) += bcm2835_aux.o
 
+common-obj-$(CONFIG_CMSDK_APB_UART) += cmsdk-apb-uart.o
 common-obj-$(CONFIG_ETRAXFS) += etraxfs_ser.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugcon.o
 common-obj-$(CONFIG_GRLIB) += grlib_apbuart.o
diff --git a/include/hw/char/cmsdk-apb-uart.h b/include/hw/char/cmsdk-apb-uart.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/char/cmsdk-apb-uart.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB UART emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+#ifndef CMSDK_APB_UART_H
+#define CMSDK_APB_UART_H
+
+#include "hw/sysbus.h"
+#include "chardev/char-fe.h"
+
+#define TYPE_CMSDK_APB_UART "cmsdk-apb-uart"
+#define CMSDK_APB_UART(obj) OBJECT_CHECK(CMSDKAPBUART, (obj), \
+                                         TYPE_CMSDK_APB_UART)
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    CharBackend chr;
+    qemu_irq txint;
+    qemu_irq rxint;
+    qemu_irq txovrint;
+    qemu_irq rxovrint;
+    qemu_irq uartint;
+    guint watch_tag;
+    uint32_t pclk_frq;
+
+    uint32_t state;
+    uint32_t ctrl;
+    uint32_t intstatus;
+    uint32_t bauddiv;
+    /* This UART has no FIFO, only a 1-character buffer for each of Tx and Rx */
+    uint8_t txbuf;
+    uint8_t rxbuf;
+} CMSDKAPBUART;
+
+/**
+ * cmsdk_apb_uart_create - convenience function to create TYPE_CMSDK_APB_UART
+ * @addr: location in system memory to map registers
+ * @chr: Chardev backend to connect UART to, or NULL if no backend
+ * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
+ */
+static inline DeviceState *cmsdk_apb_uart_create(hwaddr addr,
+                                                 qemu_irq txint,
+                                                 qemu_irq rxint,
+                                                 qemu_irq txovrint,
+                                                 qemu_irq rxovrint,
+                                                 qemu_irq uartint,
+                                                 Chardev *chr,
+                                                 uint32_t pclk_frq)
+{
+    DeviceState *dev;
+    SysBusDevice *s;
+
+    dev = qdev_create(NULL, TYPE_CMSDK_APB_UART);
+    s = SYS_BUS_DEVICE(dev);
+    qdev_prop_set_chr(dev, "chardev", chr);
+    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
+    qdev_init_nofail(dev);
+    sysbus_mmio_map(s, 0, addr);
+    sysbus_connect_irq(s, 0, txint);
+    sysbus_connect_irq(s, 1, rxint);
+    sysbus_connect_irq(s, 2, txovrint);
+    sysbus_connect_irq(s, 3, rxovrint);
+    sysbus_connect_irq(s, 4, uartint);
+    return dev;
+}
+
+#endif
diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB UART emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/* This is a model of the "APB UART" which is part of the Cortex-M
+ * System Design Kit (CMSDK) and documented in the Cortex-M System
+ * Design Kit Technical Reference Manual (ARM DDI0479C):
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
+#include "hw/char/cmsdk-apb-uart.h"
+
+REG32(DATA, 0)
+REG32(STATE, 4)
+    FIELD(STATE, TXFULL, 0, 1)
+    FIELD(STATE, RXFULL, 1, 1)
+    FIELD(STATE, TXOVERRUN, 2, 1)
+    FIELD(STATE, RXOVERRUN, 3, 1)
+REG32(CTRL, 8)
+    FIELD(CTRL, TX_EN, 0, 1)
+    FIELD(CTRL, RX_EN, 1, 1)
+    FIELD(CTRL, TX_INTEN, 2, 1)
+    FIELD(CTRL, RX_INTEN, 3, 1)
+    FIELD(CTRL, TXO_INTEN, 4, 1)
+    FIELD(CTRL, RXO_INTEN, 5, 1)
+    FIELD(CTRL, HSTEST, 6, 1)
+REG32(INTSTATUS, 0xc)
+    FIELD(INTSTATUS, TX, 0, 1)
+    FIELD(INTSTATUS, RX, 1, 1)
+    FIELD(INTSTATUS, TXO, 2, 1)
+    FIELD(INTSTATUS, RXO, 3, 1)
+REG32(BAUDDIV, 0x10)
+REG32(PID4, 0xFD0)
+REG32(PID5, 0xFD4)
+REG32(PID6, 0xFD8)
+REG32(PID7, 0xFDC)
+REG32(PID0, 0xFE0)
+REG32(PID1, 0xFE4)
+REG32(PID2, 0xFE8)
+REG32(PID3, 0xFEC)
+REG32(CID0, 0xFF0)
+REG32(CID1, 0xFF4)
+REG32(CID2, 0xFF8)
+REG32(CID3, 0xFFC)
+
+/* PID/CID values */
+static const int uart_id[] = {
+    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+    0x21, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
+    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
+static bool uart_baudrate_ok(CMSDKAPBUART *s)
+{
+    /* The minimum permitted bauddiv setting is 16, so we just ignore
+     * settings below that (usually this means the device has just
+     * been reset and not yet programmed).
+     */
+    return s->bauddiv >= 16 && s->bauddiv <= s->pclk_frq;
+}
+
+static void uart_update_parameters(CMSDKAPBUART *s)
+{
+    QEMUSerialSetParams ssp;
+
+    /* This UART is always 8N1 but the baud rate is programmable. */
+    if (!uart_baudrate_ok(s)) {
+        return;
+    }
+
+    ssp.data_bits = 8;
+    ssp.parity = 'N';
+    ssp.stop_bits = 1;
+    ssp.speed = s->pclk_frq / s->bauddiv;
+    qemu_chr_fe_ioctl(&s->chr, CHR_IOCTL_SERIAL_SET_PARAMS, &ssp);
+    trace_cmsdk_apb_uart_set_params(ssp.speed);
+}
+
+static void cmsdk_apb_uart_update(CMSDKAPBUART *s)
+{
+    /* update outbound irqs, including handling the way the rxo and txo
+     * interrupt status bits are just logical AND of the overrun bit in
+     * STATE and the overrun interrupt enable bit in CTRL.
+     */
+    uint32_t omask = (R_INTSTATUS_RXO_MASK | R_INTSTATUS_TXO_MASK);
+    s->intstatus &= ~omask;
+    s->intstatus |= (s->state & (s->ctrl >> 2) & omask);
+
+    qemu_set_irq(s->txint, !!(s->intstatus & R_INTSTATUS_TX_MASK));
+    qemu_set_irq(s->rxint, !!(s->intstatus & R_INTSTATUS_RX_MASK));
+    qemu_set_irq(s->txovrint, !!(s->intstatus & R_INTSTATUS_TXO_MASK));
+    qemu_set_irq(s->rxovrint, !!(s->intstatus & R_INTSTATUS_RXO_MASK));
+    qemu_set_irq(s->uartint, !!(s->intstatus));
+}
+
+static int uart_can_receive(void *opaque)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+
+    /* We can take a char if RX is enabled and the buffer is empty */
+    if (s->ctrl & R_CTRL_RX_EN_MASK && !(s->state & R_STATE_RXFULL_MASK)) {
+        return 1;
+    }
+    return 0;
+}
+
+static void uart_receive(void *opaque, const uint8_t *buf, int size)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+
+    trace_cmsdk_apb_uart_receive(*buf);
+
+    /* In fact uart_can_receive() ensures that we can't be
+     * called unless RX is enabled and the buffer is empty,
+     * but we include this logic as documentation of what the
+     * hardware does if a character arrives in these circumstances.
+     */
+    if (!(s->ctrl & R_CTRL_RX_EN_MASK)) {
+        /* Just drop the character on the floor */
+        return;
+    }
+
+    if (s->state & R_STATE_RXFULL_MASK) {
+        s->state |= R_STATE_RXOVERRUN_MASK;
+    }
+
+    s->rxbuf = *buf;
+    s->state |= R_STATE_RXFULL_MASK;
+    if (s->ctrl & R_CTRL_RX_INTEN_MASK) {
+        s->intstatus |= R_INTSTATUS_RX_MASK;
+    }
+    cmsdk_apb_uart_update(s);
+}
+
+static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+    uint64_t r;
+
+    switch (offset) {
+    case A_DATA:
+        r = s->rxbuf;
+        s->state &= ~R_STATE_RXFULL_MASK;
+        cmsdk_apb_uart_update(s);
+        break;
+    case A_STATE:
+        r = s->state;
+        break;
+    case A_CTRL:
+        r = s->ctrl;
+        break;
+    case A_INTSTATUS:
+        r = s->intstatus;
+        break;
+    case A_BAUDDIV:
+        r = s->bauddiv;
+        break;
+    case A_PID4 ... A_CID3:
+        r = uart_id[(offset - A_PID4) / 4];
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB UART read: bad offset %x\n", (int) offset);
+        r = 0;
+        break;
+    }
+    trace_cmsdk_apb_uart_read(offset, r, size);
+    return r;
+}
+
+/* Try to send tx data, and arrange to be called back later if
+ * we can't (ie the char backend is busy/blocking).
+ */
+static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+    int ret;
+
+    s->watch_tag = 0;
+
+    if (!(s->ctrl & R_CTRL_TX_EN_MASK) || !(s->state & R_STATE_TXFULL_MASK)) {
+        return FALSE;
+    }
+
+    ret = qemu_chr_fe_write(&s->chr, &s->txbuf, 1);
+    if (ret <= 0) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+        if (!s->watch_tag) {
+            /* Most common reason to be here is "no chardev backend":
+             * just insta-drain the buffer, so the serial output
+             * goes into a void, rather than blocking the guest.
+             */
+            goto buffer_drained;
+        }
+        /* Transmit pending */
+        trace_cmsdk_apb_uart_tx_pending();
+        return FALSE;
+    }
+
+buffer_drained:
+    /* Character successfully sent */
+    trace_cmsdk_apb_uart_tx(s->txbuf);
+    s->state &= ~R_STATE_TXFULL_MASK;
+    /* Going from TXFULL set to clear triggers the tx interrupt */
+    if (s->ctrl & R_CTRL_TX_INTEN_MASK) {
+        s->intstatus |= R_INTSTATUS_TX_MASK;
+    }
+    cmsdk_apb_uart_update(s);
+    return FALSE;
+}
+
+static void uart_cancel_transmit(CMSDKAPBUART *s)
+{
+    if (s->watch_tag) {
+        g_source_remove(s->watch_tag);
+        s->watch_tag = 0;
+    }
+}
+
+static void uart_write(void *opaque, hwaddr offset, uint64_t value,
+                       unsigned size)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+
+    trace_cmsdk_apb_uart_write(offset, value, size);
+
+    switch (offset) {
+    case A_DATA:
+        s->txbuf = value;
+        if (s->state & R_STATE_TXFULL_MASK) {
+            /* Buffer already full -- note the overrun and let the
+             * existing pending transmit callback handle the new char.
+             */
+            s->state |= R_STATE_TXOVERRUN_MASK;
+            cmsdk_apb_uart_update(s);
+        } else {
+            s->state |= R_STATE_TXFULL_MASK;
+            uart_transmit(NULL, G_IO_OUT, s);
+        }
+        break;
+    case A_STATE:
+        /* Bits 0 and 1 are read only; bits 2 and 3 are W1C */
+        s->state &= ~(value &
+                      (R_STATE_TXOVERRUN_MASK | R_STATE_RXOVERRUN_MASK));
+        cmsdk_apb_uart_update(s);
+        break;
+    case A_CTRL:
+        s->ctrl = value & 0x7f;
+        if ((s->ctrl & R_CTRL_TX_EN_MASK) && !uart_baudrate_ok(s)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "CMSDK APB UART: Tx enabled with invalid baudrate\n");
+        }
+        cmsdk_apb_uart_update(s);
+        break;
+    case A_INTSTATUS:
+        /* All bits are W1C. Clearing the overrun interrupt bits really
+         * clears the overrun status bits in the STATE register (which
+         * is then reflected into the intstatus value by the update function).
+         */
+        s->state &= ~(value & (R_INTSTATUS_TXO_MASK | R_INTSTATUS_RXO_MASK));
+        cmsdk_apb_uart_update(s);
+        break;
+    case A_BAUDDIV:
+        s->bauddiv = value & 0xFFFFF;
+        uart_update_parameters(s);
+        break;
+    case A_PID4 ... A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB UART write: write to RO offset 0x%x\n",
+                      (int)offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB UART write: bad offset 0x%x\n", (int) offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps uart_ops = {
+    .read = uart_read,
+    .write = uart_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void cmsdk_apb_uart_reset(DeviceState *dev)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(dev);
+
+    trace_cmsdk_apb_uart_reset();
+    uart_cancel_transmit(s);
+    s->state = 0;
+    s->ctrl = 0;
+    s->intstatus = 0;
+    s->bauddiv = 0;
+    s->txbuf = 0;
+    s->rxbuf = 0;
+}
+
+static void cmsdk_apb_uart_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    CMSDKAPBUART *s = CMSDK_APB_UART(obj);
+
+    memory_region_init_io(&s->iomem, obj, &uart_ops, s, "uart", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->txint);
+    sysbus_init_irq(sbd, &s->rxint);
+    sysbus_init_irq(sbd, &s->txovrint);
+    sysbus_init_irq(sbd, &s->rxovrint);
+    sysbus_init_irq(sbd, &s->uartint);
+}
+
+static void cmsdk_apb_uart_realize(DeviceState *dev, Error **errp)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(dev);
+
+    if (s->pclk_frq == 0) {
+        error_setg(errp, "CMSDK APB UART: pclk-frq property must be set");
+        return;
+    }
+
+    /* This UART has no flow control, so we do not need to register
+     * an event handler to deal with CHR_EVENT_BREAK.
+     */
+    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
+                             NULL, s, NULL, true);
+}
+
+static int cmsdk_apb_uart_post_load(void *opaque, int version_id)
+{
+    CMSDKAPBUART *s = CMSDK_APB_UART(opaque);
+
+    /* If we have a pending character, arrange to resend it. */
+    if (s->state & R_STATE_TXFULL_MASK) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+    }
+    uart_update_parameters(s);
+    return 0;
+}
+
+static const VMStateDescription cmsdk_apb_uart_vmstate = {
+    .name = "cmsdk-apb-uart",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .post_load = cmsdk_apb_uart_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(state, CMSDKAPBUART),
+        VMSTATE_UINT32(ctrl, CMSDKAPBUART),
+        VMSTATE_UINT32(intstatus, CMSDKAPBUART),
+        VMSTATE_UINT32(bauddiv, CMSDKAPBUART),
+        VMSTATE_UINT8(txbuf, CMSDKAPBUART),
+        VMSTATE_UINT8(rxbuf, CMSDKAPBUART),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property cmsdk_apb_uart_properties[] = {
+    DEFINE_PROP_CHR("chardev", CMSDKAPBUART, chr),
+    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBUART, pclk_frq, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void cmsdk_apb_uart_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = cmsdk_apb_uart_realize;
+    dc->vmsd = &cmsdk_apb_uart_vmstate;
+    dc->reset = cmsdk_apb_uart_reset;
+    dc->props = cmsdk_apb_uart_properties;
+}
+
+static const TypeInfo cmsdk_apb_uart_info = {
+    .name = TYPE_CMSDK_APB_UART,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(CMSDKAPBUART),
+    .instance_init = cmsdk_apb_uart_init,
+    .class_init = cmsdk_apb_uart_class_init,
+};
+
+static void cmsdk_apb_uart_register_types(void)
+{
+    type_register_static(&cmsdk_apb_uart_info);
+}
+
+type_init(cmsdk_apb_uart_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_ADC=y
 CONFIG_STM32F2XX_SPI=y
 CONFIG_STM32F205_SOC=y
 
+CONFIG_CMSDK_APB_UART=y
+
 CONFIG_VERSATILE_PCI=y
 CONFIG_VERSATILE_I2C=y
 
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ pl011_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 pl011_can_receive(uint32_t lcr, int read_count, int r) "LCR %08x read_count %d returning %d"
 pl011_put_fifo(uint32_t c, int read_count) "new char 0x%x read_count now %d"
 pl011_put_fifo_full(void) "FIFO now full, RXFF set"
+
+# hw/char/cmsdk_apb_uart.c
+cmsdk_apb_uart_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB UART read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_uart_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB UART write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_uart_reset(void) "CMSDK APB UART: reset"
+cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backend"
+cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
+cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
+cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
-- 
2.7.4

Add the UARTs to the MPS2 board models.

Unfortunately the details of the wiring of the interrupts through
various OR gates differ between AN511 and AN385 so this can't
be purely a data-driven difference.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1500029487-14822-4-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c            | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
 hw/char/cmsdk-apb-uart.c |  2 +-
 2 files changed, 89 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/arm/arm.h"
 #include "hw/arm/armv7m.h"
+#include "hw/or-irq.h"
 #include "hw/boards.h"
 #include "exec/address-spaces.h"
+#include "sysemu/sysemu.h"
 #include "hw/misc/unimp.h"
+#include "hw/char/cmsdk-apb-uart.h"
 
 typedef enum MPS2FPGAType {
     FPGA_AN385,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
     create_unimplemented_device("VGA", 0x41000000, 0x0200000);
 
+    switch (mmc->fpga_type) {
+    case FPGA_AN385:
+    {
+        /* The overflow IRQs for UARTs 0, 1 and 2 are ORed together.
+         * Overflow for UARTs 4 and 5 doesn't trigger any interrupt.
+         */
+        Object *orgate;
+        DeviceState *orgate_dev;
+        int i;
+
+        orgate = object_new(TYPE_OR_IRQ);
+        object_property_set_int(orgate, 6, "num-lines", &error_fatal);
+        object_property_set_bool(orgate, true, "realized", &error_fatal);
+        orgate_dev = DEVICE(orgate);
+        qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
+
+        for (i = 0; i < 5; i++) {
+            static const hwaddr uartbase[] = {0x40004000, 0x40005000,
+                                              0x40006000, 0x40007000,
+                                              0x40009000};
+            Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
+            /* RX irq number; TX irq is always one greater */
+            static const int uartirq[] = {0, 2, 4, 18, 20};
+            qemu_irq txovrint = NULL, rxovrint = NULL;
+
+            if (i < 3) {
+                txovrint = qdev_get_gpio_in(orgate_dev, i * 2);
+                rxovrint = qdev_get_gpio_in(orgate_dev, i * 2 + 1);
+            }
+
+            cmsdk_apb_uart_create(uartbase[i],
+                                  qdev_get_gpio_in(armv7m, uartirq[i] + 1),
+                                  qdev_get_gpio_in(armv7m, uartirq[i]),
+                                  txovrint, rxovrint,
+                                  NULL,
+                                  uartchr, SYSCLK_FRQ);
+        }
+        break;
+    }
+    case FPGA_AN511:
+    {
+        /* The overflow IRQs for all UARTs are ORed together.
+         * Tx and Rx IRQs for each UART are ORed together.
+         */
+        Object *orgate;
+        DeviceState *orgate_dev;
+        int i;
+
+        orgate = object_new(TYPE_OR_IRQ);
+        object_property_set_int(orgate, 10, "num-lines", &error_fatal);
+        object_property_set_bool(orgate, true, "realized", &error_fatal);
+        orgate_dev = DEVICE(orgate);
+        qdev_connect_gpio_out(orgate_dev, 0, qdev_get_gpio_in(armv7m, 12));
+
+        for (i = 0; i < 5; i++) {
+            /* system irq numbers for the combined tx/rx for each UART */
+            static const int uart_txrx_irqno[] = {0, 2, 45, 46, 56};
+            static const hwaddr uartbase[] = {0x40004000, 0x40005000,
+                                              0x4002c000, 0x4002d000,
+                                              0x4002e000};
+            Chardev *uartchr = i < MAX_SERIAL_PORTS ? serial_hds[i] : NULL;
+            Object *txrx_orgate;
+            DeviceState *txrx_orgate_dev;
+
+            txrx_orgate = object_new(TYPE_OR_IRQ);
+            object_property_set_int(txrx_orgate, 2, "num-lines", &error_fatal);
+            object_property_set_bool(txrx_orgate, true, "realized",
+                                     &error_fatal);
+            txrx_orgate_dev = DEVICE(txrx_orgate);
+            qdev_connect_gpio_out(txrx_orgate_dev, 0,
+                                  qdev_get_gpio_in(armv7m, uart_txrx_irqno[i]));
+            cmsdk_apb_uart_create(uartbase[i],
+                                  qdev_get_gpio_in(txrx_orgate_dev, 0),
+                                  qdev_get_gpio_in(txrx_orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, 0),
+                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  NULL,
+                                  uartchr, SYSCLK_FRQ);
+        }
+        break;
+    }
+    default:
+        g_assert_not_reached();
+    }
+
     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cmsdk-apb-uart.c
+++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_uart_realize(DeviceState *dev, Error **errp)
      * an event handler to deal with CHR_EVENT_BREAK.
      */
     qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
-                             NULL, s, NULL, true);
+                             NULL, NULL, s, NULL, true);
 }
 
 static int cmsdk_apb_uart_post_load(void *opaque, int version_id)
-- 
2.7.4

Implement a model of the simple timer device found in the CMSDK.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1500029487-14822-5-git-send-email-peter.maydell@linaro.org
---
 hw/timer/Makefile.objs             |   1 +
 include/hw/timer/cmsdk-apb-timer.h |  59 +++++++++
 hw/timer/cmsdk-apb-timer.c         | 253 +++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak    |   1 +
 hw/timer/trace-events              |   5 +
 5 files changed, 319 insertions(+)
 create mode 100644 include/hw/timer/cmsdk-apb-timer.h
 create mode 100644 hw/timer/cmsdk-apb-timer.c

diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_STM32F2XX_TIMER) += stm32f2xx_timer.o
 common-obj-$(CONFIG_ASPEED_SOC) += aspeed_timer.o
 
 common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
+common-obj-$(CONFIG_CMSDK_APB_TIMER) += cmsdk-apb-timer.o
diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB timer emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+#ifndef CMSDK_APB_TIMER_H
+#define CMSDK_APB_TIMER_H
+
+#include "hw/sysbus.h"
+#include "hw/ptimer.h"
+
+#define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
+#define CMSDK_APB_TIMER(obj) OBJECT_CHECK(CMSDKAPBTIMER, (obj), \
+                                         TYPE_CMSDK_APB_TIMER)
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    qemu_irq timerint;
+    uint32_t pclk_frq;
+    struct ptimer_state *timer;
+
+    uint32_t ctrl;
+    uint32_t value;
+    uint32_t reload;
+    uint32_t intstatus;
+} CMSDKAPBTIMER;
+
+/**
+ * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
+ * @addr: location in system memory to map registers
+ * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
+ */
+static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
+                                                 qemu_irq timerint,
+                                                 uint32_t pclk_frq)
+{
+    DeviceState *dev;
+    SysBusDevice *s;
+
+    dev = qdev_create(NULL, TYPE_CMSDK_APB_TIMER);
+    s = SYS_BUS_DEVICE(dev);
+    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
+    qdev_init_nofail(dev);
+    sysbus_mmio_map(s, 0, addr);
+    sysbus_connect_irq(s, 0, timerint);
+    return dev;
+}
+
+#endif
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB timer emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/* This is a model of the "APB timer" which is part of the Cortex-M
+ * System Design Kit (CMSDK) and documented in the Cortex-M System
+ * Design Kit Technical Reference Manual (ARM DDI0479C):
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
+ *
+ * The hardware has an EXTIN input wire, which can be configured
+ * by the guest to act either as a 'timer enable' (timer does not run
+ * when EXTIN is low), or as a 'timer clock' (timer runs at frequency
+ * of EXTIN clock, not PCLK frequency). We don't model this.
+ *
+ * The documentation is not very clear about the exact behaviour;
+ * we choose to implement that the interrupt is triggered when
+ * the counter goes from 1 to 0, that the counter then holds at 0
+ * for one clock cycle before reloading from the RELOAD register,
+ * and that if the RELOAD register is 0 this does not cause an
+ * interrupt (as there is no further 1->0 transition).
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/main-loop.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/timer/cmsdk-apb-timer.h"
+
+REG32(CTRL, 0)
+    FIELD(CTRL, EN, 0, 1)
+    FIELD(CTRL, SELEXTEN, 1, 1)
+    FIELD(CTRL, SELEXTCLK, 2, 1)
+    FIELD(CTRL, IRQEN, 3, 1)
+REG32(VALUE, 4)
+REG32(RELOAD, 8)
+REG32(INTSTATUS, 0xc)
+    FIELD(INTSTATUS, IRQ, 0, 1)
+REG32(PID4, 0xFD0)
+REG32(PID5, 0xFD4)
+REG32(PID6, 0xFD8)
+REG32(PID7, 0xFDC)
+REG32(PID0, 0xFE0)
+REG32(PID1, 0xFE4)
+REG32(PID2, 0xFE8)
+REG32(PID3, 0xFEC)
+REG32(CID0, 0xFF0)
+REG32(CID1, 0xFF4)
+REG32(CID2, 0xFF8)
+REG32(CID3, 0xFFC)
+
+/* PID/CID values */
+static const int timer_id[] = {
+    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+    0x22, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
+    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
+static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
+{
+    qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
+}
+
+static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
+{
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    uint64_t r;
+
+    switch (offset) {
+    case A_CTRL:
+        r = s->ctrl;
+        break;
+    case A_VALUE:
+        r = ptimer_get_count(s->timer);
+        break;
+    case A_RELOAD:
+        r = ptimer_get_limit(s->timer);
+        break;
+    case A_INTSTATUS:
+        r = s->intstatus;
+        break;
+    case A_PID4 ... A_CID3:
+        r = timer_id[(offset - A_PID4) / 4];
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB timer read: bad offset %x\n", (int) offset);
+        r = 0;
+        break;
+    }
+    trace_cmsdk_apb_timer_read(offset, r, size);
+    return r;
+}
+
+static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
+                                  unsigned size)
+{
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+
+    trace_cmsdk_apb_timer_write(offset, value, size);
+
+    switch (offset) {
+    case A_CTRL:
+        if (value & 6) {
+            /* Bits [1] and [2] enable using EXTIN as either clock or
+             * an enable line. We don't model this.
+             */
+            qemu_log_mask(LOG_UNIMP,
+                          "CMSDK APB timer: EXTIN input not supported\n");
+        }
+        s->ctrl = value & 0xf;
+        if (s->ctrl & R_CTRL_EN_MASK) {
+            ptimer_run(s->timer, 0);
+        } else {
+            ptimer_stop(s->timer);
+        }
+        break;
+    case A_RELOAD:
+        /* Writing to reload also sets the current timer value */
+        ptimer_set_limit(s->timer, value, 1);
+        break;
+    case A_VALUE:
+        ptimer_set_count(s->timer, value);
+        break;
+    case A_INTSTATUS:
+        /* Just one bit, which is W1C. */
+        value &= 1;
+        s->intstatus &= ~value;
+        cmsdk_apb_timer_update(s);
+        break;
+    case A_PID4 ... A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB timer write: write to RO offset 0x%x\n",
+                      (int)offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB timer write: bad offset 0x%x\n", (int) offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps cmsdk_apb_timer_ops = {
+    .read = cmsdk_apb_timer_read,
+    .write = cmsdk_apb_timer_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void cmsdk_apb_timer_tick(void *opaque)
+{
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+
+    if (s->ctrl & R_CTRL_IRQEN_MASK) {
+        s->intstatus |= R_INTSTATUS_IRQ_MASK;
+        cmsdk_apb_timer_update(s);
+    }
+}
+
+static void cmsdk_apb_timer_reset(DeviceState *dev)
+{
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+
+    trace_cmsdk_apb_timer_reset();
+    s->ctrl = 0;
+    s->intstatus = 0;
+    ptimer_stop(s->timer);
+    /* Set the limit and the count */
+    ptimer_set_limit(s->timer, 0, 1);
+}
+
+static void cmsdk_apb_timer_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
+
+    memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
+                          s, "cmsdk-apb-timer", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->timerint);
+}
+
+static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
+{
+    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+    QEMUBH *bh;
+
+    if (s->pclk_frq == 0) {
+        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+        return;
+    }
+
+    bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
+    s->timer = ptimer_init(bh,
+                           PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
+                           PTIMER_POLICY_NO_IMMEDIATE_TRIGGER |
+                           PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
+                           PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+
+    ptimer_set_freq(s->timer, s->pclk_frq);
+}
+
+static const VMStateDescription cmsdk_apb_timer_vmstate = {
+    .name = "cmsdk-apb-timer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
+        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
+        VMSTATE_UINT32(value, CMSDKAPBTIMER),
+        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
+        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property cmsdk_apb_timer_properties[] = {
+    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = cmsdk_apb_timer_realize;
+    dc->vmsd = &cmsdk_apb_timer_vmstate;
+    dc->reset = cmsdk_apb_timer_reset;
+    dc->props = cmsdk_apb_timer_properties;
+}
+
+static const TypeInfo cmsdk_apb_timer_info = {
+    .name = TYPE_CMSDK_APB_TIMER,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(CMSDKAPBTIMER),
+    .instance_init = cmsdk_apb_timer_init,
+    .class_init = cmsdk_apb_timer_class_init,
+};
+
+static void cmsdk_apb_timer_register_types(void)
+{
+    type_register_static(&cmsdk_apb_timer_info);
+}
+
+type_init(cmsdk_apb_timer_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_ADC=y
 CONFIG_STM32F2XX_SPI=y
 CONFIG_STM32F205_SOC=y
 
+CONFIG_CMSDK_APB_TIMER=y
 CONFIG_CMSDK_APB_UART=y
 
 CONFIG_VERSATILE_PCI=y
diff --git a/hw/timer/trace-events b/hw/timer/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/trace-events
+++ b/hw/timer/trace-events
@@ -XXX,XX +XXX,XX @@ systick_reload(void) "systick reload"
 systick_timer_tick(void) "systick reload"
 systick_read(uint64_t addr, uint32_t value, unsigned size) "systick read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
 systick_write(uint64_t addr, uint32_t value, unsigned size) "systick write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
+
+# hw/char/cmsdk_apb_timer.c
+cmsdk_apb_timer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_timer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_timer_reset(void) "CMSDK APB timer: reset"
-- 
2.7.4

Add the CMSDK APB timers to the MPS2 board.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1500029487-14822-6-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/misc/unimp.h"
 #include "hw/char/cmsdk-apb-uart.h"
+#include "hw/timer/cmsdk-apb-timer.h"
 
 typedef enum MPS2FPGAType {
     FPGA_AN385,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         g_assert_not_reached();
     }
 
+    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
+    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
+
     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-- 
2.7.4

Implement a model of the Serial Communication Controller (SCC) found
in MPS2 FPGA images.

The primary purpose of this device is to communicate with the
Motherboard Configuration Controller (MCC) which is located on
the MPS board itself, outside the FPGA image. This is used
for programming the MPS clock generators. The SCC also has
some basic ID registers and an output for the board LEDs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1500029487-14822-7-git-send-email-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs           |   1 +
 include/hw/misc/mps2-scc.h      |  43 ++++++
 hw/misc/mps2-scc.c              | 310 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   2 +
 hw/misc/trace-events            |   8 ++
 5 files changed, 364 insertions(+)
 create mode 100644 include/hw/misc/mps2-scc.h
 create mode 100644 hw/misc/mps2-scc.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
 obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
 obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
 obj-$(CONFIG_MIPS_ITU) += mips_itu.o
+obj-$(CONFIG_MPS2_SCC) += mps2-scc.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/mps2-scc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM MPS2 SCC emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+#ifndef MPS2_SCC_H
+#define MPS2_SCC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_MPS2_SCC "mps2-scc"
+#define MPS2_SCC(obj) OBJECT_CHECK(MPS2SCC, (obj), TYPE_MPS2_SCC)
+
+#define NUM_OSCCLK 3
+
+typedef struct {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+
+    uint32_t cfg0;
+    uint32_t cfg1;
+    uint32_t cfg4;
+    uint32_t cfgdata_rtn;
+    uint32_t cfgdata_out;
+    uint32_t cfgctrl;
+    uint32_t cfgstat;
+    uint32_t dll;
+    uint32_t aid;
+    uint32_t id;
+    uint32_t oscclk[NUM_OSCCLK];
+    uint32_t oscclk_reset[NUM_OSCCLK];
+} MPS2SCC;
+
+#endif
diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/mps2-scc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM MPS2 SCC emulation
+ *
+ * Copyright (c) 2017 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/* This is a model of the SCC (Serial Communication Controller)
+ * found in the FPGA images of MPS2 development boards.
+ *
+ * Documentation of it can be found in the MPS2 TRM:
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.100112_0100_03_en/index.html
+ * and also in the Application Notes documenting individual FPGA images.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/misc/mps2-scc.h"
+
+REG32(CFG0, 0)
+REG32(CFG1, 4)
+REG32(CFG3, 0xc)
+REG32(CFG4, 0x10)
+REG32(CFGDATA_RTN, 0xa0)
+REG32(CFGDATA_OUT, 0xa4)
+REG32(CFGCTRL, 0xa8)
+    FIELD(CFGCTRL, DEVICE, 0, 12)
+    FIELD(CFGCTRL, RES1, 12, 8)
+    FIELD(CFGCTRL, FUNCTION, 20, 6)
+    FIELD(CFGCTRL, RES2, 26, 4)
+    FIELD(CFGCTRL, WRITE, 30, 1)
+    FIELD(CFGCTRL, START, 31, 1)
+REG32(CFGSTAT, 0xac)
+    FIELD(CFGSTAT, DONE, 0, 1)
+    FIELD(CFGSTAT, ERROR, 1, 1)
+REG32(DLL, 0x100)
+REG32(AID, 0xFF8)
+REG32(ID, 0xFFC)
+
+/* Handle a write via the SYS_CFG channel to the specified function/device.
+ * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit).
+ */
+static bool scc_cfg_write(MPS2SCC *s, unsigned function,
+                          unsigned device, uint32_t value)
+{
+    trace_mps2_scc_cfg_write(function, device, value);
+
+    if (function != 1 || device >= NUM_OSCCLK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "MPS2 SCC config write: bad function %d device %d\n",
+                      function, device);
+        return false;
+    }
+
+    s->oscclk[device] = value;
+    return true;
+}
+
+/* Handle a read via the SYS_CFG channel to the specified function/device.
+ * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit),
+ * or set *value on success.
+ */
+static bool scc_cfg_read(MPS2SCC *s, unsigned function,
+                         unsigned device, uint32_t *value)
+{
+    if (function != 1 || device >= NUM_OSCCLK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "MPS2 SCC config read: bad function %d device %d\n",
+                      function, device);
+        return false;
+    }
+
+    *value = s->oscclk[device];
+
+    trace_mps2_scc_cfg_read(function, device, *value);
+    return true;
+}
+
+static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)
+{
+    MPS2SCC *s = MPS2_SCC(opaque);
+    uint64_t r;
+
+    switch (offset) {
+    case A_CFG0:
+        r = s->cfg0;
+        break;
+    case A_CFG1:
+        r = s->cfg1;
+        break;
+    case A_CFG3:
+        /* These are user-settable DIP switches on the board. We don't
+         * model that, so just return zeroes.
+         */
+        r = 0;
+        break;
+    case A_CFG4:
+        r = s->cfg4;
+        break;
+    case A_CFGDATA_RTN:
+        r = s->cfgdata_rtn;
+        break;
+    case A_CFGDATA_OUT:
+        r = s->cfgdata_out;
+        break;
+    case A_CFGCTRL:
+        r = s->cfgctrl;
+        break;
+    case A_CFGSTAT:
+        r = s->cfgstat;
+        break;
+    case A_DLL:
+        r = s->dll;
+        break;
+    case A_AID:
+        r = s->aid;
+        break;
+    case A_ID:
+        r = s->id;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "MPS2 SCC read: bad offset %x\n", (int) offset);
+        r = 0;
+        break;
+    }
+
+    trace_mps2_scc_read(offset, r, size);
+    return r;
+}
+
+static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
+                           unsigned size)
+{
+    MPS2SCC *s = MPS2_SCC(opaque);
+
+    trace_mps2_scc_write(offset, value, size);
+
+    switch (offset) {
+    case A_CFG0:
+        /* TODO on some boards bit 0 controls RAM remapping */
+        s->cfg0 = value;
+        break;
+    case A_CFG1:
+        /* CFG1 bits [7:0] control the board LEDs. We don't currently have
+         * a mechanism for displaying this graphically, so use a trace event.
+         */
+        trace_mps2_scc_leds(value & 0x80 ? '*' : '.',
+                            value & 0x40 ? '*' : '.',
+                            value & 0x20 ? '*' : '.',
+                            value & 0x10 ? '*' : '.',
+                            value & 0x08 ? '*' : '.',
+                            value & 0x04 ? '*' : '.',
+                            value & 0x02 ? '*' : '.',
+                            value & 0x01 ? '*' : '.');
+        s->cfg1 = value;
+        break;
+    case A_CFGDATA_OUT:
+        s->cfgdata_out = value;
+        break;
+    case A_CFGCTRL:
+        /* Writing to CFGCTRL clears SYS_CFGSTAT */
+        s->cfgstat = 0;
+        s->cfgctrl = value & ~(R_CFGCTRL_RES1_MASK |
+                               R_CFGCTRL_RES2_MASK |
+                               R_CFGCTRL_START_MASK);
+
+        if (value & R_CFGCTRL_START_MASK) {
+            /* Start bit set -- do a read or write (instantaneously) */
+            int device = extract32(s->cfgctrl, R_CFGCTRL_DEVICE_SHIFT,
+                                   R_CFGCTRL_DEVICE_LENGTH);
+            int function = extract32(s->cfgctrl, R_CFGCTRL_FUNCTION_SHIFT,
+                                     R_CFGCTRL_FUNCTION_LENGTH);
+
+            s->cfgstat = R_CFGSTAT_DONE_MASK;
+            if (s->cfgctrl & R_CFGCTRL_WRITE_MASK) {
+                if (!scc_cfg_write(s, function, device, s->cfgdata_out)) {
+                    s->cfgstat |= R_CFGSTAT_ERROR_MASK;
+                }
+            } else {
+                uint32_t result;
+                if (!scc_cfg_read(s, function, device, &result)) {
+                    s->cfgstat |= R_CFGSTAT_ERROR_MASK;
+                } else {
+                    s->cfgdata_rtn = result;
+                }
+            }
+        }
+        break;
+    case A_DLL:
+        /* DLL stands for Digital Locked Loop.
+         * Bits [31:24] (DLL_LOCK_MASK) are writable, and indicate a
+         * mask of which of the DLL_LOCKED bits [16:23] should be ORed
+         * together to determine the ALL_UNMASKED_DLLS_LOCKED bit [0].
+         * For QEMU, our DLLs are always locked, so we can leave bit 0
+         * as 1 always and don't need to recalculate it.
+         */
+        s->dll = deposit32(s->dll, 24, 8, extract32(value, 24, 8));
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "MPS2 SCC write: bad offset 0x%x\n", (int) offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps mps2_scc_ops = {
+    .read = mps2_scc_read,
+    .write = mps2_scc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void mps2_scc_reset(DeviceState *dev)
+{
+    MPS2SCC *s = MPS2_SCC(dev);
+    int i;
+
+    trace_mps2_scc_reset();
+    s->cfg0 = 0;
+    s->cfg1 = 0;
+    s->cfgdata_rtn = 0;
+    s->cfgdata_out = 0;
+    s->cfgctrl = 0x100000;
+    s->cfgstat = 0;
+    s->dll = 0xffff0001;
+    for (i = 0; i < NUM_OSCCLK; i++) {
+        s->oscclk[i] = s->oscclk_reset[i];
+    }
+}
+
+static void mps2_scc_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    MPS2SCC *s = MPS2_SCC(obj);
+
+    memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static void mps2_scc_realize(DeviceState *dev, Error **errp)
+{
+}
+
+static const VMStateDescription mps2_scc_vmstate = {
+    .name = "mps2-scc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(cfg0, MPS2SCC),
+        VMSTATE_UINT32(cfg1, MPS2SCC),
+        VMSTATE_UINT32(cfgdata_rtn, MPS2SCC),
+        VMSTATE_UINT32(cfgdata_out, MPS2SCC),
+        VMSTATE_UINT32(cfgctrl, MPS2SCC),
+        VMSTATE_UINT32(cfgstat, MPS2SCC),
+        VMSTATE_UINT32(dll, MPS2SCC),
+        VMSTATE_UINT32_ARRAY(oscclk, MPS2SCC, NUM_OSCCLK),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property mps2_scc_properties[] = {
+    /* Values for various read-only ID registers (which are specific
+     * to the board model or FPGA image)
+     */
+    DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, aid, 0),
+    DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
+    DEFINE_PROP_UINT32("scc-id", MPS2SCC, aid, 0),
+    /* These are the initial settings for the source clocks on the board.
+     * In hardware they can be configured via a config file read by the
+     * motherboard configuration controller to suit the FPGA image.
+     * These default values are used by most of the standard FPGA images.
+     */
+    DEFINE_PROP_UINT32("oscclk0", MPS2SCC, oscclk_reset[0], 50000000),
+    DEFINE_PROP_UINT32("oscclk1", MPS2SCC, oscclk_reset[1], 24576000),
+    DEFINE_PROP_UINT32("oscclk2", MPS2SCC, oscclk_reset[2], 25000000),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void mps2_scc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = mps2_scc_realize;
+    dc->vmsd = &mps2_scc_vmstate;
+    dc->reset = mps2_scc_reset;
+    dc->props = mps2_scc_properties;
+}
+
+static const TypeInfo mps2_scc_info = {
+    .name = TYPE_MPS2_SCC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(MPS2SCC),
+    .instance_init = mps2_scc_init,
+    .class_init = mps2_scc_class_init,
+};
+
+static void mps2_scc_register_types(void)
+{
+    type_register_static(&mps2_scc_info);
+}
+
+type_init(mps2_scc_register_types);
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F205_SOC=y
 CONFIG_CMSDK_APB_TIMER=y
 CONFIG_CMSDK_APB_UART=y
 
+CONFIG_MPS2_SCC=y
+
 CONFIG_VERSATILE_PCI=y
 CONFIG_VERSATILE_I2C=y
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ milkymist_pfpu_pulse_irq(void) "Pulse IRQ"
 
 # hw/misc/aspeed_scu.c
 aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
+
+# hw/misc/mps2_scc.c
+mps2_scc_read(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+mps2_scc_write(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+mps2_scc_reset(void) "MPS2 SCC: reset"
+mps2_scc_leds(char led7, char led6, char led5, char led4, char led3, char led2, char led1, char led0) "MPS2 SCC LEDs: %c%c%c%c%c%c%c%c"
+mps2_scc_cfg_write(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config write: function %d device %d data 0x%" PRIx32
+mps2_scc_cfg_read(unsigned function, unsigned device, uint32_t value) "MPS2 SCC config read: function %d device %d data 0x%" PRIx32
-- 
2.7.4

Add the SCC to the MPS2 board models.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1500029487-14822-8-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/timer/cmsdk-apb-timer.h"
+#include "hw/misc/mps2-scc.h"
 
 typedef enum MPS2FPGAType {
     FPGA_AN385,
@@ -XXX,XX +XXX,XX @@ typedef struct {
     MachineClass parent;
     MPS2FPGAType fpga_type;
     const char *cpu_model;
+    uint32_t scc_id;
 } MPS2MachineClass;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ typedef struct {
     MemoryRegion blockram_m2;
     MemoryRegion blockram_m3;
     MemoryRegion sram;
+    MPS2SCC scc;
 } MPS2MachineState;
 
 #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     MPS2MachineState *mms = MPS2_MACHINE(machine);
     MPS2MachineClass *mmc = MPS2_MACHINE_GET_CLASS(machine);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *sccdev;
 
     if (!machine->cpu_model) {
         machine->cpu_model = mmc->cpu_model;
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
     cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
 
+    object_initialize(&mms->scc, sizeof(mms->scc), TYPE_MPS2_SCC);
+    sccdev = DEVICE(&mms->scc);
+    qdev_set_parent_bus(armv7m, sysbus_get_default());
+    qdev_prop_set_uint32(sccdev, "scc-cfg4", 0x2);
+    qdev_prop_set_uint32(sccdev, "scc-aid", 0x02000008);
+    qdev_prop_set_uint32(sccdev, "scc-id", mmc->scc_id);
+    object_property_set_bool(OBJECT(&mms->scc), true, "realized",
+                             &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(sccdev), 0, 0x4002f000);
+
     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
@@ -XXX,XX +XXX,XX @@ static void mps2_an385_class_init(ObjectClass *oc, void *data)
     mc->desc = "ARM MPS2 with AN385 FPGA image for Cortex-M3";
     mmc->fpga_type = FPGA_AN385;
     mmc->cpu_model = "cortex-m3";
+    mmc->scc_id = 0x41040000 | (385 << 4);
 }
 
 static void mps2_an511_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void mps2_an511_class_init(ObjectClass *oc, void *data)
     mc->desc = "ARM MPS2 with AN511 DesignStart FPGA image for Cortex-M3";
     mmc->fpga_type = FPGA_AN511;
     mmc->cpu_model = "cortex-m3";
+    mmc->scc_id = 0x4104000 | (511 << 4);
 }
 
 static const TypeInfo mps2_info = {
-- 
2.7.4

The MPS2 FPGA images support ethernet via a LAN9220. We use
QEMU's LAN9118 model, which is software compatible except
that it is missing the checksum-offload feature.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1500029487-14822-9-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/mps2.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/timer/cmsdk-apb-timer.h"
 #include "hw/misc/mps2-scc.h"
+#include "hw/devices.h"
+#include "net/net.h"
 
 typedef enum MPS2FPGAType {
     FPGA_AN385,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     create_unimplemented_device("Extra peripheral region @0x40020000",
                                 0x40020000, 0x00010000);
     create_unimplemented_device("RESERVED 4", 0x40030000, 0x001D0000);
-    create_unimplemented_device("Ethernet", 0x40200000, 0x00100000);
     create_unimplemented_device("VGA", 0x41000000, 0x0200000);
 
     switch (mmc->fpga_type) {
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                              &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(sccdev), 0, 0x4002f000);
 
+    /* In hardware this is a LAN9220; the LAN9118 is software compatible
+     * except that it doesn't support the checksum-offload feature.
+     */
+    lan9118_init(&nd_table[0], 0x40200000,
+                 qdev_get_gpio_in(armv7m,
+                                  mmc->fpga_type == FPGA_AN385 ? 13 : 47));
+
     system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 
     armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-- 
2.7.4

Add entries to the MAINTAINERS file for the new MPS2
board and devices.

Since the CMSDK devices are not specific to the MPS2 board,
extend the existing 'PrimeCell' section to cover CMSDK
devices as well; in both cases these are devices implemented
by ARM and provided as RTL that may be used in multiple
SoCs and boards.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1500029487-14822-10-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 MAINTAINERS | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
 
-ARM PrimeCell
+ARM PrimeCell and CMSDK devices
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
@@ -XXX,XX +XXX,XX @@ F: hw/intc/pl190.c
 F: hw/sd/pl181.c
 F: hw/timer/pl031.c
 F: include/hw/arm/primecell.h
+F: hw/timer/cmsdk-apb-timer.c
+F: include/hw/timer/cmsdk-apb-timer.h
+F: hw/char/cmsdk-apb-uart.c
+F: include/hw/char/cmsdk-apb-uart.h
 
 ARM cores
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 
+MPS2
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/mps2.c
+F: hw/misc/mps2-scc.c
+F: include/hw/misc/mps2-scc.h
+
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
 L: qemu-arm@nongnu.org
-- 
2.7.4

target-arm queue. This has the "plumb txattrs through various
bits of exec.c" patches, and a collection of bug fixes from
various people.

thanks
-- PMM

The following changes since commit a3ac12fba028df90f7b3dbec924995c126c41022:

Merge remote-tracking branch 'remotes/ehabkost/tags/numa-next-pull-request' into staging (2018-05-31 11:12:36 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180531

for you to fetch changes up to 49d1dca0520ea71bc21867fab6647f474fcf857b:

KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice (2018-05-31 14:52:53 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Honour FPCR.FZ in FRECPX
 * MAINTAINERS: Add entries for newer MPS2 boards and devices
 * hw/intc/arm_gicv3: Fix APxR<n> register dispatching
 * arm_gicv3_kvm: fix bug in writing zero bits back to the in-kernel
   GIC state
 * tcg: Fix helper function vs host abi for float16
 * arm: fix qemu crash on startup with -bios option
 * arm: fix malloc type mismatch
 * xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors
 * Correct CPACR reset value for v7 cores
 * memory.h: Improve IOMMU related documentation
 * exec: Plumb transaction attributes through various functions in
   preparation for allowing IOMMUs to see them
 * vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY
 * ARM: ACPI: Fix use-after-free due to memory realloc
 * KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

----------------------------------------------------------------
Francisco Iglesias (1):
      xlnx-zdma: Correct mem leaks and memset to zero on desc unaligned errors

Igor Mammedov (1):
      arm: fix qemu crash on startup with -bios option

Jan Kiszka (1):
      hw/intc/arm_gicv3: Fix APxR<n> register dispatching

Paolo Bonzini (1):
      arm: fix malloc type mismatch

Peter Maydell (17):
      target/arm: Honour FPCR.FZ in FRECPX
      MAINTAINERS: Add entries for newer MPS2 boards and devices
      Correct CPACR reset value for v7 cores
      memory.h: Improve IOMMU related documentation
      Make tb_invalidate_phys_addr() take a MemTxAttrs argument
      Make address_space_translate{, _cached}() take a MemTxAttrs argument
      Make address_space_map() take a MemTxAttrs argument
      Make address_space_access_valid() take a MemTxAttrs argument
      Make flatview_extend_translation() take a MemTxAttrs argument
      Make memory_region_access_valid() take a MemTxAttrs argument
      Make MemoryRegion valid.accepts callback take a MemTxAttrs argument
      Make flatview_access_valid() take a MemTxAttrs argument
      Make flatview_translate() take a MemTxAttrs argument
      Make address_space_get_iotlb_entry() take a MemTxAttrs argument
      Make flatview_do_translate() take a MemTxAttrs argument
      Make address_space_translate_iommu take a MemTxAttrs argument
      vmstate.h: Provide VMSTATE_BOOL_SUB_ARRAY

Richard Henderson (1):
      tcg: Fix helper function vs host abi for float16

Shannon Zhao (3):
      arm_gicv3_kvm: increase clroffset accordingly
      ARM: ACPI: Fix use-after-free due to memory realloc
      KVM: GIC: Fix memory leak due to calling kvm_init_irq_routing twice

The FRECPX instructions should (like most other floating point operations)
honour the FPCR.FZ bit which specifies whether input denormals should
be flushed to zero (or FZ16 for the half-precision version).
We forgot to implement this, which doesn't affect the results (since
the calculation doesn't actually care about the mantissa bits) but did
mean we were failing to set the FPSR.IDC bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521172712.19930-1-peter.maydell@linaro.org
---
 target/arm/helper-a64.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ float16 HELPER(frecpx_f16)(float16 a, void *fpstp)
         return nan;
     }
 
+    a = float16_squash_input_denormal(a, fpst);
+
     val16 = float16_val(a);
     sbit = 0x8000 & val16;
     exp = extract32(val16, 10, 5);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)
         return nan;
     }
 
+    a = float32_squash_input_denormal(a, fpst);
+
     val32 = float32_val(a);
     sbit = 0x80000000ULL & val32;
     exp = extract32(val32, 23, 8);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)
         return nan;
     }
 
+    a = float64_squash_input_denormal(a, fpst);
+
     val64 = float64_val(a);
     sbit = 0x8000000000000000ULL & val64;
     exp = extract64(float64_val(a), 52, 11);
-- 
2.17.1

Add entries to MAINTAINERS to cover the newer MPS2 boards and
the new devices they use.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180518153157.14899-1-peter.maydell@linaro.org
---
 MAINTAINERS | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
 F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
+F: hw/misc/tz-ppc.c
+F: include/hw/misc/tz-ppc.h
 
 ARM cores
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/mps2.c
-F: hw/misc/mps2-scc.c
-F: include/hw/misc/mps2-scc.h
+F: hw/arm/mps2-tz.c
+F: hw/misc/mps2-*.c
+F: include/hw/misc/mps2-*.h
+F: hw/arm/iotkit.c
+F: include/hw/arm/iotkit.h
 
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
-- 
2.17.1

From: Jan Kiszka <jan.kiszka@siemens.com>

There was a nasty flip in identifying which register group an access is
targeting. The issue caused spuriously raised priorities of the guest
when handing CPUs over in the Jailhouse hypervisor.

Cc: qemu-stable@nongnu.org
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 28b927d3-da58-bce4-cc13-bfec7f9b1cb9@siemens.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static uint64_t icv_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
+    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
     uint64_t value = cs->ich_apr[grp][regno];
 
     trace_gicv3_icv_ap_read(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
@@ -XXX,XX +XXX,XX @@ static void icv_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
+    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
 
     trace_gicv3_icv_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
 
@@ -XXX,XX +XXX,XX @@ static uint64_t icc_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
     uint64_t value;
 
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
+    int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
 
     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
         return icv_ap_read(env, ri);
@@ -XXX,XX +XXX,XX @@ static void icc_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
     GICv3CPUState *cs = icc_cs_from_env(env);
 
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1;
+    int grp = (ri->crm & 1) ? GICV3_G1 : GICV3_G0;
 
     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
         icv_ap_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static uint64_t ich_ap_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
+    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
     uint64_t value;
 
     value = cs->ich_apr[grp][regno];
@@ -XXX,XX +XXX,XX @@ static void ich_ap_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int regno = ri->opc2 & 3;
-    int grp = ri->crm & 1 ? GICV3_G0 : GICV3_G1NS;
+    int grp = (ri->crm & 1) ? GICV3_G1NS : GICV3_G0;
 
     trace_gicv3_ich_ap_write(ri->crm & 1, regno, gicv3_redist_affid(cs), value);
 
-- 
2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

It forgot to increase clroffset during the loop. So it only clear the
first 4 bytes.

Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920
Cc: qemu-stable@nongnu.org
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1527047633-12368-1-git-send-email-zhaoshenglong@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,
         if (clroffset != 0) {
             reg = 0;
             kvm_gicd_access(s, clroffset, &reg, true);
+            clroffset += 4;
         }
         reg = *gic_bmp_ptr32(bmp, irq);
         kvm_gicd_access(s, offset, &reg, true);
-- 
2.17.1

From: Richard Henderson <richard.henderson@linaro.org>

Depending on the host abi, float16, aka uint16_t, values are
passed and returned either zero-extended in the host register
or with garbage at the top of the host register.

The tcg code generator has so far been assuming garbage, as that
matches the x86 abi, but this is incorrect for other host abis.
Further, target/arm has so far been assuming zero-extended results,
so that it may store the 16-bit value into a 32-bit slot with the
high 16-bits already clear.

Rectify both problems by mapping "f16" in the helper definition
to uint32_t instead of (a typedef for) uint16_t.  This forces
the host compiler to assume garbage in the upper 16 bits on input
and to zero-extend the result on output.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20180522175629.24932-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/helper-head.h |  2 +-
 target/arm/helper-a64.c    | 35 +++++++++--------
 target/arm/helper.c        | 80 +++++++++++++++++++-------------------
 3 files changed, 59 insertions(+), 58 deletions(-)

diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -XXX,XX +XXX,XX @@
 #define dh_ctype_int int
 #define dh_ctype_i64 uint64_t
 #define dh_ctype_s64 int64_t
-#define dh_ctype_f16 float16
+#define dh_ctype_f16 uint32_t
 #define dh_ctype_f32 float32
 #define dh_ctype_f64 float64
 #define dh_ctype_ptr void *
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
-uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+uint64_t HELPER(vfp_cmph_a64)(uint32_t x, uint32_t y, void *fp_status)
 {
     return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
 }
 
-uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+uint64_t HELPER(vfp_cmpeh_a64)(uint32_t x, uint32_t y, void *fp_status)
 {
     return float_rel_to_flags(float16_compare(x, y, fp_status));
 }
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, void *fpstp)
 #define float64_three make_float64(0x4008000000000000ULL)
 #define float64_one_point_five make_float64(0x3FF8000000000000ULL)
 
-float16 HELPER(recpsf_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(recpsf_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
 
@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpsf_f64)(float64 a, float64 b, void *fpstp)
     return float64_muladd(a, b, float64_two, 0, fpst);
 }
 
-float16 HELPER(rsqrtsf_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
 
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_addlp_u16)(uint64_t a)
 }
 
 /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
-float16 HELPER(frecpx_f16)(float16 a, void *fpstp)
+uint32_t HELPER(frecpx_f16)(uint32_t a, void *fpstp)
 {
     float_status *fpst = fpstp;
     uint16_t val16, sbit;
@@ -XXX,XX +XXX,XX @@ void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
 #define ADVSIMD_HELPER(name, suffix) HELPER(glue(glue(advsimd_, name), suffix))
 
 #define ADVSIMD_HALFOP(name) \
-float16 ADVSIMD_HELPER(name, h)(float16 a, float16 b, void *fpstp) \
+uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, void *fpstp) \
 { \
     float_status *fpst = fpstp; \
     return float16_ ## name(a, b, fpst);    \
@@ -XXX,XX +XXX,XX @@ ADVSIMD_HALFOP(mulx)
 ADVSIMD_TWOHALFOP(mulx)
 
 /* fused multiply-accumulate */
-float16 HELPER(advsimd_muladdh)(float16 a, float16 b, float16 c, void *fpstp)
+uint32_t HELPER(advsimd_muladdh)(uint32_t a, uint32_t b, uint32_t c,
+                                 void *fpstp)
 {
     float_status *fpst = fpstp;
     return float16_muladd(a, b, c, 0, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_muladd2h)(uint32_t two_a, uint32_t two_b,
 
 #define ADVSIMD_CMPRES(test) (test) ? 0xffff : 0
 
-uint32_t HELPER(advsimd_ceq_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(advsimd_ceq_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
     int compare = float16_compare_quiet(a, b, fpst);
     return ADVSIMD_CMPRES(compare == float_relation_equal);
 }
 
-uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(advsimd_cge_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
     int compare = float16_compare(a, b, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_cge_f16)(float16 a, float16 b, void *fpstp)
                           compare == float_relation_equal);
 }
 
-uint32_t HELPER(advsimd_cgt_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(advsimd_cgt_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
     int compare = float16_compare(a, b, fpst);
     return ADVSIMD_CMPRES(compare == float_relation_greater);
 }
 
-uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(advsimd_acge_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
     float16 f0 = float16_abs(a);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acge_f16)(float16 a, float16 b, void *fpstp)
                           compare == float_relation_equal);
 }
 
-uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)
+uint32_t HELPER(advsimd_acgt_f16)(uint32_t a, uint32_t b, void *fpstp)
 {
     float_status *fpst = fpstp;
     float16 f0 = float16_abs(a);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_acgt_f16)(float16 a, float16 b, void *fpstp)
 }
 
 /* round to integral */
-float16 HELPER(advsimd_rinth_exact)(float16 x, void *fp_status)
+uint32_t HELPER(advsimd_rinth_exact)(uint32_t x, void *fp_status)
 {
     return float16_round_to_int(x, fp_status);
 }
 
-float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)
+uint32_t HELPER(advsimd_rinth)(uint32_t x, void *fp_status)
 {
     int old_flags = get_float_exception_flags(fp_status), new_flags;
     float16 ret;
@@ -XXX,XX +XXX,XX @@ float16 HELPER(advsimd_rinth)(float16 x, void *fp_status)
  * setting the mode appropriately before calling the helper.
  */
 
-uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)
+uint32_t HELPER(advsimd_f16tosinth)(uint32_t a, void *fpstp)
 {
     float_status *fpst = fpstp;
 
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16tosinth)(float16 a, void *fpstp)
     return float16_to_int16(a, fpst);
 }
 
-uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)
+uint32_t HELPER(advsimd_f16touinth)(uint32_t a, void *fpstp)
 {
     float_status *fpst = fpstp;
 
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(advsimd_f16touinth)(float16 a, void *fpstp)
  * Square Root and Reciprocal square root
  */
 
-float16 HELPER(sqrt_f16)(float16 a, void *fpstp)
+uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
 {
     float_status *s = fpstp;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ DO_VFP_cmp(d, float64)
 
 /* Integer to float and float to integer conversions */
 
-#define CONV_ITOF(name, fsz, sign) \
-    float##fsz HELPER(name)(uint32_t x, void *fpstp) \
-{ \
-    float_status *fpst = fpstp; \
-    return sign##int32_to_##float##fsz((sign##int32_t)x, fpst); \
+#define CONV_ITOF(name, ftype, fsz, sign)                           \
+ftype HELPER(name)(uint32_t x, void *fpstp)                         \
+{                                                                   \
+    float_status *fpst = fpstp;                                     \
+    return sign##int32_to_##float##fsz((sign##int32_t)x, fpst);     \
 }
 
-#define CONV_FTOI(name, fsz, sign, round) \
-uint32_t HELPER(name)(float##fsz x, void *fpstp) \
-{ \
-    float_status *fpst = fpstp; \
-    if (float##fsz##_is_any_nan(x)) { \
-        float_raise(float_flag_invalid, fpst); \
-        return 0; \
-    } \
-    return float##fsz##_to_##sign##int32##round(x, fpst); \
+#define CONV_FTOI(name, ftype, fsz, sign, round)                \
+uint32_t HELPER(name)(ftype x, void *fpstp)                     \
+{                                                               \
+    float_status *fpst = fpstp;                                 \
+    if (float##fsz##_is_any_nan(x)) {                           \
+        float_raise(float_flag_invalid, fpst);                  \
+        return 0;                                               \
+    }                                                           \
+    return float##fsz##_to_##sign##int32##round(x, fpst);       \
 }
 
-#define FLOAT_CONVS(name, p, fsz, sign) \
-CONV_ITOF(vfp_##name##to##p, fsz, sign) \
-CONV_FTOI(vfp_to##name##p, fsz, sign, ) \
-CONV_FTOI(vfp_to##name##z##p, fsz, sign, _round_to_zero)
+#define FLOAT_CONVS(name, p, ftype, fsz, sign)            \
+    CONV_ITOF(vfp_##name##to##p, ftype, fsz, sign)        \
+    CONV_FTOI(vfp_to##name##p, ftype, fsz, sign, )        \
+    CONV_FTOI(vfp_to##name##z##p, ftype, fsz, sign, _round_to_zero)
 
-FLOAT_CONVS(si, h, 16, )
-FLOAT_CONVS(si, s, 32, )
-FLOAT_CONVS(si, d, 64, )
-FLOAT_CONVS(ui, h, 16, u)
-FLOAT_CONVS(ui, s, 32, u)
-FLOAT_CONVS(ui, d, 64, u)
+FLOAT_CONVS(si, h, uint32_t, 16, )
+FLOAT_CONVS(si, s, float32, 32, )
+FLOAT_CONVS(si, d, float64, 64, )
+FLOAT_CONVS(ui, h, uint32_t, 16, u)
+FLOAT_CONVS(ui, s, float32, 32, u)
+FLOAT_CONVS(ui, d, float64, 64, u)
 
 #undef CONV_ITOF
 #undef CONV_FTOI
@@ -XXX,XX +XXX,XX @@ static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
     return float64_to_float16(float64_scalbn(f, -shift, fpst), true, fpst);
 }
 
-float16 HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return do_postscale_fp16(int32_to_float64(x, fpst), shift, fpst);
 }
 
-float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
-float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 {
     return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 }
 
-float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 {
     return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 }
@@ -XXX,XX +XXX,XX @@ static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
     }
 }
 
-uint32_t HELPER(vfp_toshh)(float16 x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_toshh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_int16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
-uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_touhh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
-uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_toslh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
-uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+uint32_t HELPER(vfp_toulh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
-uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+uint64_t HELPER(vfp_tosqh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
-uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+uint64_t HELPER(vfp_touqh)(uint32_t x, uint32_t shift, void *fpst)
 {
     return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 }
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(set_neon_rmode)(uint32_t rmode, CPUARMState *env)
 }
 
 /* Half precision conversions.  */
-float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)
+float32 HELPER(vfp_fcvt_f16_to_f32)(uint32_t a, void *fpstp, uint32_t ahp_mode)
 {
     /* Squash FZ16 to 0 for the duration of conversion.  In this case,
      * it would affect flushing input denormals.
@@ -XXX,XX +XXX,XX @@ float32 HELPER(vfp_fcvt_f16_to_f32)(float16 a, void *fpstp, uint32_t ahp_mode)
     return r;
 }
 
-float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
+uint32_t HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
 {
     /* Squash FZ16 to 0 for the duration of conversion.  In this case,
      * it would affect flushing output denormals.
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_fcvt_f32_to_f16)(float32 a, void *fpstp, uint32_t ahp_mode)
     return r;
 }
 
-float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)
+float64 HELPER(vfp_fcvt_f16_to_f64)(uint32_t a, void *fpstp, uint32_t ahp_mode)
 {
     /* Squash FZ16 to 0 for the duration of conversion.  In this case,
      * it would affect flushing input denormals.
@@ -XXX,XX +XXX,XX @@ float64 HELPER(vfp_fcvt_f16_to_f64)(float16 a, void *fpstp, uint32_t ahp_mode)
     return r;
 }
 
-float16 HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)
+uint32_t HELPER(vfp_fcvt_f64_to_f16)(float64 a, void *fpstp, uint32_t ahp_mode)
 {
     /* Squash FZ16 to 0 for the duration of conversion.  In this case,
      * it would affect flushing output denormals.
@@ -XXX,XX +XXX,XX @@ static bool round_to_inf(float_status *fpst, bool sign_bit)
     g_assert_not_reached();
 }
 
-float16 HELPER(recpe_f16)(float16 input, void *fpstp)
+uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)
 {
     float_status *fpst = fpstp;
     float16 f16 = float16_squash_input_denormal(input, fpst);
@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
     return extract64(estimate, 0, 8) << 44;
 }
 
-float16 HELPER(rsqrte_f16)(float16 input, void *fpstp)
+uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)
 {
     float_status *s = fpstp;
     float16 f16 = float16_squash_input_denormal(input, s);
-- 
2.17.1

From: Igor Mammedov <imammedo@redhat.com>

When QEMU is started with following CLI
 -machine virt,gic-version=3,accel=kvm -cpu host -bios AAVMF_CODE.fd
it crashes with abort at
 accel/kvm/kvm-all.c:2164:
 KVM_SET_DEVICE_ATTR failed: Group 6 attr 0x000000000000c665: Invalid argument

Which is caused by implicit dependency of kvm_arm_gicv3_reset() on
arm_gicv3_icc_reset() where the later is called by CPU reset
reset callback.

However commit:
 3b77f6c arm/boot: split load_dtb() from arm_load_kernel()
broke CPU reset callback registration in case

arm_load_kernel()
      ...
      if (!info->kernel_filename || info->firmware_loaded)

branch is taken, i.e. it's sufficient to provide a firmware
or do not provide kernel on CLI to skip cpu reset callback
registration, where before offending commit the callback
has been registered unconditionally.

Fix it by registering the callback right at the beginning of
arm_load_kernel() unconditionally instead of doing it at the end.

NOTE:
 we probably should eliminate that dependency anyways as well as
 separate arch CPU reset parts from arm_load_kernel() into CPU
 itself, but that refactoring that I probably would have to do
 anyways later for CPU hotplug to work.

Reported-by: Auger Eric <eric.auger@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1527070950-208350-1-git-send-email-imammedo@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
     static const ARMInsnFixup *primary_loader;
     AddressSpace *as = arm_boot_address_space(cpu, info);
 
+    /* CPU objects (unlike devices) are not automatically reset on system
+     * reset, so we must always register a handler to do so. If we're
+     * actually loading a kernel, the handler is also responsible for
+     * arranging that we start it correctly.
+     */
+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
+        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
+    }
+
     /* The board code is not supposed to set secure_board_setup unless
      * running its code in secure mode is actually possible, and KVM
      * doesn't support secure.
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
         ARM_CPU(cs)->env.boot_info = info;
     }
 
-    /* CPU objects (unlike devices) are not automatically reset on system
-     * reset, so we must always register a handler to do so. If we're
-     * actually loading a kernel, the handler is also responsible for
-     * arranging that we start it correctly.
-     */
-    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
-        qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
-    }
-
     if (!info->skip_dtb_autoload && have_dtb(info)) {
         if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
             exit(1);
-- 
2.17.1

From: Paolo Bonzini <pbonzini@redhat.com>

cpregs_keys is an uint32_t* so the allocation should use uint32_t.
g_new is even better because it is type-safe.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_xml(CPUState *cs)
     RegisterSysregXmlParam param = {cs, s};
 
     cpu->dyn_xml.num_cpregs = 0;
-    cpu->dyn_xml.cpregs_keys = g_malloc(sizeof(uint32_t *) *
-                                        g_hash_table_size(cpu->cp_regs));
+    cpu->dyn_xml.cpregs_keys = g_new(uint32_t, g_hash_table_size(cpu->cp_regs));
     g_string_printf(s, "<?xml version=\"1.0\"?>");
     g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
     g_string_append_printf(s, "<feature name=\"org.qemu.gdb.arm.sys.regs\">");
-- 
2.17.1

From: Francisco Iglesias <frasse.iglesias@gmail.com>

Coverity found that the string return by 'object_get_canonical_path' was not
being freed at two locations in the model (CID 1391294 and CID 1391293) and
also that a memset was being called with a value greater than the max of a byte
on the second argument (CID 1391286). This patch corrects this by adding the
freeing of the strings and also changing to memset to zero instead on
descriptor unaligned errors.

Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180528184859.3530-1-frasse.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xlnx-zdma.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -XXX,XX +XXX,XX @@ static bool zdma_load_descriptor(XlnxZDMA *s, uint64_t addr, void *buf)
         qemu_log_mask(LOG_GUEST_ERROR,
                       "zdma: unaligned descriptor at %" PRIx64,
                       addr);
-        memset(buf, 0xdeadbeef, sizeof(XlnxZDMADescr));
+        memset(buf, 0x0, sizeof(XlnxZDMADescr));
         s->error = true;
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static uint64_t zdma_read(void *opaque, hwaddr addr, unsigned size)
     RegisterInfo *r = &s->regs_info[addr / 4];
 
     if (!r->data) {
+        gchar *path = object_get_canonical_path(OBJECT(s));
         qemu_log("%s: Decode error: read from %" HWADDR_PRIx "\n",
-                 object_get_canonical_path(OBJECT(s)),
+                 path,
                  addr);
+        g_free(path);
         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);
         zdma_ch_imr_update_irq(s);
         return 0;
@@ -XXX,XX +XXX,XX @@ static void zdma_write(void *opaque, hwaddr addr, uint64_t value,
     RegisterInfo *r = &s->regs_info[addr / 4];
 
     if (!r->data) {
+        gchar *path = object_get_canonical_path(OBJECT(s));
         qemu_log("%s: Decode error: write to %" HWADDR_PRIx "=%" PRIx64 "\n",
-                 object_get_canonical_path(OBJECT(s)),
+                 path,
                  addr, value);
+        g_free(path);
         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, INV_APB, true);
         zdma_ch_imr_update_irq(s);
         return;
-- 
2.17.1

In commit f0aff255700 we made cpacr_write() enforce that some CPACR
bits are RAZ/WI and some are RAO/WI for ARMv7 cores. Unfortunately
we forgot to also update the register's reset value. The effect
was that (a) a guest that read CPACR on reset would not see ones in
the RAO bits, and (b) if you did a migration before the guest did
a write to the CPACR then the migration would fail because the
destination would enforce the RAO bits and then complain that they
didn't match the zero value from the source.

Implement reset for the CPACR using a custom reset function
that just calls cpacr_write(), to avoid having to duplicate
the logic for which bits are RAO.

This bug would affect migration for TCG CPUs which are ARMv7
with VFP but without one of Neon or VFPv3.

Reported-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180522173713.26282-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     env->cp15.cpacr_el1 = value;
 }
 
+static void cpacr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* Call cpacr_write() so that we reset with the correct RAO bits set
+     * for our CPU features.
+     */
+    cpacr_write(env, ri, 0);
+}
+
 static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
     { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
-      .resetvalue = 0, .writefn = cpacr_write },
+      .resetfn = cpacr_reset, .writefn = cpacr_write },
     REGINFO_SENTINEL
 };
 
-- 
2.17.1

Add more detail to the documentation for memory_region_init_iommu()
and other IOMMU-related functions and data structures.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20180521140402.23318-2-peter.maydell@linaro.org
---
 include/exec/memory.h | 105 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 95 insertions(+), 10 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ enum IOMMUMemoryRegionAttr {
     IOMMU_ATTR_SPAPR_TCE_FD
 };
 
+/**
+ * IOMMUMemoryRegionClass:
+ *
+ * All IOMMU implementations need to subclass TYPE_IOMMU_MEMORY_REGION
+ * and provide an implementation of at least the @translate method here
+ * to handle requests to the memory region. Other methods are optional.
+ *
+ * The IOMMU implementation must use the IOMMU notifier infrastructure
+ * to report whenever mappings are changed, by calling
+ * memory_region_notify_iommu() (or, if necessary, by calling
+ * memory_region_notify_one() for each registered notifier).
+ */
 typedef struct IOMMUMemoryRegionClass {
     /* private */
     struct DeviceClass parent_class;
 
     /*
-     * Return a TLB entry that contains a given address. Flag should
-     * be the access permission of this translation operation. We can
-     * set flag to IOMMU_NONE to mean that we don't need any
-     * read/write permission checks, like, when for region replay.
+     * Return a TLB entry that contains a given address.
+     *
+     * The IOMMUAccessFlags indicated via @flag are optional and may
+     * be specified as IOMMU_NONE to indicate that the caller needs
+     * the full translation information for both reads and writes. If
+     * the access flags are specified then the IOMMU implementation
+     * may use this as an optimization, to stop doing a page table
+     * walk as soon as it knows that the requested permissions are not
+     * allowed. If IOMMU_NONE is passed then the IOMMU must do the
+     * full page table walk and report the permissions in the returned
+     * IOMMUTLBEntry. (Note that this implies that an IOMMU may not
+     * return different mappings for reads and writes.)
+     *
+     * The returned information remains valid while the caller is
+     * holding the big QEMU lock or is inside an RCU critical section;
+     * if the caller wishes to cache the mapping beyond that it must
+     * register an IOMMU notifier so it can invalidate its cached
+     * information when the IOMMU mapping changes.
+     *
+     * @iommu: the IOMMUMemoryRegion
+     * @hwaddr: address to be translated within the memory region
+     * @flag: requested access permissions
      */
     IOMMUTLBEntry (*translate)(IOMMUMemoryRegion *iommu, hwaddr addr,
                                IOMMUAccessFlags flag);
-    /* Returns minimum supported page size */
+    /* Returns minimum supported page size in bytes.
+     * If this method is not provided then the minimum is assumed to
+     * be TARGET_PAGE_SIZE.
+     *
+     * @iommu: the IOMMUMemoryRegion
+     */
     uint64_t (*get_min_page_size)(IOMMUMemoryRegion *iommu);
-    /* Called when IOMMU Notifier flag changed */
+    /* Called when IOMMU Notifier flag changes (ie when the set of
+     * events which IOMMU users are requesting notification for changes).
+     * Optional method -- need not be provided if the IOMMU does not
+     * need to know exactly which events must be notified.
+     *
+     * @iommu: the IOMMUMemoryRegion
+     * @old_flags: events which previously needed to be notified
+     * @new_flags: events which now need to be notified
+     */
     void (*notify_flag_changed)(IOMMUMemoryRegion *iommu,
                                 IOMMUNotifierFlag old_flags,
                                 IOMMUNotifierFlag new_flags);
-    /* Set this up to provide customized IOMMU replay function */
+    /* Called to handle memory_region_iommu_replay().
+     *
+     * The default implementation of memory_region_iommu_replay() is to
+     * call the IOMMU translate method for every page in the address space
+     * with flag == IOMMU_NONE and then call the notifier if translate
+     * returns a valid mapping. If this method is implemented then it
+     * overrides the default behaviour, and must provide the full semantics
+     * of memory_region_iommu_replay(), by calling @notifier for every
+     * translation present in the IOMMU.
+     *
+     * Optional method -- an IOMMU only needs to provide this method
+     * if the default is inefficient or produces undesirable side effects.
+     *
+     * Note: this is not related to record-and-replay functionality.
+     */
     void (*replay)(IOMMUMemoryRegion *iommu, IOMMUNotifier *notifier);
 
-    /* Get IOMMU misc attributes */
-    int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr,
+    /* Get IOMMU misc attributes. This is an optional method that
+     * can be used to allow users of the IOMMU to get implementation-specific
+     * information. The IOMMU implements this method to handle calls
+     * by IOMMU users to memory_region_iommu_get_attr() by filling in
+     * the arbitrary data pointer for any IOMMUMemoryRegionAttr values that
+     * the IOMMU supports. If the method is unimplemented then
+     * memory_region_iommu_get_attr() will always return -EINVAL.
+     *
+     * @iommu: the IOMMUMemoryRegion
+     * @attr: attribute being queried
+     * @data: memory to fill in with the attribute data
+     *
+     * Returns 0 on success, or a negative errno; in particular
+     * returns -EINVAL for unrecognized or unimplemented attribute types.
+     */
+    int (*get_attr)(IOMMUMemoryRegion *iommu, enum IOMMUMemoryRegionAttr attr,
                     void *data);
 } IOMMUMemoryRegionClass;
 
@@ -XXX,XX +XXX,XX @@ static inline void memory_region_init_reservation(MemoryRegion *mr,
  * An IOMMU region translates addresses and forwards accesses to a target
  * memory region.
  *
+ * The IOMMU implementation must define a subclass of TYPE_IOMMU_MEMORY_REGION.
+ * @_iommu_mr should be a pointer to enough memory for an instance of
+ * that subclass, @instance_size is the size of that subclass, and
+ * @mrtypename is its name. This function will initialize @_iommu_mr as an
+ * instance of the subclass, and its methods will then be called to handle
+ * accesses to the memory region. See the documentation of
+ * #IOMMUMemoryRegionClass for further details.
+ *
  * @_iommu_mr: the #IOMMUMemoryRegion to be initialized
  * @instance_size: the IOMMUMemoryRegion subclass instance size
  * @mrtypename: the type name of the #IOMMUMemoryRegion
@@ -XXX,XX +XXX,XX @@ void memory_region_register_iommu_notifier(MemoryRegion *mr,
  * a notifier with the minimum page granularity returned by
  * mr->iommu_ops->get_page_size().
  *
+ * Note: this is not related to record-and-replay functionality.
+ *
  * @iommu_mr: the memory region to observe
  * @n: the notifier to which to replay iommu mappings
  */
@@ -XXX,XX +XXX,XX @@ void memory_region_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n);
  * memory_region_iommu_replay_all: replay existing IOMMU translations
  * to all the notifiers registered.
  *
+ * Note: this is not related to record-and-replay functionality.
+ *
  * @iommu_mr: the memory region to observe
  */
 void memory_region_iommu_replay_all(IOMMUMemoryRegion *iommu_mr);
@@ -XXX,XX +XXX,XX @@ void memory_region_unregister_iommu_notifier(MemoryRegion *mr,
  * memory_region_iommu_get_attr: return an IOMMU attr if get_attr() is
  * defined on the IOMMU.
  *
- * Returns 0 if succeded, error code otherwise.
+ * Returns 0 on success, or a negative errno otherwise. In particular,
+ * -EINVAL indicates that the IOMMU does not support the requested
+ * attribute.
  *
  * @iommu_mr: the memory region
  * @attr: the requested attribute
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to tb_invalidate_phys_addr().
Its callers either have an attrs value to hand, or don't care
and can use MEMTXATTRS_UNSPECIFIED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180521140402.23318-3-peter.maydell@linaro.org
---
 include/exec/exec-all.h   | 5 +++--
 accel/tcg/translate-all.c | 2 +-
 exec.c                    | 2 +-
 target/xtensa/op_helper.c | 3 ++-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
 void tlb_set_page(CPUState *cpu, target_ulong vaddr,
                   hwaddr paddr, int prot,
                   int mmu_idx, target_ulong size);
-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr);
+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 void probe_write(CPUArchState *env, target_ulong addr, int size, int mmu_idx,
                  uintptr_t retaddr);
 #else
@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                        uint16_t idxmap)
 {
 }
-static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)
+static inline void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr,
+                                           MemTxAttrs attrs)
 {
 }
 #endif
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
 }
 
 #if !defined(CONFIG_USER_ONLY)
-void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr)
+void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
 {
     ram_addr_t ram_addr;
     MemoryRegion *mr;
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
     if (phys != -1) {
         /* Locks grabbed by tb_invalidate_phys_addr */
         tb_invalidate_phys_addr(cpu->cpu_ases[asidx].as,
-                                phys | (pc & ~TARGET_PAGE_MASK));
+                                phys | (pc & ~TARGET_PAGE_MASK), attrs);
     }
 }
 #endif
diff --git a/target/xtensa/op_helper.c b/target/xtensa/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/op_helper.c
+++ b/target/xtensa/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void tb_invalidate_virtual_addr(CPUXtensaState *env, uint32_t vaddr)
     int ret = xtensa_get_physical_addr(env, false, vaddr, 2, 0,
             &paddr, &page_size, &access);
     if (ret == 0) {
-        tb_invalidate_phys_addr(&address_space_memory, paddr);
+        tb_invalidate_phys_addr(&address_space_memory, paddr,
+                                MEMTXATTRS_UNSPECIFIED);
     }
 }
 
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to address_space_translate()
and address_space_translate_cached(). Callers either have an
attrs value to hand, or don't care and can use MEMTXATTRS_UNSPECIFIED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521140402.23318-4-peter.maydell@linaro.org
---
 include/exec/memory.h     |  4 +++-
 accel/tcg/translate-all.c |  2 +-
 exec.c                    | 14 +++++++++-----
 hw/vfio/common.c          |  3 ++-
 memory_ldst.inc.c         | 18 +++++++++---------
 target/riscv/helper.c     |  2 +-
 6 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
  * #MemoryRegion.
  * @len: pointer to length
  * @is_write: indicates the transfer direction
+ * @attrs: memory attributes
  */
 MemoryRegion *flatview_translate(FlatView *fv,
                                  hwaddr addr, hwaddr *xlat,
@@ -XXX,XX +XXX,XX @@ MemoryRegion *flatview_translate(FlatView *fv,
 
 static inline MemoryRegion *address_space_translate(AddressSpace *as,
                                                     hwaddr addr, hwaddr *xlat,
-                                                    hwaddr *len, bool is_write)
+                                                    hwaddr *len, bool is_write,
+                                                    MemTxAttrs attrs)
 {
     return flatview_translate(address_space_to_flatview(as),
                               addr, xlat, len, is_write);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs)
     hwaddr l = 1;
 
     rcu_read_lock();
-    mr = address_space_translate(as, addr, &addr, &l, false);
+    mr = address_space_translate(as, addr, &addr, &l, false, attrs);
     if (!(memory_region_is_ram(mr)
           || memory_region_is_romd(mr))) {
         rcu_read_unlock();
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static inline void cpu_physical_memory_write_rom_internal(AddressSpace *as,
     rcu_read_lock();
     while (len > 0) {
         l = len;
-        mr = address_space_translate(as, addr, &addr1, &l, true);
+        mr = address_space_translate(as, addr, &addr1, &l, true,
+                                     MEMTXATTRS_UNSPECIFIED);
 
         if (!(memory_region_is_ram(mr) ||
               memory_region_is_romd(mr))) {
@@ -XXX,XX +XXX,XX @@ void address_space_cache_destroy(MemoryRegionCache *cache)
  */
 static inline MemoryRegion *address_space_translate_cached(
     MemoryRegionCache *cache, hwaddr addr, hwaddr *xlat,
-    hwaddr *plen, bool is_write)
+    hwaddr *plen, bool is_write, MemTxAttrs attrs)
 {
     MemoryRegionSection section;
     MemoryRegion *mr;
@@ -XXX,XX +XXX,XX @@ address_space_read_cached_slow(MemoryRegionCache *cache, hwaddr addr,
     MemoryRegion *mr;
 
     l = len;
-    mr = address_space_translate_cached(cache, addr, &addr1, &l, false);
+    mr = address_space_translate_cached(cache, addr, &addr1, &l, false,
+                                        MEMTXATTRS_UNSPECIFIED);
     flatview_read_continue(cache->fv,
                            addr, MEMTXATTRS_UNSPECIFIED, buf, len,
                            addr1, l, mr);
@@ -XXX,XX +XXX,XX @@ address_space_write_cached_slow(MemoryRegionCache *cache, hwaddr addr,
     MemoryRegion *mr;
 
     l = len;
-    mr = address_space_translate_cached(cache, addr, &addr1, &l, true);
+    mr = address_space_translate_cached(cache, addr, &addr1, &l, true,
+                                        MEMTXATTRS_UNSPECIFIED);
     flatview_write_continue(cache->fv,
                             addr, MEMTXATTRS_UNSPECIFIED, buf, len,
                             addr1, l, mr);
@@ -XXX,XX +XXX,XX @@ bool cpu_physical_memory_is_io(hwaddr phys_addr)
 
     rcu_read_lock();
     mr = address_space_translate(&address_space_memory,
-                                 phys_addr, &phys_addr, &l, false);
+                                 phys_addr, &phys_addr, &l, false,
+                                 MEMTXATTRS_UNSPECIFIED);
 
     res = !(memory_region_is_ram(mr) || memory_region_is_romd(mr));
     rcu_read_unlock();
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ static bool vfio_get_vaddr(IOMMUTLBEntry *iotlb, void **vaddr,
      */
     mr = address_space_translate(&address_space_memory,
                                  iotlb->translated_addr,
-                                 &xlat, &len, writable);
+                                 &xlat, &len, writable,
+                                 MEMTXATTRS_UNSPECIFIED);
     if (!memory_region_is_ram(mr)) {
         error_report("iommu map to non memory area %"HWADDR_PRIx"",
                      xlat);
diff --git a/memory_ldst.inc.c b/memory_ldst.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/memory_ldst.inc.c
+++ b/memory_ldst.inc.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, false);
+    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
     if (l < 4 || !IS_DIRECT(mr, false)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, false);
+    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
     if (l < 8 || !IS_DIRECT(mr, false)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, false);
+    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
     if (!IS_DIRECT(mr, false)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, false);
+    mr = TRANSLATE(addr, &addr1, &l, false, attrs);
     if (l < 2 || !IS_DIRECT(mr, false)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, true);
+    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 4 || !IS_DIRECT(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stl_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, true);
+    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 4 || !IS_DIRECT(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ void glue(address_space_stb, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, true);
+    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (!IS_DIRECT(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
         r = memory_region_dispatch_write(mr, addr1, val, 1, attrs);
@@ -XXX,XX +XXX,XX @@ static inline void glue(address_space_stw_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, true);
+    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 2 || !IS_DIRECT(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
@@ -XXX,XX +XXX,XX @@ static void glue(address_space_stq_internal, SUFFIX)(ARG1_DECL,
     bool release_lock = false;
 
     RCU_READ_LOCK();
-    mr = TRANSLATE(addr, &addr1, &l, true);
+    mr = TRANSLATE(addr, &addr1, &l, true, attrs);
     if (l < 8 || !IS_DIRECT(mr, true)) {
         release_lock |= prepare_mmio_access(mr);
 
diff --git a/target/riscv/helper.c b/target/riscv/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.c
+++ b/target/riscv/helper.c
@@ -XXX,XX +XXX,XX @@ restart:
                 MemoryRegion *mr;
                 hwaddr l = sizeof(target_ulong), addr1;
                 mr = address_space_translate(cs->as, pte_addr,
-                    &addr1, &l, false);
+                    &addr1, &l, false, MEMTXATTRS_UNSPECIFIED);
                 if (memory_access_is_direct(mr, true)) {
                     target_ulong *pte_pa =
                         qemu_map_ram_ptr(mr->ram_block, addr1);
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to address_space_map().
Its callers either have an attrs value to hand, or don't care
and can use MEMTXATTRS_UNSPECIFIED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521140402.23318-5-peter.maydell@linaro.org
---
 include/exec/memory.h   | 3 ++-
 include/sysemu/dma.h    | 3 ++-
 exec.c                  | 6 ++++--
 target/ppc/mmu-hash64.c | 3 ++-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_
  * @addr: address within that address space
  * @plen: pointer to length of buffer; updated on return
  * @is_write: indicates the transfer direction
+ * @attrs: memory attributes
  */
 void *address_space_map(AddressSpace *as, hwaddr addr,
-                        hwaddr *plen, bool is_write);
+                        hwaddr *plen, bool is_write, MemTxAttrs attrs);
 
 /* address_space_unmap: Unmaps a memory region previously mapped by address_space_map()
  *
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -XXX,XX +XXX,XX @@ static inline void *dma_memory_map(AddressSpace *as,
     hwaddr xlen = *len;
     void *p;
 
-    p = address_space_map(as, addr, &xlen, dir == DMA_DIRECTION_FROM_DEVICE);
+    p = address_space_map(as, addr, &xlen, dir == DMA_DIRECTION_FROM_DEVICE,
+                          MEMTXATTRS_UNSPECIFIED);
     *len = xlen;
     return p;
 }
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ flatview_extend_translation(FlatView *fv, hwaddr addr,
 void *address_space_map(AddressSpace *as,
                         hwaddr addr,
                         hwaddr *plen,
-                        bool is_write)
+                        bool is_write,
+                        MemTxAttrs attrs)
 {
     hwaddr len = *plen;
     hwaddr l, xlat;
@@ -XXX,XX +XXX,XX @@ void *cpu_physical_memory_map(hwaddr addr,
                               hwaddr *plen,
                               int is_write)
 {
-    return address_space_map(&address_space_memory, addr, plen, is_write);
+    return address_space_map(&address_space_memory, addr, plen, is_write,
+                             MEMTXATTRS_UNSPECIFIED);
 }
 
 void cpu_physical_memory_unmap(void *buffer, hwaddr len,
diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -XXX,XX +XXX,XX @@ const ppc_hash_pte64_t *ppc_hash64_map_hptes(PowerPCCPU *cpu,
         return NULL;
     }
 
-    hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false);
+    hptes = address_space_map(CPU(cpu)->as, base + pte_offset, &plen, false,
+                              MEMTXATTRS_UNSPECIFIED);
     if (plen < (n * HASH_PTE_SIZE_64)) {
         hw_error("%s: Unable to map all requested HPTEs\n", __func__);
     }
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to address_space_access_valid().
Its callers either have an attrs value to hand, or don't care
and can use MEMTXATTRS_UNSPECIFIED.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521140402.23318-6-peter.maydell@linaro.org
---
 include/exec/memory.h      | 4 +++-
 include/sysemu/dma.h       | 3 ++-
 exec.c                     | 3 ++-
 target/s390x/diag.c        | 6 ++++--
 target/s390x/excp_helper.c | 3 ++-
 target/s390x/mmu_helper.c  | 3 ++-
 target/s390x/sigp.c        | 3 ++-
 7 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate(AddressSpace *as,
  * @addr: address within that address space
  * @len: length of the area to be checked
  * @is_write: indicates the transfer direction
+ * @attrs: memory attributes
  */
-bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write);
+bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len,
+                                bool is_write, MemTxAttrs attrs);
 
 /* address_space_map: map a physical memory region into a host virtual address
  *
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -XXX,XX +XXX,XX @@ static inline bool dma_memory_valid(AddressSpace *as,
                                     DMADirection dir)
 {
     return address_space_access_valid(as, addr, len,
-                                      dir == DMA_DIRECTION_FROM_DEVICE);
+                                      dir == DMA_DIRECTION_FROM_DEVICE,
+                                      MEMTXATTRS_UNSPECIFIED);
 }
 
 static inline int dma_memory_rw_relaxed(AddressSpace *as, dma_addr_t addr,
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
 }
 
 bool address_space_access_valid(AddressSpace *as, hwaddr addr,
-                                int len, bool is_write)
+                                int len, bool is_write,
+                                MemTxAttrs attrs)
 {
     FlatView *fv;
     bool result;
diff --git a/target/s390x/diag.c b/target/s390x/diag.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/diag.c
+++ b/target/s390x/diag.c
@@ -XXX,XX +XXX,XX @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
             return;
         }
         if (!address_space_access_valid(&address_space_memory, addr,
-                                        sizeof(IplParameterBlock), false)) {
+                                        sizeof(IplParameterBlock), false,
+                                        MEMTXATTRS_UNSPECIFIED)) {
             s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
             return;
         }
@@ -XXX,XX +XXX,XX @@ out:
             return;
         }
         if (!address_space_access_valid(&address_space_memory, addr,
-                                        sizeof(IplParameterBlock), true)) {
+                                        sizeof(IplParameterBlock), true,
+                                        MEMTXATTRS_UNSPECIFIED)) {
             s390_program_interrupt(env, PGM_ADDRESSING, ILEN_AUTO, ra);
             return;
         }
diff --git a/target/s390x/excp_helper.c b/target/s390x/excp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/excp_helper.c
+++ b/target/s390x/excp_helper.c
@@ -XXX,XX +XXX,XX @@ int s390_cpu_handle_mmu_fault(CPUState *cs, vaddr orig_vaddr, int size,
 
     /* check out of RAM access */
     if (!address_space_access_valid(&address_space_memory, raddr,
-                                    TARGET_PAGE_SIZE, rw)) {
+                                    TARGET_PAGE_SIZE, rw,
+                                    MEMTXATTRS_UNSPECIFIED)) {
         DPRINTF("%s: raddr %" PRIx64 " > ram_size %" PRIx64 "\n", __func__,
                 (uint64_t)raddr, (uint64_t)ram_size);
         trigger_pgm_exception(env, PGM_ADDRESSING, ILEN_AUTO);
diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -XXX,XX +XXX,XX @@ static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
             return ret;
         }
         if (!address_space_access_valid(&address_space_memory, pages[i],
-                                        TARGET_PAGE_SIZE, is_write)) {
+                                        TARGET_PAGE_SIZE, is_write,
+                                        MEMTXATTRS_UNSPECIFIED)) {
             trigger_access_exception(env, PGM_ADDRESSING, ILEN_AUTO, 0);
             return -EFAULT;
         }
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -XXX,XX +XXX,XX @@ static void sigp_set_prefix(CPUState *cs, run_on_cpu_data arg)
     cpu_synchronize_state(cs);
 
     if (!address_space_access_valid(&address_space_memory, addr,
-                                    sizeof(struct LowCore), false)) {
+                                    sizeof(struct LowCore), false,
+                                    MEMTXATTRS_UNSPECIFIED)) {
         set_sigp_status(si, SIGP_STAT_INVALID_PARAMETER);
         return;
     }
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to flatview_extend_translation().
Its callers either have an attrs value to hand, or don't care
and can use MEMTXATTRS_UNSPECIFIED.

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr,
 
 static hwaddr
 flatview_extend_translation(FlatView *fv, hwaddr addr,
-                                 hwaddr target_len,
-                                 MemoryRegion *mr, hwaddr base, hwaddr len,
-                                 bool is_write)
+                            hwaddr target_len,
+                            MemoryRegion *mr, hwaddr base, hwaddr len,
+                            bool is_write, MemTxAttrs attrs)
 {
     hwaddr done = 0;
     hwaddr xlat;
@@ -XXX,XX +XXX,XX @@ void *address_space_map(AddressSpace *as,
 
     memory_region_ref(mr);
     *plen = flatview_extend_translation(fv, addr, len, mr, xlat,
-                                             l, is_write);
+                                        l, is_write, attrs);
     ptr = qemu_ram_ptr_length(mr->ram_block, xlat, plen, true);
     rcu_read_unlock();
 
@@ -XXX,XX +XXX,XX @@ int64_t address_space_cache_init(MemoryRegionCache *cache,
     mr = cache->mrs.mr;
     memory_region_ref(mr);
     if (memory_access_is_direct(mr, is_write)) {
+        /* We don't care about the memory attributes here as we're only
+         * doing this if we found actual RAM, which behaves the same
+         * regardless of attributes; so UNSPECIFIED is fine.
+         */
         l = flatview_extend_translation(cache->fv, addr, len, mr,
-                                        cache->xlat, l, is_write);
+                                        cache->xlat, l, is_write,
+                                        MEMTXATTRS_UNSPECIFIED);
         cache->ptr = qemu_ram_ptr_length(mr->ram_block, cache->xlat, &l, true);
     } else {
         cache->ptr = NULL;
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to memory_region_access_valid().
Its callers either have an attrs value to hand, or don't care
and can use MEMTXATTRS_UNSPECIFIED.

The callsite in flatview_access_valid() is part of a recursive
loop flatview_access_valid() -> memory_region_access_valid() ->
 subpage_accepts() -> flatview_access_valid(); we make it pass
MEMTXATTRS_UNSPECIFIED for now, until the next several commits
have plumbed an attrs parameter through the rest of the loop
and we can add an attrs parameter to flatview_access_valid().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521140402.23318-8-peter.maydell@linaro.org
---
 include/exec/memory-internal.h | 3 ++-
 exec.c                         | 4 +++-
 hw/s390x/s390-pci-inst.c       | 3 ++-
 memory.c                       | 7 ++++---
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/include/exec/memory-internal.h b/include/exec/memory-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory-internal.h
+++ b/include/exec/memory-internal.h
@@ -XXX,XX +XXX,XX @@ void flatview_unref(FlatView *view);
 extern const MemoryRegionOps unassigned_mem_ops;
 
 bool memory_region_access_valid(MemoryRegion *mr, hwaddr addr,
-                                unsigned size, bool is_write);
+                                unsigned size, bool is_write,
+                                MemTxAttrs attrs);
 
 void flatview_add_to_dispatch(FlatView *fv, MemoryRegionSection *section);
 AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv);
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
         mr = flatview_translate(fv, addr, &xlat, &l, is_write);
         if (!memory_access_is_direct(mr, is_write)) {
             l = memory_access_size(mr, l, addr);
-            if (!memory_region_access_valid(mr, xlat, l, is_write)) {
+            /* When our callers all have attrs we'll pass them through here */
+            if (!memory_region_access_valid(mr, xlat, l, is_write,
+                                            MEMTXATTRS_UNSPECIFIED)) {
                 return false;
             }
         }
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -XXX,XX +XXX,XX @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
     mr = s390_get_subregion(mr, offset, len);
     offset -= mr->addr;
 
-    if (!memory_region_access_valid(mr, offset, len, true)) {
+    if (!memory_region_access_valid(mr, offset, len, true,
+                                    MEMTXATTRS_UNSPECIFIED)) {
         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
         return 0;
     }
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ram_device_mem_ops = {
 bool memory_region_access_valid(MemoryRegion *mr,
                                 hwaddr addr,
                                 unsigned size,
-                                bool is_write)
+                                bool is_write,
+                                MemTxAttrs attrs)
 {
     int access_size_min, access_size_max;
     int access_size, i;
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
 {
     MemTxResult r;
 
-    if (!memory_region_access_valid(mr, addr, size, false)) {
+    if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
         *pval = unassigned_mem_read(mr, addr, size);
         return MEMTX_DECODE_ERROR;
     }
@@ -XXX,XX +XXX,XX @@ MemTxResult memory_region_dispatch_write(MemoryRegion *mr,
                                          unsigned size,
                                          MemTxAttrs attrs)
 {
-    if (!memory_region_access_valid(mr, addr, size, true)) {
+    if (!memory_region_access_valid(mr, addr, size, true, attrs)) {
         unassigned_mem_write(mr, addr, data, size);
         return MEMTX_DECODE_ERROR;
     }
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to the MemoryRegion valid.accepts
callback. We'll need this for subpage_accepts().

We could take the approach we used with the read and write
callbacks and add new a new _with_attrs version, but since there
are so few implementations of the accepts hook we just change
them all.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180521140402.23318-9-peter.maydell@linaro.org
---
 include/exec/memory.h |  3 ++-
 exec.c                |  9 ++++++---
 hw/hppa/dino.c        |  3 ++-
 hw/nvram/fw_cfg.c     | 12 ++++++++----
 hw/scsi/esp.c         |  3 ++-
 hw/xen/xen_pt_msi.c   |  3 ++-
 memory.c              |  5 +++--
 7 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionOps {
          * as a machine check exception).
          */
         bool (*accepts)(void *opaque, hwaddr addr,
-                        unsigned size, bool is_write);
+                        unsigned size, bool is_write,
+                        MemTxAttrs attrs);
     } valid;
     /* Internal implementation constraints: */
     struct {
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
 }
 
 static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write)
+                                 unsigned size, bool is_write,
+                                 MemTxAttrs attrs)
 {
     return is_write;
 }
@@ -XXX,XX +XXX,XX @@ static MemTxResult subpage_write(void *opaque, hwaddr addr,
 }
 
 static bool subpage_accepts(void *opaque, hwaddr addr,
-                            unsigned len, bool is_write)
+                            unsigned len, bool is_write,
+                            MemTxAttrs attrs)
 {
     subpage_t *subpage = opaque;
 #if defined(DEBUG_SUBPAGE)
@@ -XXX,XX +XXX,XX @@ static void readonly_mem_write(void *opaque, hwaddr addr,
 }
 
 static bool readonly_mem_accepts(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write)
+                                 unsigned size, bool is_write,
+                                 MemTxAttrs attrs)
 {
     return is_write;
 }
diff --git a/hw/hppa/dino.c b/hw/hppa/dino.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/hppa/dino.c
+++ b/hw/hppa/dino.c
@@ -XXX,XX +XXX,XX @@ static void gsc_to_pci_forwarding(DinoState *s)
 }
 
 static bool dino_chip_mem_valid(void *opaque, hwaddr addr,
-                                unsigned size, bool is_write)
+                                unsigned size, bool is_write,
+                                MemTxAttrs attrs)
 {
     switch (addr) {
     case DINO_IAR0:
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
 }
 
 static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
+                                 unsigned size, bool is_write,
+                                 MemTxAttrs attrs)
 {
     return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
                          (size == 8 && addr == 0));
 }
 
 static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
+                                  unsigned size, bool is_write,
+                                  MemTxAttrs attrs)
 {
     return addr == 0;
 }
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
 }
 
 static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
-                                 unsigned size, bool is_write)
+                                 unsigned size, bool is_write,
+                                 MemTxAttrs attrs)
 {
     return is_write && size == 2;
 }
@@ -XXX,XX +XXX,XX @@ static void fw_cfg_comb_write(void *opaque, hwaddr addr,
 }
 
 static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
-                                  unsigned size, bool is_write)
+                              unsigned size, bool is_write,
+                              MemTxAttrs attrs)
 {
     return (size == 1) || (is_write && size == 2);
 }
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -XXX,XX +XXX,XX @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
 }
 
 static bool esp_mem_accepts(void *opaque, hwaddr addr,
-                            unsigned size, bool is_write)
+                            unsigned size, bool is_write,
+                            MemTxAttrs attrs)
 {
     return (size == 1) || (is_write && size == 4);
 }
diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/xen/xen_pt_msi.c
+++ b/hw/xen/xen_pt_msi.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pci_msix_read(void *opaque, hwaddr addr,
 }
 
 static bool pci_msix_accepts(void *opaque, hwaddr addr,
-                             unsigned size, bool is_write)
+                             unsigned size, bool is_write,
+                             MemTxAttrs attrs)
 {
     return !(addr & (size - 1));
 }
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@ static void unassigned_mem_write(void *opaque, hwaddr addr,
 }
 
 static bool unassigned_mem_accepts(void *opaque, hwaddr addr,
-                                   unsigned size, bool is_write)
+                                   unsigned size, bool is_write,
+                                   MemTxAttrs attrs)
 {
     return false;
 }
@@ -XXX,XX +XXX,XX @@ bool memory_region_access_valid(MemoryRegion *mr,
     access_size = MAX(MIN(size, access_size_max), access_size_min);
     for (i = 0; i < size; i += access_size) {
         if (!mr->ops->valid.accepts(mr->opaque, addr + i, access_size,
-                                    is_write)) {
+                                    is_write, attrs)) {
             return false;
         }
     }
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to flatview_access_valid().
Its callers now all have an attrs value to hand, so we can
correct our earlier temporary use of MEMTXATTRS_UNSPECIFIED.

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
 static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
                                   const uint8_t *buf, int len);
 static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
-                                  bool is_write);
+                                  bool is_write, MemTxAttrs attrs);
 
 static MemTxResult subpage_read(void *opaque, hwaddr addr, uint64_t *data,
                                 unsigned len, MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool subpage_accepts(void *opaque, hwaddr addr,
 #endif
 
     return flatview_access_valid(subpage->fv, addr + subpage->base,
-                                 len, is_write);
+                                 len, is_write, attrs);
 }
 
 static const MemoryRegionOps subpage_ops = {
@@ -XXX,XX +XXX,XX @@ static void cpu_notify_map_clients(void)
 }
 
 static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
-                                  bool is_write)
+                                  bool is_write, MemTxAttrs attrs)
 {
     MemoryRegion *mr;
     hwaddr l, xlat;
@@ -XXX,XX +XXX,XX @@ static bool flatview_access_valid(FlatView *fv, hwaddr addr, int len,
         mr = flatview_translate(fv, addr, &xlat, &l, is_write);
         if (!memory_access_is_direct(mr, is_write)) {
             l = memory_access_size(mr, l, addr);
-            /* When our callers all have attrs we'll pass them through here */
-            if (!memory_region_access_valid(mr, xlat, l, is_write,
-                                            MEMTXATTRS_UNSPECIFIED)) {
+            if (!memory_region_access_valid(mr, xlat, l, is_write, attrs)) {
                 return false;
             }
         }
@@ -XXX,XX +XXX,XX @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr,
 
     rcu_read_lock();
     fv = address_space_to_flatview(as);
-    result = flatview_access_valid(fv, addr, len, is_write);
+    result = flatview_access_valid(fv, addr, len, is_write, attrs);
     rcu_read_unlock();
     return result;
 }
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to flatview_translate(); all its
callers now have attrs available.

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to address_space_get_iotlb_entry().

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ void address_space_cache_destroy(MemoryRegionCache *cache);
  * entry. Should be called from an RCU critical section.
  */
 IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-                                            bool is_write);
+                                            bool is_write, MemTxAttrs attrs);
 
 /* address_space_translate: translate an address range into an address space
  * into a MemoryRegion and an address range into that section.  Should be
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
 
 /* Called from RCU critical section */
 IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
-                                            bool is_write)
+                                            bool is_write, MemTxAttrs attrs)
 {
     MemoryRegionSection section;
     hwaddr xlat, page_mask;
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -XXX,XX +XXX,XX @@ int vhost_device_iotlb_miss(struct vhost_dev *dev, uint64_t iova, int write)
     trace_vhost_iotlb_miss(dev, 1);
 
     iotlb = address_space_get_iotlb_entry(dev->vdev->dma_as,
-                                          iova, write);
+                                          iova, write,
+                                          MEMTXATTRS_UNSPECIFIED);
     if (iotlb.target_as != NULL) {
         ret = vhost_memory_region_lookup(dev, iotlb.translated_addr,
                                          &uaddr, &len);
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to flatview_do_translate().

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ unassigned:
  * @is_write: whether the translation operation is for write
  * @is_mmio: whether this can be MMIO, set true if it can
  * @target_as: the address space targeted by the IOMMU
+ * @attrs: memory transaction attributes
  *
  * This function is called from RCU critical section
  */
@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
                                                  hwaddr *page_mask_out,
                                                  bool is_write,
                                                  bool is_mmio,
-                                                 AddressSpace **target_as)
+                                                 AddressSpace **target_as,
+                                                 MemTxAttrs attrs)
 {
     MemoryRegionSection *section;
     IOMMUMemoryRegion *iommu_mr;
@@ -XXX,XX +XXX,XX @@ IOMMUTLBEntry address_space_get_iotlb_entry(AddressSpace *as, hwaddr addr,
      * but page mask.
      */
     section = flatview_do_translate(address_space_to_flatview(as), addr, &xlat,
-                                    NULL, &page_mask, is_write, false, &as);
+                                    NULL, &page_mask, is_write, false, &as,
+                                    attrs);
 
     /* Illegal translation */
     if (section.mr == &io_mem_unassigned) {
@@ -XXX,XX +XXX,XX @@ MemoryRegion *flatview_translate(FlatView *fv, hwaddr addr, hwaddr *xlat,
 
     /* This can be MMIO, so setup MMIO bit. */
     section = flatview_do_translate(fv, addr, xlat, plen, NULL,
-                                    is_write, true, &as);
+                                    is_write, true, &as, attrs);
     mr = section.mr;
 
     if (xen_enabled() && memory_access_is_direct(mr, is_write)) {
-- 
2.17.1

As part of plumbing MemTxAttrs down to the IOMMU translate method,
add MemTxAttrs as an argument to address_space_translate_iommu().

diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ address_space_translate_internal(AddressSpaceDispatch *d, hwaddr addr, hwaddr *x
  * @is_write: whether the translation operation is for write
  * @is_mmio: whether this can be MMIO, set true if it can
  * @target_as: the address space targeted by the IOMMU
+ * @attrs: transaction attributes
  *
  * This function is called from RCU critical section.  It is the common
  * part of flatview_do_translate and address_space_translate_cached.
@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection address_space_translate_iommu(IOMMUMemoryRegion *iomm
                                                          hwaddr *page_mask_out,
                                                          bool is_write,
                                                          bool is_mmio,
-                                                         AddressSpace **target_as)
+                                                         AddressSpace **target_as,
+                                                         MemTxAttrs attrs)
 {
     MemoryRegionSection *section;
     hwaddr page_mask = (hwaddr)-1;
@@ -XXX,XX +XXX,XX @@ static MemoryRegionSection flatview_do_translate(FlatView *fv,
         return address_space_translate_iommu(iommu_mr, xlat,
                                              plen_out, page_mask_out,
                                              is_write, is_mmio,
-                                             target_as);
+                                             target_as, attrs);
     }
     if (page_mask_out) {
         /* Not behind an IOMMU, use default page size. */
@@ -XXX,XX +XXX,XX @@ static inline MemoryRegion *address_space_translate_cached(
 
     section = address_space_translate_iommu(iommu_mr, xlat, plen,
                                             NULL, is_write, true,
-                                            &target_as);
+                                            &target_as, attrs);
     return section.mr;
 }
 
-- 
2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

acpi_data_push uses g_array_set_size to resize the memory size. If there
is no enough contiguous memory, the address will be changed. So previous
pointer could not be used any more. It must update the pointer and use
the new one.

Also, previous codes wrongly use le32 conversion of iort->node_offset
for subsequent computations that will result incorrect value if host is
not litlle endian. So use the non-converted one instead.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1527663951-14552-1-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     AcpiIortItsGroup *its;
     AcpiIortTable *iort;
     AcpiIortSmmu3 *smmu;
-    size_t node_size, iort_length, smmu_offset = 0;
+    size_t node_size, iort_node_offset, iort_length, smmu_offset = 0;
     AcpiIortRC *rc;
 
     iort = acpi_data_push(table_data, sizeof(*iort));
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 
     iort_length = sizeof(*iort);
     iort->node_count = cpu_to_le32(nb_nodes);
-    iort->node_offset = cpu_to_le32(sizeof(*iort));
+    /*
+     * Use a copy in case table_data->data moves during acpi_data_push
+     * operations.
+     */
+    iort_node_offset = sizeof(*iort);
+    iort->node_offset = cpu_to_le32(iort_node_offset);
 
     /* ITS group node */
     node_size =  sizeof(*its) + sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         int irq =  vms->irqmap[VIRT_SMMU];
 
         /* SMMUv3 node */
-        smmu_offset = iort->node_offset + node_size;
+        smmu_offset = iort_node_offset + node_size;
         node_size = sizeof(*smmu) + sizeof(*idmap);
         iort_length += node_size;
         smmu = acpi_data_push(table_data, node_size);
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         idmap->id_count = cpu_to_le32(0xFFFF);
         idmap->output_base = 0;
         /* output IORT node is the ITS group node (the first node) */
-        idmap->output_reference = cpu_to_le32(iort->node_offset);
+        idmap->output_reference = cpu_to_le32(iort_node_offset);
     }
 
     /* Root Complex Node */
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         idmap->output_reference = cpu_to_le32(smmu_offset);
     } else {
         /* output IORT node is the ITS group node (the first node) */
-        idmap->output_reference = cpu_to_le32(iort->node_offset);
+        idmap->output_reference = cpu_to_le32(iort_node_offset);
     }
 
+    /*
+     * Update the pointer address in case table_data->data moves during above
+     * acpi_data_push operations.
+     */
+    iort = (AcpiIortTable *)(table_data->data + iort_start);
     iort->length = cpu_to_le32(iort_length);
 
     build_header(linker, table_data, (void *)(table_data->data + iort_start),
-- 
2.17.1

From: Shannon Zhao <zhaoshenglong@huawei.com>

kvm_irqchip_create called by kvm_init will call kvm_init_irq_routing to
initialize global capability variables. If we call kvm_init_irq_routing in
GIC realize function, previous allocated memory will leak.

Fix this by deleting the unnecessary call.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1527750994-14360-1-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic_kvm.c   | 1 -
 hw/intc/arm_gicv3_kvm.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
 
     if (kvm_has_gsi_routing()) {
         /* set up irq routing */
-        kvm_init_irq_routing(kvm_state);
         for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {
             kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
         }
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
 
     if (kvm_has_gsi_routing()) {
         /* set up irq routing */
-        kvm_init_irq_routing(kvm_state);
         for (i = 0; i < s->num_irq - GIC_INTERNAL; ++i) {
             kvm_irqchip_add_irq_route(kvm_state, i, 0, i);
         }
-- 
2.17.1