Series comparison

-[Qemu-devel] [PULL 00/18] target-arm queue
+[PULL 0/2] target-arm queue
-ARM queue: nothing particularly exciting, but 18 patches
+This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
-is enough to send out.
+we were using uninitialized data for the guarded bit when
 combining stage 1 and stage 2 attrs.
 thanks
 -- PMM
-The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
+The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
+  Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410
-for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
+for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:
-  mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
+  target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+target-arm: Fix bug where we weren't initializing
- * v7M: various code cleanups
+            guarded bit state when combining S1/S2 attrs
  * v7M: set correct BFSR bits on bus fault
  * v7M: clear exclusive monitor on reset and exception entry/exit
  * v7M: don't apply priority mask to negative priorities
  * zcu102: support 'secure' and 'virtualization' machine properties
  * aarch64: fix ERET single stepping
  * gpex: implement PCI INTx routing
  * mps2-an511: fix UART overflow interrupt line wiring
 ----------------------------------------------------------------
-Alistair Francis (5):
+Richard Henderson (2):
-      xlnx-ep108: Rename to ZCU102
+      target/arm: PTE bit GP only applies to stage1
-      xlnx-zcu102: Manually create the machines
+      target/arm: Copy guarded bit in combine_cacheattrs
       xlnx-zcu102: Add a machine level secure property
       xlnx-zcu102: Add a machine level virtualization property
       xlnx-zcu102: Mark the EP108 machine as deprecated
-Jaroslaw Pelczar (1):
+ target/arm/ptw.c | 11 ++++++-----
-      AArch64: Fix single stepping of ERET instruction
+file changed, 6 insertions(+), 5 deletions(-)
 Peter Maydell (8):
       target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
       target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
       target/arm: Get PRECISERR and IBUSERR the right way round
       nvic: Don't apply group priority mask to negative priorities
       target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
       target/arm: Add and use defines for EXCRET constants
       target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
       mps2-an511: Fix wiring of UART overflow interrupt lines
 Pranavkumar Sawargaonkar (3):
       hw/pci-host/gpex: Set INTx index/gsi mapping
       hw/arm/virt: Set INTx/gsi mapping
       hw/pci-host/gpex: Implement PCI INTx routing
 Richard Henderson (1):
       target/arm: Avoid an extra temporary for store_exclusive
  hw/arm/Makefile.objs         |   2 +-
  include/hw/arm/xlnx-zynqmp.h |   2 +
  include/hw/pci-host/gpex.h   |   3 +
  target/arm/cpu.h             |  35 +++---
  target/arm/internals.h       |  20 ++++
  hw/arm/mps2.c                |   4 +-
  hw/arm/virt.c                |   1 +
  hw/arm/xlnx-ep108.c          | 139 -----------------------
  hw/arm/xlnx-zcu102.c         | 259 +++++++++++++++++++++++++++++++++++++++++++
  hw/arm/xlnx-zynqmp.c         |   3 +-
  hw/intc/armv7m_nvic.c        |  11 +-
  hw/pci-host/gpex.c           |  22 ++++
  target/arm/cpu.c             |   6 +
  target/arm/helper.c          |  43 ++++---
  target/arm/op_helper.c       |   2 +-
  target/arm/translate-a64.c   |  27 ++---
 files changed, 382 insertions(+), 197 deletions(-)
  delete mode 100644 hw/arm/xlnx-ep108.c
  create mode 100644 hw/arm/xlnx-zcu102.c

-[Qemu-devel] [PULL 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+Deleted patch
-Use a symbolic constant M_REG_NUM_BANKS for the array size for
-registers which are banked by M profile security state, rather
-than hardcoding lots of 2s.
-Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h | 35 +++++++++++++++++++----------------
-file changed, 19 insertions(+), 16 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
-  * accessed via env->registerfield[env->v7m.secure] (whether the security
-  * extension is implemented or not).
-  */
--#define M_REG_NS 0
--#define M_REG_S 1
-+enum {
-+    M_REG_NS = 0,
-+    M_REG_S = 1,
-+    M_REG_NUM_BANKS = 2,
-+};
- /* ARM-specific interrupt pending bits.  */
- #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t other_sp;
-         uint32_t other_ss_msp;
-         uint32_t other_ss_psp;
--        uint32_t vecbase[2];
--        uint32_t basepri[2];
--        uint32_t control[2];
--        uint32_t ccr[2]; /* Configuration and Control */
--        uint32_t cfsr[2]; /* Configurable Fault Status */
-+        uint32_t vecbase[M_REG_NUM_BANKS];
-+        uint32_t basepri[M_REG_NUM_BANKS];
-+        uint32_t control[M_REG_NUM_BANKS];
-+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
-+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
-         uint32_t hfsr; /* HardFault Status */
-         uint32_t dfsr; /* Debug Fault Status Register */
--        uint32_t mmfar[2]; /* MemManage Fault Address */
-+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
-         uint32_t bfar; /* BusFault Address */
--        unsigned mpu_ctrl[2]; /* MPU_CTRL */
-+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
-         int exception;
--        uint32_t primask[2];
--        uint32_t faultmask[2];
-+        uint32_t primask[M_REG_NUM_BANKS];
-+        uint32_t faultmask[M_REG_NUM_BANKS];
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
-     } v7m;
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t *drbar;
-         uint32_t *drsr;
-         uint32_t *dracr;
--        uint32_t rnr[2];
-+        uint32_t rnr[M_REG_NUM_BANKS];
-     } pmsav7;
-     /* PMSAv8 MPU */
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-          *  pmsav7.rnr (region number register)
-          *  pmsav7_dregion (number of configured regions)
-          */
--        uint32_t *rbar[2];
--        uint32_t *rlar[2];
--        uint32_t mair0[2];
--        uint32_t mair1[2];
-+        uint32_t *rbar[M_REG_NUM_BANKS];
-+        uint32_t *rlar[M_REG_NUM_BANKS];
-+        uint32_t mair0[M_REG_NUM_BANKS];
-+        uint32_t mair1[M_REG_NUM_BANKS];
-     } pmsav8;
-     void *nvic;
---
-.7.4

-[Qemu-devel] [PULL 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
+Deleted patch
-For M profile we must clear the exclusive monitor on reset, exception
-entry and exception exit.  We weren't doing any of these things; fix
-this bug.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
----
- target/arm/internals.h | 10 ++++++++++
- target/arm/cpu.c       |  6 ++++++
- target/arm/helper.c    |  2 ++
- target/arm/op_helper.c |  2 +-
-files changed, 19 insertions(+), 1 deletion(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
- #endif
- /**
-+ * arm_clear_exclusive: clear the exclusive monitor
-+ * @env: CPU env
-+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
-+ */
-+static inline void arm_clear_exclusive(CPUARMState *env)
-+{
-+    env->exclusive_addr = -1;
-+}
-+
-+/**
-  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
-  * @s2addr: Address that caused a fault at stage 2
-  * @stage2: True if we faulted at stage 2
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-         env->regs[15] = 0xFFFF0000;
-     }
-+    /* M profile requires that reset clears the exclusive monitor;
-+     * A profile does not, but clearing it makes more sense than having it
-+     * set with an exclusive access on address zero.
-+     */
-+    arm_clear_exclusive(env);
-+
-     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
- #endif
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
-     armv7m_nvic_acknowledge_irq(env->nvic);
-     switch_v7m_sp(env, 0);
-+    arm_clear_exclusive(env);
-     /* Clear IT bits */
-     env->condexec_bits = 0;
-     env->regs[14] = lr;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-     }
-     /* Otherwise, we have a successful exception exit. */
-+    arm_clear_exclusive(env);
-     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
- }
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
-+++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
-     aarch64_save_sp(env, cur_el);
--    env->exclusive_addr = -1;
-+    arm_clear_exclusive(env);
-     /* We must squash the PSTATE.SS bit to zero unless both of the
-      * following hold:
---
-.7.4

-[Qemu-devel] [PULL 03/18] target/arm: Get PRECISERR and IBUSERR the right way round
+Deleted patch
-For a bus fault, the M profile BFSR bit PRECISERR means a bus
-fault on a data access, and IBUSERR means a bus fault on an
-instruction access. We had these the wrong way around; fix this.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         case 0x8: /* External Abort */
-             switch (cs->exception_index) {
-             case EXCP_PREFETCH_ABORT:
--                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
--                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
-+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
-                 break;
-             case EXCP_DATA_ABORT:
-                 env->v7m.cfsr[M_REG_NS] |=
--                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-                 env->v7m.bfar = env->exception.vaddress;
-                 qemu_log_mask(CPU_LOG_INT,
--                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
-+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
-                               env->v7m.bfar);
-                 break;
-             }
---
-.7.4

-[Qemu-devel] [PULL 04/18] nvic: Don't apply group priority mask to negative priorities
+Deleted patch
-In several places we were unconditionally applying the
-nvic_gprio_mask() to a priority value. This is incorrect
-if the priority is one of the fixed negative priority
-values (for NMI and HardFault), so don't do it.
-This bug would have caused both NMI and HardFault to be
-considered as the same priority and so NMI wouldn't
-correctly preempt HardFault.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 11 +++++++++--
-file changed, 9 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
-         }
-     }
-+    if (active_prio > 0) {
-+        active_prio &= nvic_gprio_mask(s);
-+    }
-+
-     s->vectpending = pend_irq;
--    s->exception_prio = active_prio & nvic_gprio_mask(s);
-+    s->exception_prio = active_prio;
-     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
- }
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
-     assert(vec->enabled);
-     assert(vec->pending);
--    pendgroupprio = vec->prio & nvic_gprio_mask(s);
-+    pendgroupprio = vec->prio;
-+    if (pendgroupprio > 0) {
-+        pendgroupprio &= nvic_gprio_mask(s);
-+    }
-     assert(pendgroupprio < running);
-     trace_nvic_acknowledge_irq(pending, vec->prio);
---
-.7.4

-[Qemu-devel] [PULL 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
+Deleted patch
-In do_v7m_exception_exit(), there's no need to force the high 4
-bits of 'type' to 1 when calling v7m_exception_taken(), because
-we know that they're always 1 or we could not have got to this
-"handle return to magic exception return address" code. Remove
-the unnecessary ORs.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          */
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
--        v7m_exception_taken(cpu, type | 0xf0000000);
-+        v7m_exception_taken(cpu, type);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                       "stackframe: failed exception return integrity check\n");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         v7m_push_stack(cpu);
--        v7m_exception_taken(cpu, type | 0xf0000000);
-+        v7m_exception_taken(cpu, type);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
-                       "failed exception return integrity check\n");
-         return;
---
-.7.4

-[Qemu-devel] [PULL 06/18] target/arm: Add and use defines for EXCRET constants
+Deleted patch
-The exception-return magic values get some new bits in v8M, which
-makes some bit definitions for them worthwhile.
-We don't use the bit definitions for the switch on the low bits
-which checks the return type for v7M, because this is defined
-in the v7M ARM ARM as a set of valid values rather than via
-per-bit checks.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
----
- target/arm/internals.h | 10 ++++++++++
- target/arm/helper.c    | 14 +++++++++-----
-files changed, 19 insertions(+), 5 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
- FIELD(V7M_CONTROL, SPSEL, 1, 1)
- FIELD(V7M_CONTROL, FPCA, 2, 1)
-+/* Bit definitions for v7M exception return payload */
-+FIELD(V7M_EXCRET, ES, 0, 1)
-+FIELD(V7M_EXCRET, RES0, 1, 1)
-+FIELD(V7M_EXCRET, SPSEL, 2, 1)
-+FIELD(V7M_EXCRET, MODE, 3, 1)
-+FIELD(V7M_EXCRET, FTYPE, 4, 1)
-+FIELD(V7M_EXCRET, DCRS, 5, 1)
-+FIELD(V7M_EXCRET, S, 6, 1)
-+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
-+
- /*
-  * For AArch64, map a given EL to an index in the banked_spsr array.
-  * Note that this mapping and the AArch32 mapping defined in bank_number()
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                   " previous exception %d\n",
-                   type, env->v7m.exception);
--    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
-+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
-     }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
-          */
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
--            int es = type & 1;
-+            int es = type & R_V7M_EXCRET_ES_MASK;
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
-                 env->v7m.faultmask[es] = 0;
-             }
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         return; /* Never happens.  Keep compiler happy.  */
-     }
--    lr = 0xfffffff1;
-+    lr = R_V7M_EXCRET_RES1_MASK |
-+        R_V7M_EXCRET_S_MASK |
-+        R_V7M_EXCRET_DCRS_MASK |
-+        R_V7M_EXCRET_FTYPE_MASK |
-+        R_V7M_EXCRET_ES_MASK;
-     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
--        lr |= 4;
-+        lr |= R_V7M_EXCRET_SPSEL_MASK;
-     }
-     if (!arm_v7m_is_handler_mode(env)) {
--        lr |= 8;
-+        lr |= R_V7M_EXCRET_MODE_MASK;
-     }
-     v7m_push_stack(cpu);
---
-.7.4

-[Qemu-devel] [PULL 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
+Deleted patch
-In the v7M and v8M ARM ARM, the magic exception return values are
-referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
-constants to define bits within them. Rename the 'type' variable
-which holds the exception return value in do_v7m_exception_exit()
-to excret, making it clearer that it does hold an EXC_RETURN value.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 23 ++++++++++++-----------
-file changed, 12 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
- static void do_v7m_exception_exit(ARMCPU *cpu)
- {
-     CPUARMState *env = &cpu->env;
--    uint32_t type;
-+    uint32_t excret;
-     uint32_t xpsr;
-     bool ufault = false;
-     bool return_to_sp_process = false;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-      * the target value up between env->regs[15] and env->thumb in
-      * gen_bx(). Reconstitute it.
-      */
--    type = env->regs[15];
-+    excret = env->regs[15];
-     if (env->thumb) {
--        type |= 1;
-+        excret |= 1;
-     }
-     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
-                   " previous exception %d\n",
--                  type, env->v7m.exception);
-+                  excret, env->v7m.exception);
--    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
-+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
--                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
-+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
-+                      excret);
-     }
-     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
-          */
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
--            int es = type & R_V7M_EXCRET_ES_MASK;
-+            int es = excret & R_V7M_EXCRET_ES_MASK;
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
-                 env->v7m.faultmask[es] = 0;
-             }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         g_assert_not_reached();
-     }
--    switch (type & 0xf) {
-+    switch (excret & 0xf) {
-     case 1: /* Return to Handler */
-         return_to_handler = true;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          */
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
--        v7m_exception_taken(cpu, type);
-+        v7m_exception_taken(cpu, excret);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                       "stackframe: failed exception return integrity check\n");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-     /* The restored xPSR exception field will be zero if we're
-      * resuming in Thread mode. If that doesn't match what the
--     * exception return type specified then this is a UsageFault.
-+     * exception return excret specified then this is a UsageFault.
-      */
-     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
-         /* Take an INVPC UsageFault by pushing the stack again. */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         v7m_push_stack(cpu);
--        v7m_exception_taken(cpu, type);
-+        v7m_exception_taken(cpu, excret);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
-                       "failed exception return integrity check\n");
-         return;
---
-.7.4

-[Qemu-devel] [PULL 08/18] xlnx-ep108: Rename to ZCU102
+[PULL 1/2] target/arm: PTE bit GP only applies to stage1
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The EP108 is a early access development board. Now that silicon is in
+Only perform the extract of GP during the stage1 walk.
 production people have access to the ZCU102. Let's rename the internal
 QEMU files and variables to use the ZCU102.
-There is no functional change here as the EP108 is still a valid board
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
-option.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                   |  2 +-
+ target/arm/ptw.c | 10 +++++-----
- hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
+file changed, 5 insertions(+), 5 deletions(-)
 files changed, 16 insertions(+), 16 deletions(-)
  rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/target/arm/ptw.c
-+++ b/hw/arm/Makefile.objs
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
- obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
+         result->f.attrs.secure = false;
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 -obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
 +obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
 similarity index 85%
 rename from hw/arm/xlnx-ep108.c
 rename to hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-ep108.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
  /*
 - * Xilinx ZynqMP EP108 board
 + * Xilinx ZynqMP ZCU102 board
   *
   * Copyright (C) 2015 Xilinx Inc
   * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/log.h"
 -typedef struct XlnxEP108 {
 +typedef struct XlnxZCU102 {
      XlnxZynqMPState soc;
      MemoryRegion ddr_ram;
 -} XlnxEP108;
 +} XlnxZCU102;
 -static struct arm_boot_info xlnx_ep108_binfo;
 +static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_ep108_init(MachineState *machine)
 +static void xlnx_zcu102_init(MachineState *machine)
  {
 -    XlnxEP108 *s = g_new0(XlnxEP108, 1);
 +    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
      int i;
      uint64_t ram_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
      }
-     if (ram_size < 0x08000000) {
+-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
--        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
+-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-                  ram_size);
+-    }
 -
      if (regime_is_stage2(mmu_idx)) {
          result->cacheattrs.is_s2_format = true;
          result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          assert(attrindx <= 7);
          result->cacheattrs.is_s2_format = false;
          result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 +
 +        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
 +        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
 +            result->f.guarded = extract64(attrs, 50, 1); /* GP */
 +        }
      }
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+     /*
      /* TODO create and connect IDE devices for ide_drive_get() */
 -    xlnx_ep108_binfo.ram_size = ram_size;
 -    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
 -    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
 -    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
 -    xlnx_ep108_binfo.loader_start = 0;
 -    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
 +    xlnx_zcu102_binfo.ram_size = ram_size;
 +    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
 +    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
 +    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
 +    xlnx_zcu102_binfo.loader_start = 0;
 +    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
  }
  static void xlnx_ep108_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP EP108 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
  static void xlnx_zcu102_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP ZCU102 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 09/18] xlnx-zcu102: Manually create the machines
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-In preperation for future work let's manually create the Xilnx machines.
-This will allow us to set properties for the machines in the future.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
-file changed, 67 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- typedef struct XlnxZCU102 {
-+    MachineState parent_obj;
-+
-     XlnxZynqMPState soc;
-     MemoryRegion ddr_ram;
- } XlnxZCU102;
-+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-+#define ZCU102_MACHINE(obj) \
-+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
-+
-+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
-+#define EP108_MACHINE(obj) \
-+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
-+
- static struct arm_boot_info xlnx_zcu102_binfo;
--static void xlnx_zcu102_init(MachineState *machine)
-+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
- {
--    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
-     int i;
-     uint64_t ram_size = machine->ram_size;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
-     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
- }
--static void xlnx_ep108_machine_init(MachineClass *mc)
-+static void xlnx_ep108_init(MachineState *machine)
-+{
-+    XlnxZCU102 *s = EP108_MACHINE(machine);
-+
-+    xlnx_zynqmp_init(s, machine);
-+}
-+
-+static void xlnx_ep108_machine_instance_init(Object *obj)
- {
-+}
-+
-+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Xilinx ZynqMP EP108 board";
--    mc->init = xlnx_zcu102_init;
-+    mc->init = xlnx_ep108_init;
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
-     mc->ignore_memory_transaction_failures = true;
- }
--DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
-+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
-+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
-+    .parent     = TYPE_MACHINE,
-+    .class_init = xlnx_ep108_machine_class_init,
-+    .instance_init = xlnx_ep108_machine_instance_init,
-+    .instance_size = sizeof(XlnxZCU102),
-+};
--static void xlnx_zcu102_machine_init(MachineClass *mc)
-+static void xlnx_ep108_machine_init_register_types(void)
- {
-+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
-+}
-+
-+static void xlnx_zcu102_init(MachineState *machine)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
-+
-+    xlnx_zynqmp_init(s, machine);
-+}
-+
-+static void xlnx_zcu102_machine_instance_init(Object *obj)
-+{
-+}
-+
-+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Xilinx ZynqMP ZCU102 board";
-     mc->init = xlnx_zcu102_init;
-     mc->block_default_type = IF_IDE;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
-     mc->ignore_memory_transaction_failures = true;
- }
--DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
-+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
-+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
-+    .parent     = TYPE_MACHINE,
-+    .class_init = xlnx_zcu102_machine_class_init,
-+    .instance_init = xlnx_zcu102_machine_instance_init,
-+    .instance_size = sizeof(XlnxZCU102),
-+};
-+
-+static void xlnx_zcu102_machine_init_register_types(void)
-+{
-+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
-+}
-+
-+type_init(xlnx_zcu102_machine_init_register_types)
-+type_init(xlnx_ep108_machine_init_register_types)
---
-.7.4

-[Qemu-devel] [PULL 10/18] xlnx-zcu102: Add a machine level secure property
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-Add a machine level secure property. This defaults to false and can be
-set to true using this machine command line argument:
-    -machine xlnx-zcu102,secure=on
-This follows what the ARM virt machine does.
-This property only applies to the ZCU102 machine. The EP108 machine does
-not have this property.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
-file changed, 32 insertions(+)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
-     XlnxZynqMPState soc;
-     MemoryRegion ddr_ram;
-+
-+    bool secure;
- } XlnxZCU102;
- #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
- static struct arm_boot_info xlnx_zcu102_binfo;
-+static bool zcu102_get_secure(Object *obj, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    return s->secure;
-+}
-+
-+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    s->secure = value;
-+}
-+
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
- {
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
-     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
-                          "ddr-ram", &error_abort);
-+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
-+                             &error_fatal);
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
- static void xlnx_ep108_machine_instance_init(Object *obj)
- {
-+    XlnxZCU102 *s = EP108_MACHINE(obj);
-+
-+    /* EP108, we don't support setting secure */
-+    s->secure = false;
- }
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
- static void xlnx_zcu102_machine_instance_init(Object *obj)
- {
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    /* Default to secure mode being disabled */
-+    s->secure = false;
-+    object_property_add_bool(obj, "secure", zcu102_get_secure,
-+                             zcu102_set_secure, NULL);
-+    object_property_set_description(obj, "secure",
-+                                    "Set on/off to enable/disable the ARM "
-+                                    "Security Extensions (TrustZone)",
-+                                    NULL);
- }
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
---
-.7.4

-[Qemu-devel] [PULL 11/18] xlnx-zcu102: Add a machine level virtualization property
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-Add a machine level virtualization property. This defaults to false and can be
-set to true using this machine command line argument:
-    -machine xlnx-zcu102,virtualization=on
-This follows what the ARM virt machine does.
-This property only applies to the ZCU102 machine. The EP108 machine does
-not have this property.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/xlnx-zynqmp.h |  2 ++
- hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
- hw/arm/xlnx-zynqmp.c         |  3 ++-
-files changed, 33 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
-     /* Has the ARM Security extensions?  */
-     bool secure;
-+    /* Has the ARM Virtualization extensions?  */
-+    bool virt;
-     /* Has the RPU subsystem?  */
-     bool has_rpu;
- }  XlnxZynqMPState;
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
-     MemoryRegion ddr_ram;
-     bool secure;
-+    bool virt;
- } XlnxZCU102;
- #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
-     s->secure = value;
- }
-+static bool zcu102_get_virt(Object *obj, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    return s->virt;
-+}
-+
-+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    s->virt = value;
-+}
-+
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
- {
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
-                          "ddr-ram", &error_abort);
-     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
-                              &error_fatal);
-+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
-+                             &error_fatal);
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
- {
-     XlnxZCU102 *s = EP108_MACHINE(obj);
--    /* EP108, we don't support setting secure */
-+    /* EP108, we don't support setting secure or virt */
-     s->secure = false;
-+    s->virt = false;
- }
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
-                                     "Set on/off to enable/disable the ARM "
-                                     "Security Extensions (TrustZone)",
-                                     NULL);
-+
-+    /* Default to virt (EL2) being disabled */
-+    s->virt = false;
-+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
-+                             zcu102_set_virt, NULL);
-+    object_property_set_description(obj, "virtualization",
-+                                    "Set on/off to enable/disable emulating a "
-+                                    "guest CPU which implements the ARM "
-+                                    "Virtualization Extensions",
-+                                    NULL);
- }
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                  s->secure, "has_el3", NULL);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
--                                 false, "has_el2", NULL);
-+                                 s->virt, "has_el2", NULL);
-         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
-                                 "reset-cbar", &error_abort);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
- static Property xlnx_zynqmp_props[] = {
-     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
-     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
-+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
-     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
-     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
-                      MemoryRegion *),
---
-.7.4

-[Qemu-devel] [PULL 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-The EP108 is the same as the ZCU102, mark it as deprecated as we don't
-need two machines.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zcu102.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
- {
-     MachineClass *mc = MACHINE_CLASS(oc);
--    mc->desc = "Xilinx ZynqMP EP108 board";
-+    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
-     mc->init = xlnx_ep108_init;
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
---
-.7.4

-[Qemu-devel] [PULL 13/18] AArch64: Fix single stepping of ERET instruction
+Deleted patch
-From: Jaroslaw Pelczar <j.pelczar@samsung.com>
-Previously when single stepping through ERET instruction via GDB
-would result in debugger entering the "next" PC after ERET instruction.
-When debugging in kernel mode, this will also cause unintended behavior,
-because debugger will try to access memory from EL0 point of view.
-Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
-Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-         default:
-             gen_a64_set_pc_im(dc->pc);
-             /* fall through */
-+        case DISAS_EXIT:
-         case DISAS_JUMP:
-             if (dc->base.singlestep_enabled) {
-                 gen_exception_internal(EXCP_DEBUG);
---
-.7.4

-[Qemu-devel] [PULL 14/18] target/arm: Avoid an extra temporary for store_exclusive
+[PULL 2/2] target/arm: Copy guarded bit in combine_cacheattrs
 From: Richard Henderson <richard.henderson@linaro.org>
-Instead of copying addr to a local temp, reuse the value (which we
+The guarded bit comes from the stage1 walk.
 have just compared as equal) already saved in cpu_exclusive_addr.
+Fixes: Coverity CID 1507929
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
+Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 26 +++++++++-----------------
+ target/arm/ptw.c | 1 +
-file changed, 9 insertions(+), 17 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
- }
+     assert(!s1.is_s2_format);
- static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
+     ret.is_s2_format = false;
--                                TCGv_i64 inaddr, int size, int is_pair)
++    ret.guarded = s1.guarded;
-+                                TCGv_i64 addr, int size, int is_pair)
- {
+     if (s1.attrs == 0xf0) {
-     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
+         tagged = true;
       *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
       */
      TCGLabel *fail_label = gen_new_label();
      TCGLabel *done_label = gen_new_label();
 -    TCGv_i64 addr = tcg_temp_local_new_i64();
      TCGv_i64 tmp;
 -    /* Copy input into a local temp so it is not trashed when the
 -     * basic block ends at the branch insn.
 -     */
 -    tcg_gen_mov_i64(addr, inaddr);
      tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
      tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
              } else {
                  tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
              }
 -            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
 +            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
 +                                       cpu_exclusive_val, tmp,
                                         get_mem_index(s),
                                         MO_64 | MO_ALIGN | s->be_data);
              tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
          } else if (s->be_data == MO_LE) {
 -            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          } else {
 -            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          }
      } else {
 -        TCGv_i64 val = cpu_reg(s, rt);
 -        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
 -                                   get_mem_index(s),
 +        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
 +                                   cpu_reg(s, rt), get_mem_index(s),
                                     size | MO_ALIGN | s->be_data);
          tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
      }
 -
 -    tcg_temp_free_i64(addr);
 -
      tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
      tcg_temp_free_i64(tmp);
      tcg_gen_br(done_label);
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping
+Deleted patch
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-To implement INTx to gsi routing we need to pass the gpex host
-bridge the gsi associated to each INTx index. Let's introduce
-irq_num array and gpex_set_irq_num setter function.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Feng Kan <fkan@apm.com>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
-Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/pci-host/gpex.h |  3 +++
- hw/pci-host/gpex.c         | 10 ++++++++++
-files changed, 13 insertions(+)
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci-host/gpex.h
-+++ b/include/hw/pci-host/gpex.h
-@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
-     MemoryRegion io_ioport;
-     MemoryRegion io_mmio;
-     qemu_irq irq[GPEX_NUM_IRQS];
-+    int irq_num[GPEX_NUM_IRQS];
- } GPEXHost;
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
-+
- #endif /* HW_GPEX_H */
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
-+++ b/hw/pci-host/gpex.c
-@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
-     qemu_set_irq(s->irq[irq_num], level);
- }
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
-+{
-+    if (index >= GPEX_NUM_IRQS) {
-+        return -EINVAL;
-+    }
-+
-+    s->irq_num[index] = gsi;
-+    return 0;
-+}
-+
- static void gpex_host_realize(DeviceState *dev, Error **errp)
- {
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
---
-.7.4

-[Qemu-devel] [PULL 16/18] hw/arm/virt: Set INTx/gsi mapping
+Deleted patch
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
-needed for INTx/gsi routing.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
-Tested-by: Feng Kan <fkan@apm.com>
-Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
-     for (i = 0; i < GPEX_NUM_IRQS; i++) {
-         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
-+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
-     }
-     pci = PCI_HOST_BRIDGE(dev);
---
-.7.4

-[Qemu-devel] [PULL 17/18] hw/pci-host/gpex: Implement PCI INTx routing
+Deleted patch
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-Now we are able to retrieve the gsi from the INTx pin, let's
-enable intx_to_irq routing. From that point on, irqfd becomes
-usable along with INTx when assigning a PCIe device.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
-Tested-by: Feng Kan <fkan@apm.com>
-Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/pci-host/gpex.c | 12 ++++++++++++
-file changed, 12 insertions(+)
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
-+++ b/hw/pci-host/gpex.c
-@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
-     return 0;
- }
-+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
-+{
-+    PCIINTxRoute route;
-+    GPEXHost *s = opaque;
-+
-+    route.mode = PCI_INTX_ENABLED;
-+    route.irq = s->irq_num[pin];
-+
-+    return route;
-+}
-+
- static void gpex_host_realize(DeviceState *dev, Error **errp)
- {
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
-                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
-     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
-+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
-     qdev_init_nofail(DEVICE(&s->gpex_root));
- }
---
-.7.4

-[Qemu-devel] [PULL 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines
+Deleted patch
-Fix an error that meant we were wiring every UART's overflow
-interrupts into the same inputs 0 and 1 of the OR gate,
-rather than giving each its own input.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
----
- hw/arm/mps2.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
-+++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-             cmsdk_apb_uart_create(uartbase[i],
-                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
-                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
--                                  qdev_get_gpio_in(orgate_dev, 0),
--                                  qdev_get_gpio_in(orgate_dev, 1),
-+                                  qdev_get_gpio_in(orgate_dev, i * 2),
-+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
-                                   NULL,
-                                   uartchr, SYSCLK_FRQ);
-         }
---
-.7.4

ARM queue: nothing particularly exciting, but 18 patches
is enough to send out.

thanks
-- PMM

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

----------------------------------------------------------------
Alistair Francis (5):
      xlnx-ep108: Rename to ZCU102
      xlnx-zcu102: Manually create the machines
      xlnx-zcu102: Add a machine level secure property
      xlnx-zcu102: Add a machine level virtualization property
      xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):
      AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):
      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
      target/arm: Get PRECISERR and IBUSERR the right way round
      nvic: Don't apply group priority mask to negative priorities
      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
      target/arm: Add and use defines for EXCRET constants
      target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
      mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):
      hw/pci-host/gpex: Set INTx index/gsi mapping
      hw/arm/virt: Set INTx/gsi mapping
      hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):
      target/arm: Avoid an extra temporary for store_exclusive

Use a symbolic constant M_REG_NUM_BANKS for the array size for
registers which are banked by M profile security state, rather
than hardcoding lots of 2s.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
  * accessed via env->registerfield[env->v7m.secure] (whether the security
  * extension is implemented or not).
  */
-#define M_REG_NS 0
-#define M_REG_S 1
+enum {
+    M_REG_NS = 0,
+    M_REG_S = 1,
+    M_REG_NUM_BANKS = 2,
+};
 
 /* ARM-specific interrupt pending bits.  */
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t other_sp;
         uint32_t other_ss_msp;
         uint32_t other_ss_psp;
-        uint32_t vecbase[2];
-        uint32_t basepri[2];
-        uint32_t control[2];
-        uint32_t ccr[2]; /* Configuration and Control */
-        uint32_t cfsr[2]; /* Configurable Fault Status */
+        uint32_t vecbase[M_REG_NUM_BANKS];
+        uint32_t basepri[M_REG_NUM_BANKS];
+        uint32_t control[M_REG_NUM_BANKS];
+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
-        uint32_t mmfar[2]; /* MemManage Fault Address */
+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
-        unsigned mpu_ctrl[2]; /* MPU_CTRL */
+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
-        uint32_t primask[2];
-        uint32_t faultmask[2];
+        uint32_t primask[M_REG_NUM_BANKS];
+        uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
-        uint32_t rnr[2];
+        uint32_t rnr[M_REG_NUM_BANKS];
     } pmsav7;
 
     /* PMSAv8 MPU */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          *  pmsav7.rnr (region number register)
          *  pmsav7_dregion (number of configured regions)
          */
-        uint32_t *rbar[2];
-        uint32_t *rlar[2];
-        uint32_t mair0[2];
-        uint32_t mair1[2];
+        uint32_t *rbar[M_REG_NUM_BANKS];
+        uint32_t *rlar[M_REG_NUM_BANKS];
+        uint32_t mair0[M_REG_NUM_BANKS];
+        uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
     void *nvic;
-- 
2.7.4

For M profile we must clear the exclusive monitor on reset, exception
entry and exception exit.  We weren't doing any of these things; fix
this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/cpu.c       |  6 ++++++
 target/arm/helper.c    |  2 ++
 target/arm/op_helper.c |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
 #endif
 
 /**
+ * arm_clear_exclusive: clear the exclusive monitor
+ * @env: CPU env
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+ */
+static inline void arm_clear_exclusive(CPUARMState *env)
+{
+    env->exclusive_addr = -1;
+}
+
+/**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->regs[15] = 0xFFFF0000;
     }
 
+    /* M profile requires that reset clears the exclusive monitor;
+     * A profile does not, but clearing it makes more sense than having it
+     * set with an exclusive access on address zero.
+     */
+    arm_clear_exclusive(env);
+
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 
     armv7m_nvic_acknowledge_irq(env->nvic);
     switch_v7m_sp(env, 0);
+    arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     }
 
     /* Otherwise, we have a successful exception exit. */
+    arm_clear_exclusive(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
 
     aarch64_save_sp(env, cur_el);
 
-    env->exclusive_addr = -1;
+    arm_clear_exclusive(env);
 
     /* We must squash the PSTATE.SS bit to zero unless both of the
      * following hold:
-- 
2.7.4

For a bus fault, the M profile BFSR bit PRECISERR means a bus
fault on a data access, and IBUSERR means a bus fault on an
instruction access. We had these the wrong way around; fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
-                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
-                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
                 break;
             case EXCP_DATA_ABORT:
                 env->v7m.cfsr[M_REG_NS] |=
-                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
                 env->v7m.bfar = env->exception.vaddress;
                 qemu_log_mask(CPU_LOG_INT,
-                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
                               env->v7m.bfar);
                 break;
             }
-- 
2.7.4

In several places we were unconditionally applying the
nvic_gprio_mask() to a priority value. This is incorrect
if the priority is one of the fixed negative priority
values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be
considered as the same priority and so NMI wouldn't
correctly preempt HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
         }
     }
 
+    if (active_prio > 0) {
+        active_prio &= nvic_gprio_mask(s);
+    }
+
     s->vectpending = pend_irq;
-    s->exception_prio = active_prio & nvic_gprio_mask(s);
+    s->exception_prio = active_prio;
 
     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
 }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     assert(vec->enabled);
     assert(vec->pending);
 
-    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    pendgroupprio = vec->prio;
+    if (pendgroupprio > 0) {
+        pendgroupprio &= nvic_gprio_mask(s);
+    }
     assert(pendgroupprio < running);
 
     trace_nvic_acknowledge_irq(pending, vec->prio);
-- 
2.7.4

In do_v7m_exception_exit(), there's no need to force the high 4
bits of 'type' to 1 when calling v7m_exception_taken(), because
we know that they're always 1 or we could not have got to this
"handle return to magic exception return address" code. Remove
the unnecessary ORs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

The exception-return magic values get some new bits in v8M, which
makes some bit definitions for them worthwhile.

We don't use the bit definitions for the switch on the low bits
which checks the return type for v7M, because this is defined
in the v7M ARM ARM as a set of valid values rather than via
per-bit checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 14 +++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
 
+/* Bit definitions for v7M exception return payload */
+FIELD(V7M_EXCRET, ES, 0, 1)
+FIELD(V7M_EXCRET, RES0, 1, 1)
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+FIELD(V7M_EXCRET, MODE, 3, 1)
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+FIELD(V7M_EXCRET, DCRS, 5, 1)
+FIELD(V7M_EXCRET, S, 6, 1)
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                   " previous exception %d\n",
                   type, env->v7m.exception);
 
-    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
     }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & 1;
+            int es = type & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = 0xfffffff1;
+    lr = R_V7M_EXCRET_RES1_MASK |
+        R_V7M_EXCRET_S_MASK |
+        R_V7M_EXCRET_DCRS_MASK |
+        R_V7M_EXCRET_FTYPE_MASK |
+        R_V7M_EXCRET_ES_MASK;
     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= 4;
+        lr |= R_V7M_EXCRET_SPSEL_MASK;
     }
     if (!arm_v7m_is_handler_mode(env)) {
-        lr |= 8;
+        lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-- 
2.7.4

In the v7M and v8M ARM ARM, the magic exception return values are
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
constants to define bits within them. Rename the 'type' variable
which holds the exception return value in do_v7m_exception_exit()
to excret, making it clearer that it does hold an EXC_RETURN value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t type;
+    uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
     bool return_to_sp_process = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * the target value up between env->regs[15] and env->thumb in
      * gen_bx(). Reconstitute it.
      */
-    type = env->regs[15];
+    excret = env->regs[15];
     if (env->thumb) {
-        type |= 1;
+        excret |= 1;
     }
 
     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
                   " previous exception %d\n",
-                  type, env->v7m.exception);
+                  excret, env->v7m.exception);
 
-    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
+                      excret);
     }
 
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & R_V7M_EXCRET_ES_MASK;
+            int es = excret & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
-    switch (type & 0xf) {
+    switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
         break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-     * exception return type specified then this is a UsageFault.
+     * exception return excret specified then this is a UsageFault.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
         /* Take an INVPC UsageFault by pushing the stack again. */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is a early access development board. Now that silicon is in
production people have access to the ZCU102. Let's rename the internal
QEMU files and variables to use the ZCU102.

There is no functional change here as the EP108 is still a valid board
option.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                   |  2 +-
 hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
similarity index 85%
rename from hw/arm/xlnx-ep108.c
rename to hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-ep108.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 /*
- * Xilinx ZynqMP EP108 board
+ * Xilinx ZynqMP ZCU102 board
  *
  * Copyright (C) 2015 Xilinx Inc
  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 
-typedef struct XlnxEP108 {
+typedef struct XlnxZCU102 {
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
-} XlnxEP108;
+} XlnxZCU102;
 
-static struct arm_boot_info xlnx_ep108_binfo;
+static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_ep108_init(MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
-    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
     }
 
     if (ram_size < 0x08000000) {
-        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                  ram_size);
     }
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
     /* TODO create and connect IDE devices for ide_drive_get() */
 
-    xlnx_ep108_binfo.ram_size = ram_size;
-    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
-    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
-    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
-    xlnx_ep108_binfo.loader_start = 0;
-    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
+    xlnx_zcu102_binfo.ram_size = ram_size;
+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+    xlnx_zcu102_binfo.loader_start = 0;
+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
 static void xlnx_ep108_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 static void xlnx_zcu102_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP ZCU102 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

In preperation for future work let's manually create the Xilnx machines.
This will allow us to set properties for the machines in the future.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 typedef struct XlnxZCU102 {
+    MachineState parent_obj;
+
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
 } XlnxZCU102;
 
+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+#define ZCU102_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+
+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+#define EP108_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+
 static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_zcu102_init(MachineState *machine)
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
-    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_machine_init(MachineClass *mc)
+static void xlnx_ep108_init(MachineState *machine)
+{
+    XlnxZCU102 *s = EP108_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+}
+
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_zcu102_init;
+    mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_ep108_machine_class_init,
+    .instance_init = xlnx_ep108_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
 
-static void xlnx_zcu102_machine_init(MachineClass *mc)
+static void xlnx_ep108_machine_init_register_types(void)
 {
+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+}
+
+static void xlnx_zcu102_init(MachineState *machine)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_zcu102_machine_instance_init(Object *obj)
+{
+}
+
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP ZCU102 board";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_zcu102_machine_class_init,
+    .instance_init = xlnx_zcu102_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
+
+static void xlnx_zcu102_machine_init_register_types(void)
+{
+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
+}
+
+type_init(xlnx_zcu102_machine_init_register_types)
+type_init(xlnx_ep108_machine_init_register_types)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level secure property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,secure=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
+
+    bool secure;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
 static struct arm_boot_info xlnx_zcu102_binfo;
 
+static bool zcu102_get_secure(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->secure;
+}
+
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->secure = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 
     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
                          "ddr-ram", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
 static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = EP108_MACHINE(obj);
+
+    /* EP108, we don't support setting secure */
+    s->secure = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
 
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    /* Default to secure mode being disabled */
+    s->secure = false;
+    object_property_add_bool(obj, "secure", zcu102_get_secure,
+                             zcu102_set_secure, NULL);
+    object_property_set_description(obj, "secure",
+                                    "Set on/off to enable/disable the ARM "
+                                    "Security Extensions (TrustZone)",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level virtualization property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,virtualization=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
 hw/arm/xlnx-zynqmp.c         |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
 
     /* Has the ARM Security extensions?  */
     bool secure;
+    /* Has the ARM Virtualization extensions?  */
+    bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
 }  XlnxZynqMPState;
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
     MemoryRegion ddr_ram;
 
     bool secure;
+    bool virt;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
     s->secure = value;
 }
 
+static bool zcu102_get_virt(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->virt;
+}
+
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->virt = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
                          "ddr-ram", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
                              &error_fatal);
+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = EP108_MACHINE(obj);
 
-    /* EP108, we don't support setting secure */
+    /* EP108, we don't support setting secure or virt */
     s->secure = false;
+    s->virt = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                     "Set on/off to enable/disable the ARM "
                                     "Security Extensions (TrustZone)",
                                     NULL);
+
+    /* Default to virt (EL2) being disabled */
+    s->virt = false;
+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+                             zcu102_set_virt, NULL);
+    object_property_set_description(obj, "virtualization",
+                                    "Set on/off to enable/disable emulating a "
+                                    "guest CPU which implements the ARM "
+                                    "Virtualization Extensions",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                  s->secure, "has_el3", NULL);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                 false, "has_el2", NULL);
+                                 s->virt, "has_el2", NULL);
         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-- 
2.7.4

From: Jaroslaw Pelczar <j.pelczar@samsung.com>

Previously when single stepping through ERET instruction via GDB
would result in debugger entering the "next" PC after ERET instruction.
When debugging in kernel mode, this will also cause unintended behavior,
because debugger will try to access memory from EL0 point of view.

Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         default:
             gen_a64_set_pc_im(dc->pc);
             /* fall through */
+        case DISAS_EXIT:
         case DISAS_JUMP:
             if (dc->base.singlestep_enabled) {
                 gen_exception_internal(EXCP_DEBUG);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
 }
 
 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-                                TCGv_i64 inaddr, int size, int is_pair)
+                                TCGv_i64 addr, int size, int is_pair)
 {
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      */
     TCGLabel *fail_label = gen_new_label();
     TCGLabel *done_label = gen_new_label();
-    TCGv_i64 addr = tcg_temp_local_new_i64();
     TCGv_i64 tmp;
 
-    /* Copy input into a local temp so it is not trashed when the
-     * basic block ends at the branch insn.
-     */
-    tcg_gen_mov_i64(addr, inaddr);
     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
             } else {
                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
             }
-            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
+                                       cpu_exclusive_val, tmp,
                                        get_mem_index(s),
                                        MO_64 | MO_ALIGN | s->be_data);
             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
         } else if (s->be_data == MO_LE) {
-            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         } else {
-            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         }
     } else {
-        TCGv_i64 val = cpu_reg(s, rt);
-        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
-                                   get_mem_index(s),
+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+                                   cpu_reg(s, rt), get_mem_index(s),
                                    size | MO_ALIGN | s->be_data);
         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
     }
-
-    tcg_temp_free_i64(addr);
-
     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
     tcg_temp_free_i64(tmp);
     tcg_gen_br(done_label);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/pci-host/gpex.h |  3 +++
 hw/pci-host/gpex.c         | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
     MemoryRegion io_ioport;
     MemoryRegion io_mmio;
     qemu_irq irq[GPEX_NUM_IRQS];
+    int irq_num[GPEX_NUM_IRQS];
 } GPEXHost;
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(s->irq[irq_num], level);
 }
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+    if (index >= GPEX_NUM_IRQS) {
+        return -EINVAL;
+    }
+
+    s->irq_num[index] = gsi;
+    return 0;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
     }
 
     pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/gpex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
     return 0;
 }
 
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+    PCIINTxRoute route;
+    GPEXHost *s = opaque;
+
+    route.mode = PCI_INTX_ENABLED;
+    route.irq = s->irq_num[pin];
+
+    return route;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
 
     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
     qdev_init_nofail(DEVICE(&s->gpex_root));
 }
 
-- 
2.7.4

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
             cmsdk_apb_uart_create(uartbase[i],
                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, 0),
-                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, i * 2),
+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                   NULL,
                                   uartchr, SYSCLK_FRQ);
         }
-- 
2.7.4

This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
we were using uninitialized data for the guarded bit when
combining stage 1 and stage 2 attrs.

thanks
-- PMM

The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:

Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410

for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:

target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)

----------------------------------------------------------------
target-arm: Fix bug where we weren't initializing
            guarded bit state when combining S1/S2 attrs

----------------------------------------------------------------
Richard Henderson (2):
      target/arm: PTE bit GP only applies to stage1
      target/arm: Copy guarded bit in combine_cacheattrs

target/arm/ptw.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Only perform the extract of GP during the stage1 walk.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.attrs.secure = false;
     }
 
-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-    }
-
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
+
+        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
+        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
+            result->f.guarded = extract64(attrs, 50, 1); /* GP */
+        }
     }
 
     /*
-- 
2.34.1