Series comparison

-[Qemu-devel] [PULL 0/7] target-arm queue
+[Qemu-devel] [PULL 00/25] target-arm queue
-A small set of arm bugfixes for rc0.
+Some more outstanding target-arm patches; nothing terribly
 exciting. Mostly they're mine; I'm trying to reduce the
 number of patches I still have in flight, so I've picked
 out some of the reviewed patches from a couple of sets I've
 sent out and will resend v2 versions of those sets with the
 remaining patches with fixes for issues noted in review once
 this is in master.
 thanks
 -- PMM
+The following changes since commit adaec191bfb31e12d40af8ab1b869f5b40d61ee9:
-The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:
+  Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-08-20 09:48:03 +0100)
-  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)
+are available in the Git repository at:
-are available in the git repository at:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180820
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107
+for you to fetch changes up to b85fad1588e812566f897f747e38da345a7016d6:
-for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:
+  hw/dma/pl080: Remove hw_error() if DMA is enabled (2018-08-20 11:24:33 +0100)
   hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * arm_gicv3_its: Don't abort on table save failure
+ * Fix crash on conditional instruction in an IT block
- * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+ * docs/generic-loader: mention U-Boot and Intel HEX executable formats
- * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
+ * hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset
- * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
+ * imx_serial: Generate interrupt on receive data ready if enabled
- * arm: implement cache/shareability attribute bits for PAR registers
+ * Fix various minor bugs in AArch32 Hyp related coprocessor registers
  * Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
  * Implement AArch32 ERET instruction
  * hw/arm/virt: Add virt-3.1 machine type
  * sdhci: add i.MX SD Stable Clock bit
  * Remove now-obsolete MMIO request_ptr APIs
  * hw/timer/m48t59: Move away from old_mmio accessors
  * hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module
  * nvic: Expose NMI line
  * hw/dma/pl080: cleanups and new features required for use in MPS boards
 ----------------------------------------------------------------
-Andrew Baumann (1):
+Andrew Jones (1):
-      arm: implement cache/shareability attribute bits for PAR registers
+      hw/arm/virt: Add virt-3.1 machine type
-Eric Auger (1):
+Hans-Erik Floryd (2):
-      hw/intc/arm_gicv3_its: Don't abort on table save failure
+      imx_serial: Generate interrupt on receive data ready if enabled
       sdhci: add i.MX SD Stable Clock bit
-Peter Maydell (1):
+Jia He (1):
-      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
+      hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset
-Shanker Donthineni (1):
+Peter Maydell (19):
-      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+      target/arm: Correct typo in HAMAIR1 regdef name
       target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
       target/arm: Implement AArch32 HVBAR
       target/arm: Implement AArch32 Hyp FARs
       target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
       target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
       target/arm: Implement AArch32 ERET instruction
       hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code
       memory: Remove MMIO request_ptr APIs
       hw/misc: Remove mmio_interface device
       hw/timer/m48t59: Move away from old_mmio accessors
       hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module
       nvic: Expose NMI line
       hw/dma/pl080: Allow use as embedded-struct device
       hw/dma/pl080: Support all three interrupt lines
       hw/dma/pl080: Don't use CPU address space for DMA accesses
       hw/dma/pl080: Provide device reset function
       hw/dma/pl080: Correct bug in register address decode logic
       hw/dma/pl080: Remove hw_error() if DMA is enabled
-Thomas Huth (3):
+Roman Kapl (1):
-      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
+      target/arm: Fix crash on conditional instruction in an IT block
       hw/arm: Mark the "fsl,imx25" device with user_creatable = false
       hw/arm: Mark the "fsl,imx31" device with user_creatable = false
- hw/arm/fsl-imx25.c          |   6 +-
+Stefan Hajnoczi (1):
- hw/arm/fsl-imx31.c          |   6 +-
+      docs/generic-loader: mention U-Boot and Intel HEX executable formats
  hw/arm/fsl-imx6.c           |   3 +-
  hw/intc/arm_gicv3_its_kvm.c |  12 +--
  target/arm/helper.c         | 178 ++++++++++++++++++++++++++++++++++++++++----
  target/arm/translate.c      |  39 ++++++++--
 files changed, 214 insertions(+), 30 deletions(-)
+ docs/generic-loader.txt                  |  20 +-
+ Makefile.objs                            |   1 +
+ hw/misc/Makefile.objs                    |   1 -
+ hw/watchdog/Makefile.objs                |   1 +
+ hw/sd/sdhci-internal.h                   |   2 +
+ include/exec/memory.h                    |  35 ----
+ include/hw/char/imx_serial.h             |   1 +
+ include/hw/dma/pl080.h                   |  71 +++++++
+ include/hw/misc/mmio_interface.h         |  49 -----
+ include/hw/watchdog/cmsdk-apb-watchdog.h |  59 ++++++
+ hw/arm/armv7m.c                          |   1 +
+ hw/arm/realview.c                        |   8 +-
+ hw/arm/versatilepb.c                     |   9 +-
+ hw/arm/virt.c                            |  23 ++-
+ hw/char/imx_serial.c                     |   3 +-
+ hw/dma/pl080.c                           | 113 ++++++-----
+ hw/intc/arm_gicv3_its_kvm.c              |   2 +-
+ hw/intc/armv7m_nvic.c                    |  19 ++
+ hw/misc/mmio_interface.c                 | 135 -------------
+ hw/sd/sdhci.c                            |   8 +
+ hw/ssi/xilinx_spips.c                    |  46 -----
+ hw/timer/m48t59.c                        |  59 ++----
+ hw/watchdog/cmsdk-apb-watchdog.c         | 326 +++++++++++++++++++++++++++++++
+ memory.c                                 | 110 -----------
+ target/arm/helper.c                      |  36 +++-
+ target/arm/op_helper.c                   |  22 +--
+ target/arm/translate.c                   |  76 +++++--
+ MAINTAINERS                              |   3 +
+ default-configs/arm-softmmu.mak          |   1 +
+ hw/intc/trace-events                     |   1 +
+ hw/watchdog/trace-events                 |   6 +
+files changed, 717 insertions(+), 530 deletions(-)
+ create mode 100644 include/hw/dma/pl080.h
+ delete mode 100644 include/hw/misc/mmio_interface.h
+ create mode 100644 include/hw/watchdog/cmsdk-apb-watchdog.h
+ delete mode 100644 hw/misc/mmio_interface.c
+ create mode 100644 hw/watchdog/cmsdk-apb-watchdog.c
+ create mode 100644 hw/watchdog/trace-events

-[Qemu-devel] [PULL 1/7] arm: implement cache/shareability attribute bits for PAR registers
+[Qemu-devel] [PULL 01/25] target/arm: Fix crash on conditional instruction in an IT block
-From: Andrew Baumann <Andrew.Baumann@microsoft.com>
+From: Roman Kapl <rka@sysgo.com>
-On a successful address translation instruction, PAR is supposed to
+If an instruction is conditional (like CBZ) and it is executed
-contain cacheability and shareability attributes determined by the
+conditionally (using the ITx instruction), a jump to an undefined
-translation. We previously returned 0 for these bits (in line with the
+label is generated, and QEMU crashes.
 general strategy of ignoring caches and memory attributes), but some
 guest OSes may depend on them.
-This patch collects the attribute bits in the page-table walk, and
+CBZ in IT block is an UNPREDICTABLE behavior, but we should not
-updates PAR with the correct attributes for all LPAE translations.
+crash.  Honouring the condition code is allowed by the spec in this
-Short descriptor formats still return 0 for these bits, as in the
+case (constrained unpredictable, ARMv8, section K1.1.7), and matches
-prior implementation.
+what we do for other "UNPREDICTABLE inside an IT block" instructions.
-Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Fix the 'skip on condition' code to create a new label only if it
-Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
+does not already exist.  Previously multiple labels were created, but
 only the last one of them was set.
 Signed-off-by: Roman Kapl <rka@sysgo.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180816120533.6587-1-rka@sysgo.com
 [PMM: fixed ^ 1 being applied to wrong argument, fixed typo]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ target/arm/translate.c | 35 +++++++++++++++++++++--------------
-file changed, 164 insertions(+), 14 deletions(-)
+file changed, 21 insertions(+), 14 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
- #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
+     s->base.is_jmp = DISAS_UPDATE;
  #ifndef CONFIG_USER_ONLY
 +/* Cacheability and shareability attributes for a memory access */
 +typedef struct ARMCacheAttrs {
 +    unsigned int attrs:8; /* as in the MAIR register encoding */
 +    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
 +} ARMCacheAttrs;
 +
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi);
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
 -                               ARMMMUFaultInfo *fi);
 +                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  /* Security attributes for an address, as returned by v8m_security_lookup. */
  typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
      uint64_t par64;
      MemTxAttrs attrs = {};
      ARMMMUFaultInfo fi = {};
 +    ARMCacheAttrs cacheattrs = {};
 -    ret = get_phys_addr(env, value, access_type, mmu_idx,
 -                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
 +    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
 +                        &prot, &page_size, &fsr, &fi, &cacheattrs);
      if (extended_addresses_enabled(env)) {
          /* fsr is a DFSR/IFSR value for the long descriptor
           * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
              if (!attrs.secure) {
                  par64 |= (1 << 9); /* NS */
              }
 -            /* We don't set the ATTR or SH fields in the PAR. */
 +            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
 +            par64 |= cacheattrs.shareability << 7; /* SH */
          } else {
              par64 |= 1; /* F */
              par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
          return false;
      }
      if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
 -                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
 +                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
          /* the MPU lookup failed */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          int ret;
          ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
 -                                 &txattrs, &s2prot, &s2size, fsr, fi);
 +                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
          if (ret) {
              fi->s2addr = addr;
              fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
      return true;
  }
-+/* Translate from the 4-bit stage 2 representation of
++/* Generate a label used for skipping this instruction */
-+ * memory attributes (without cache-allocation hints) to
++static void arm_gen_condlabel(DisasContext *s)
 + * the 8-bit representation of the stage 1 MAIR registers
 + * (which includes allocation hints).
 + *
 + * ref: shared/translation/attrs/S2AttrDecode()
 + *      .../S2ConvertAttrsHints()
 + */
 +static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
 +{
-+    uint8_t hiattr = extract32(s2attrs, 2, 2);
++    if (!s->condjmp) {
-+    uint8_t loattr = extract32(s2attrs, 0, 2);
++        s->condlabel = gen_new_label();
-+    uint8_t hihint = 0, lohint = 0;
++        s->condjmp = 1;
 +
 +    if (hiattr != 0) { /* normal memory */
 +        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
 +            hiattr = loattr = 1; /* non-cacheable */
 +        } else {
 +            if (hiattr != 1) { /* Write-through or write-back */
 +                hihint = 3; /* RW allocate */
 +            }
 +            if (loattr != 1) { /* Write-through or write-back */
 +                lohint = 3; /* RW allocate */
 +            }
 +        }
 +    }
 +
 +    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
 +}
 +
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
 -                               ARMMMUFaultInfo *fi)
 +                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
  {
      ARMCPU *cpu = arm_env_get_cpu(env);
      CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
           */
          txattrs->secure = false;
      }
 +
 +    if (cacheattrs != NULL) {
 +        if (mmu_idx == ARMMMUIdx_S2NS) {
 +            cacheattrs->attrs = convert_stage2_attrs(env,
 +                                                     extract32(attrs, 0, 4));
 +        } else {
 +            /* Index into MAIR registers for cache attributes */
 +            uint8_t attrindx = extract32(attrs, 0, 3);
 +            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
 +            assert(attrindx <= 7);
 +            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
 +        }
 +        cacheattrs->shareability = extract32(attrs, 6, 2);
 +    }
 +
      *phys_ptr = descaddr;
      *page_size_ptr = page_size;
      return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
      return false;
  }
 +/* Combine either inner or outer cacheability attributes for normal
 + * memory, according to table D4-42 and pseudocode procedure
 + * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
 + *
 + * NB: only stage 1 includes allocation hints (RW bits), leading to
 + * some asymmetry.
 + */
 +static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
 +{
 +    if (s1 == 4 || s2 == 4) {
 +        /* non-cacheable has precedence */
 +        return 4;
 +    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
 +        /* stage 1 write-through takes precedence */
 +        return s1;
 +    } else if (extract32(s2, 2, 2) == 2) {
 +        /* stage 2 write-through takes precedence, but the allocation hint
 +         * is still taken from stage 1
 +         */
 +        return (2 << 2) | extract32(s1, 0, 2);
 +    } else { /* write-back */
 +        return s1;
 +    }
 +}
 +
-+/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
++/* Skip this instruction if the ARM condition is false */
-+ * and CombineS1S2Desc()
++static void arm_skip_unless(DisasContext *s, uint32_t cond)
 + *
 + * @s1:      Attributes from stage 1 walk
 + * @s2:      Attributes from stage 2 walk
 + */
 +static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
 +{
-+    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
++    arm_gen_condlabel(s);
-+    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
++    arm_gen_test_cc(cond ^ 1, s->condlabel);
 +    ARMCacheAttrs ret;
 +
 +    /* Combine shareability attributes (table D4-43) */
 +    if (s1.shareability == 2 || s2.shareability == 2) {
 +        /* if either are outer-shareable, the result is outer-shareable */
 +        ret.shareability = 2;
 +    } else if (s1.shareability == 3 || s2.shareability == 3) {
 +        /* if either are inner-shareable, the result is inner-shareable */
 +        ret.shareability = 3;
 +    } else {
 +        /* both non-shareable */
 +        ret.shareability = 0;
 +    }
 +
 +    /* Combine memory type and cacheability attributes */
 +    if (s1hi == 0 || s2hi == 0) {
 +        /* Device has precedence over normal */
 +        if (s1lo == 0 || s2lo == 0) {
 +            /* nGnRnE has precedence over anything */
 +            ret.attrs = 0;
 +        } else if (s1lo == 4 || s2lo == 4) {
 +            /* non-Reordering has precedence over Reordering */
 +            ret.attrs = 4;  /* nGnRE */
 +        } else if (s1lo == 8 || s2lo == 8) {
 +            /* non-Gathering has precedence over Gathering */
 +            ret.attrs = 8;  /* nGRE */
 +        } else {
 +            ret.attrs = 0xc; /* GRE */
 +        }
 +
 +        /* Any location for which the resultant memory type is any
 +         * type of Device memory is always treated as Outer Shareable.
 +         */
 +        ret.shareability = 2;
 +    } else { /* Normal memory */
 +        /* Outer/inner cacheability combine independently */
 +        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
 +                  | combine_cacheattr_nibble(s1lo, s2lo);
 +
 +        if (ret.attrs == 0x44) {
 +            /* Any location for which the resultant memory type is Normal
 +             * Inner Non-cacheable, Outer Non-cacheable is always treated
 +             * as Outer Shareable.
 +             */
 +            ret.shareability = 2;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
-+
+ static void disas_arm_insn(DisasContext *s, unsigned int insn)
  /* get_phys_addr - get the physical address for this virtual address
   *
   * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
   * @prot: set to the permissions for the page containing phys_ptr
   * @page_size: set to the size of the page containing phys_ptr
   * @fsr: set to the DFSR/IFSR value on failure
 + * @fi: set to fault info if the translation fails
 + * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
   */
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi)
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
  {
-     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
+     unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;
-         /* Call ourselves recursively to do the stage 1 and then stage 2
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+     if (cond != 0xe) {
-             hwaddr ipa;
+         /* if not always execute, we generate a conditional jump to
-             int s2_prot;
+            next instruction */
-             int ret;
+-        s->condlabel = gen_new_label();
-+            ARMCacheAttrs cacheattrs2 = {};
+-        arm_gen_test_cc(cond ^ 1, s->condlabel);
+-        s->condjmp = 1;
-             ret = get_phys_addr(env, address, access_type,
++        arm_skip_unless(s, cond);
-                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
+     }
--                                prot, page_size, fsr, fi);
+     if ((insn & 0x0f900000) == 0x03000000) {
-+                                prot, page_size, fsr, fi, cacheattrs);
+         if ((insn & (1 << 21)) == 0) {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-             /* If S1 fails or S2 is disabled, return early.  */
+                 /* Conditional branch.  */
-             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
+                 op = (insn >> 22) & 0xf;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+                 /* Generate a conditional jump to next instruction.  */
-             /* S1 is done. Now do S2 translation.  */
+-                s->condlabel = gen_new_label();
-             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
+-                arm_gen_test_cc(op ^ 1, s->condlabel);
-                                      phys_ptr, attrs, &s2_prot,
+-                s->condjmp = 1;
--                                     page_size, fsr, fi);
++                arm_skip_unless(s, op);
-+                                     page_size, fsr, fi,
-+                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
+                 /* offset[11:1] = insn[10:0] */
-             fi->s2addr = ipa;
+                 offset = (insn & 0x7ff) << 1;
-             /* Combine the S1 and S2 perms.  */
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-             *prot &= s2_prot;
+         case 1: case 3: case 9: case 11: /* czb */
-+
+             rm = insn & 7;
-+            /* Combine the S1 and S2 cache attributes, if needed */
+             tmp = load_reg(s, rm);
-+            if (!ret && cacheattrs != NULL) {
+-            s->condlabel = gen_new_label();
-+                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+-            s->condjmp = 1;
-+            }
++            arm_gen_condlabel(s);
-+
+             if (insn & (1 << 11))
-             return ret;
+                 tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
-         } else {
+             else
-             /*
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+             break;
+         }
-     if (regime_using_lpae_format(env, mmu_idx)) {
+         /* generate a conditional jump to next instruction */
-         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
+-        s->condlabel = gen_new_label();
--                                  attrs, prot, page_size, fsr, fi);
+-        arm_gen_test_cc(cond ^ 1, s->condlabel);
-+                                  attrs, prot, page_size, fsr, fi, cacheattrs);
+-        s->condjmp = 1;
-     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
++        arm_skip_unless(s, cond);
-         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
-                                 attrs, prot, page_size, fsr, fi);
+         /* jump to the offset */
-@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
+         val = (uint32_t)s->pc + 2;
+@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-     ret = get_phys_addr(env, address, access_type,
+         uint32_t cond = dc->condexec_cond;
-                         core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
--                        &attrs, &prot, &page_size, fsr, fi);
+         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
-+                        &attrs, &prot, &page_size, fsr, fi, NULL);
+-            dc->condlabel = gen_new_label();
-     if (!ret) {
+-            arm_gen_test_cc(cond ^ 1, dc->condlabel);
-         /* Map a single [sub]page.  */
+-            dc->condjmp = 1;
-         phys_addr &= TARGET_PAGE_MASK;
++            arm_skip_unless(dc, cond);
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
+         }
-     *attrs = (MemTxAttrs) {};
+     }
      ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
 -                        attrs, &prot, &page_size, &fsr, &fi);
 +                        attrs, &prot, &page_size, &fsr, &fi, NULL);
      if (ret) {
          return -1;
 --
-.7.4
+.18.0

-[Qemu-devel] [PULL 6/7] hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+[Qemu-devel] [PULL 02/25] docs/generic-loader: mention U-Boot and Intel HEX executable formats
-From: Shanker Donthineni <shankerd@codeaurora.org>
+From: Stefan Hajnoczi <stefanha@redhat.com>
-The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
+The generic loader device supports the U-Boot and Intel HEX executable
-/restore") breaks the backward compatibility with the older kernels
+formats in addition to the document raw and ELF formats.  Reword the
-where vITS save/restore support is not available. The vmstate function
+documentation to include these formats and explain how various options
-vm_change_state_handler() should not be registered if the running kernel
+depend on the executable format.
 doesn't support ITS save/restore feature. Otherwise VM instance will be
 killed whenever vmstate callback function is invoked.
-Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20180816145554.9814-1-stefanha@redhat.com
-KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_its_kvm.c | 4 ++--
+ docs/generic-loader.txt | 20 ++++++++++----------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 10 insertions(+), 10 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
+diff --git a/docs/generic-loader.txt b/docs/generic-loader.txt
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
+--- a/docs/generic-loader.txt
-+++ b/hw/intc/arm_gicv3_its_kvm.c
++++ b/docs/generic-loader.txt
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ An example of setting CPU 0's PC to 0x8000 is:
-             error_free(s->migration_blocker);
-             return;
+ Loading Files
-         }
+ -------------
-+    } else {
+-The loader device also allows files to be loaded into memory. It can load raw
-+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+-files and ELF executable files.  Raw files are loaded verbatim.  ELF executable
-     }
+-files are loaded by an ELF loader.  The syntax is shown below:
++The loader device also allows files to be loaded into memory. It can load ELF,
-     kvm_msi_use_devid = true;
++U-Boot, and Intel HEX executable formats as well as raw images.  The syntax is
-     kvm_gsi_direct_mapping = false;
++shown below:
-     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
--
+     -device loader,file=<file>[,addr=<addr>][,cpu-num=<cpu-num>][,force-raw=<raw>]
--    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
- }
+     <file>      - A file to be loaded into memory
+-    <addr>      - The addr in memory that the file should be loaded. This is
- /**
+-                  ignored if you are using an ELF (unless force-raw is true).
 -                  This is required if you aren't loading an ELF.
 +    <addr>      - The memory address where the file should be loaded. This is
 +                  required for raw images and ignored for non-raw files.
      <cpu-num>   - This specifies the CPU that should be used. This is an
                    optional argument and will cause the CPU's PC to be set to
 -                  where the image is stored or in the case of an ELF file to
 -                  the value in the header. This option should only be used
 -                  for the boot image.
 +                  the memory address where the raw file is loaded or the entry
 +                  point specified in the executable format header. This option
 +                  should only be used for the boot image.
                    This will also cause the image to be written to the specified
                    CPU's address space. If not specified, the default is CPU 0.
      <force-raw> - Setting force-raw=on forces the file to be treated as a raw
 -                  image.  This can be used to load ELF files as if they were raw.
 +                  image.  This can be used to load supported executable formats
 +                  as if they were raw.
  All values are parsed using the standard QemuOps parsing. This allows the user
  to specify any values in any format supported. By default the values
 --
-.7.4
+.18.0

-[Qemu-devel] [PULL 7/7] hw/intc/arm_gicv3_its: Don't abort on table save failure
+[Qemu-devel] [PULL 03/25] hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset
-From: Eric Auger <eric.auger@redhat.com>
+From: Jia He <hejianet@gmail.com>
-The ITS is not fully properly reset at the moment. Caches are
+In scripts/arch-run.bash of kvm-unit-tests, it will check the qemu
-not emptied.
+output log with:
 if [ -z "$(echo "$errors" | grep -vi warning)" ]; then
-After a reset, in case we attempt to save the state before
+Thus without the warning prefix, all of the test fail.
 the bound devices have registered their MSIs and after the
 st level table has been allocated by the ITS driver
 (device BASER is valid), the first level entries are still
 invalid. If the device cache is not empty (devices registered
 before the reset), vgic_its_save_device_tables fails with -EINVAL.
 This causes a QEMU abort().
-Cc: qemu-stable@nongnu.org
+Since it is not unrecoverable error in kvm_arm_its_reset for
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+current implementation, downgrading the report from error to
-Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
+warn makes sense.
 Signed-off-by: Jia He <jia.he@hxt-semitech.com>
 Message-id: 1531969910-32843-1-git-send-email-jia.he@hxt-semitech.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_its_kvm.c | 8 ++------
+ hw/intc/arm_gicv3_its_kvm.c | 2 +-
-file changed, 2 insertions(+), 6 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_reset(DeviceState *dev)
  {
      GICv3ITSState *s = (GICv3ITSState *)opaque;
      Error *err = NULL;
 -    int ret;
      if (running) {
          return;
      }
--    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+-    error_report("ITS KVM: full reset is not supported by the host kernel");
--                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
++    warn_report("ITS KVM: full reset is not supported by the host kernel");
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-+                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+     if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
-     if (err) {
+                                GITS_CTLR)) {
          error_report_err(err);
      }
 -    if (ret < 0 && ret != -EFAULT) {
 -        abort();
 -    }
  }
  static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
 --
-.7.4
+.18.0

-New patch
+[Qemu-devel] [PULL 04/25] imx_serial: Generate interrupt on receive data ready if enabled
+From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
+Generate an interrupt if USR2_RDR and UCR4_DREN are both set.
+Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
+Message-id: 1534341354-11956-1-git-send-email-hans-erik.floryd@rt-labs.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/imx_serial.h | 1 +
+ hw/char/imx_serial.c         | 3 ++-
+files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/imx_serial.h
++++ b/include/hw/char/imx_serial.h
+@@ -XXX,XX +XXX,XX @@
+ #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+ #define UCR2_SRST       (1<<0)    /* Reset complete */
++#define UCR4_DREN       BIT(0)    /* Receive Data Ready interrupt enable */
+ #define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+ #define UTS1_TXEMPTY    (1<<6)
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
+     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+     /*
+      * TCEN and TXDC are both bit 3
++     * RDR and DREN are both bit 0
+      */
+-    mask |= s->ucr4 & UCR4_TCEN;
++    mask |= s->ucr4 & (UCR4_TCEN | UCR4_DREN);
+     usr2 = s->usr2 & mask;
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 05/25] target/arm: Correct typo in HAMAIR1 regdef name
+We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
+regdef, though, and were incorrectly naming it HMAIR1 (which is
+a different register which we also implement as RAZ/WI).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-2-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+-    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
++    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
+       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
+-    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
++    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
+       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 06/25] target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
+ARMCPRegInfo structs will default to .cp = 15 if they
+are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
+(because a coprocessor number of 0 is valid for AArch32).
+We forgot to explicitly set .cp = 15 for the HMAIR1 and
+HAMAIR1 regdefs, which meant they would UNDEF when the guest
+tried to access them under cp15.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-3-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
+-      .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
++      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
+-      .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
++      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
+       .resetvalue = 0 },
+     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
+-      .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
++      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_ALIAS,
+       .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
+     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .resetvalue = 0 },
+     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
+     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
+-      .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
++      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+       .access = PL2_RW, .type = ARM_CP_CONST,
+       .resetvalue = 0 },
+     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 07/25] target/arm: Implement AArch32 HVBAR
+Implement the AArch32 HVBAR register; we can do this just by
+making the existing VBAR_EL2 regdefs be STATE_BOTH.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-5-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
+ /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
+ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+-    { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
++    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
+       .access = PL2_RW,
+       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
+       .access = PL2_RW,
+       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
+-    { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
++    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
+       .access = PL2_RW, .writefn = vbar_write,
+       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 08/25] target/arm: Implement AArch32 Hyp FARs
+The AArch32 virtualization extensions support these fault address
+registers:
+ * HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
+ * HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)
+Implement the accessors for these. This fixes in passing a bug
+where we weren't implementing the "RES0 from EL3 if EL2 not
+implemented" behaviour for AArch64 FAR_EL2.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-7-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 14 +++++++++++++-
+file changed, 13 insertions(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+     { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
+       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
++    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
++      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
++    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
++      .type = ARM_CP_CONST,
++      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
++      .access = PL2_RW, .resetvalue = 0 },
+     REGINFO_SENTINEL
+ };
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+     { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
+-    { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
++    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
++    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
++      .type = ARM_CP_ALIAS,
++      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
++      .access = PL2_RW,
++      .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
+     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
+       .type = ARM_CP_ALIAS,
+       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 09/25] target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
+The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
+we can implement it by marking our existing ESR_EL2 regdef
+as STATE_BOTH. It also needs to be "RES0 from EL3 if
+EL2 not implemented", so add the missing stanza to
+el3_no_el2_cp_reginfo.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-8-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 6 +++++-
+file changed, 5 insertions(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL2_RW,
+       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
++    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
++      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
++      .access = PL2_RW,
++      .type = ARM_CP_CONST, .resetvalue = 0 },
+     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
+       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
+       .access = PL2_RW,
+       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
+-    { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
++    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
+     { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 10/25] target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
+The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp
+from either Monitor or Hyp mode. Our translate time check
+was overly strict and only permitted access from Monitor mode.
+The runtime check we do in msr_mrs_banked_exc_checks() had the
+correct code in it, but never got there because of the earlier
+"currmode == tgtmode" check. Special case ELR_Hyp.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20180814124254.5229-9-peter.maydell@linaro.org
+---
+ target/arm/op_helper.c | 22 +++++++++++-----------
+ target/arm/translate.c | 10 +++++++---
+files changed, 18 insertions(+), 14 deletions(-)
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
+      */
+     int curmode = env->uncached_cpsr & CPSR_M;
++    if (regno == 17) {
++        /* ELR_Hyp: a special case because access from tgtmode is OK */
++        if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
++            goto undef;
++        }
++        return;
++    }
++
+     if (curmode == tgtmode) {
+         goto undef;
+     }
+@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
+     }
+     if (tgtmode == ARM_CPU_MODE_HYP) {
+-        switch (regno) {
+-        case 17: /* ELR_Hyp */
+-            if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
+-                goto undef;
+-            }
+-            break;
+-        default:
+-            if (curmode != ARM_CPU_MODE_MON) {
+-                goto undef;
+-            }
+-            break;
++        /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */
++        if (curmode != ARM_CPU_MODE_MON) {
++            goto undef;
+         }
+     }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
+         }
+         break;
+     case ARM_CPU_MODE_HYP:
+-        /* Note that we can forbid accesses from EL2 here because they
+-         * must be from Hyp mode itself
++        /*
++         * SPSR_hyp and r13_hyp can only be accessed from Monitor mode
++         * (and so we can forbid accesses from EL2 or below). elr_hyp
++         * can be accessed also from Hyp mode, so forbid accesses from
++         * EL0 or EL1.
+          */
+-        if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 3) {
++        if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 2 ||
++            (s->current_el < 3 && *regno != 17)) {
+             goto undef;
+         }
+         break;
+--
+.18.0

-[Qemu-devel] [PULL 5/7] translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
+[Qemu-devel] [PULL 11/25] target/arm: Implement AArch32 ERET instruction
-For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
+ARMv7VE introduced the ERET instruction, which is necessary to
-lowest address is always Rt and the one at addr+4 is Rt2, even if the
+return from an exception taken to Hyp mode. Implement this.
-CPU is big-endian. Our implementation does these with a single
+In A32 encoding it is a completely new encoding; in T32 it
--bit store, so if we're big-endian then we need to put the two
+is an adjustment of the behaviour of the existing
--bit halves together in the opposite order to little-endian,
+"SUBS PC, LR, #<imm8>" instruction.
 so that they end up in the right places. We were trying to do
 this with the gen_aa32_frob64() function, but that is not correct
 for the usermode emulator, because there there is a distinction
 between "load a 64 bit value" (which does a BE 64-bit access
 and doesn't need swapping) and "load two 32 bit values as one
 bit access" (where we still need to do the swapping, like
 system mode BE32).
-Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
-Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Message-id: 20180814124254.5229-10-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
+ target/arm/translate.c | 31 +++++++++++++++++++++++++++++--
-file changed, 34 insertions(+), 5 deletions(-)
+file changed, 29 insertions(+), 2 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-         TCGv_i32 tmp2 = tcg_temp_new_i32();
+             tcg_temp_free_i32(tmp2);
-         TCGv_i64 t64 = tcg_temp_new_i64();
+             store_reg(s, rd, tmp);
+             break;
--        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
++        case 0x6: /* ERET */
-+        /* For AArch32, architecturally the 32-bit word at the lowest
++            if (op1 != 3) {
-+         * address is always Rt and the one at addr+4 is Rt2, even if
++                goto illegal_op;
-+         * the CPU is big-endian. That means we don't want to do a
++            }
-+         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
++            if (!arm_dc_feature(s, ARM_FEATURE_V7VE)) {
-+         * for an architecturally 64-bit access, but instead do a
++                goto illegal_op;
-+         * 64-bit access using MO_BE if appropriate and then split
++            }
-+         * the two halves.
++            if ((insn & 0x000fff0f) != 0x0000000e) {
-+         * This only makes a difference for BE32 user-mode, where
++                /* UNPREDICTABLE; we choose to UNDEF */
-+         * frob64() must not flip the two halves of the 64-bit data
++                goto illegal_op;
-+         * but this code must treat BE32 user-mode like BE32 system.
++            }
 +         */
 +        TCGv taddr = gen_aa32_addr(s, addr, opc);
 +
-+        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
++            if (s->current_el == 2) {
-+        tcg_temp_free(taddr);
++                tmp = load_cpu_field(elr_el[2]);
-         tcg_gen_mov_i64(cpu_exclusive_val, t64);
++            } else {
--        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
++                tmp = load_reg(s, 14);
-+        if (s->be_data == MO_BE) {
++            }
-+            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
++            gen_exception_return(s, tmp);
-+        } else {
++            break;
-+            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+         case 7:
-+        }
+         {
-         tcg_temp_free_i64(t64);
+             int imm16 = extract32(insn, 0, 4) | (extract32(insn, 8, 12) << 4);
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-         store_reg(s, rt2, tmp2);
+                         if (rn != 14 || rd != 15) {
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
+                             goto illegal_op;
-         TCGv_i64 n64 = tcg_temp_new_i64();
+                         }
+-                        tmp = load_reg(s, rn);
-         t2 = load_reg(s, rt2);
+-                        tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
--        tcg_gen_concat_i32_i64(n64, t1, t2);
++                        if (s->current_el == 2) {
-+        /* For AArch32, architecturally the 32-bit word at the lowest
++                            /* ERET from Hyp uses ELR_Hyp, not LR */
-+         * address is always Rt and the one at addr+4 is Rt2, even if
++                            if (insn & 0xff) {
-+         * the CPU is big-endian. Since we're going to treat this as a
++                                goto illegal_op;
-+         * single 64-bit BE store, we need to put the two halves in the
++                            }
-+         * opposite order for BE to LE, so that they end up in the right
++                            tmp = load_cpu_field(elr_el[2]);
-+         * places.
++                        } else {
-+         * We don't want gen_aa32_frob64() because that does the wrong
++                            tmp = load_reg(s, rn);
-+         * thing for BE32 usermode.
++                            tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
-+         */
++                        }
-+        if (s->be_data == MO_BE) {
+                         gen_exception_return(s, tmp);
-+            tcg_gen_concat_i32_i64(n64, t2, t1);
+                         break;
-+        } else {
+                     case 6: /* MRS */
 +            tcg_gen_concat_i32_i64(n64, t1, t2);
 +        }
          tcg_temp_free_i32(t2);
 -        gen_aa32_frob64(s, n64);
          tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
                                     get_mem_index(s), opc);
          tcg_temp_free_i64(n64);
 -        gen_aa32_frob64(s, o64);
          tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
          tcg_gen_extrl_i64_i32(t0, o64);
 --
-.7.4
+.18.0

-[Qemu-devel] [PULL 4/7] hw/arm: Mark the "fsl, imx31" device with user_creatable = false
+[Qemu-devel] [PULL 12/25] hw/arm/virt: Add virt-3.1 machine type
-From: Thomas Huth <thuth@redhat.com>
+From: Andrew Jones <drjones@redhat.com>
-QEMU currently crashes when the user tries to instantiate the fsl,imx31
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-device manually:
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 $ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
 **
 ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
  assertion failed: (n < max_cpus)
 Aborted (core dumped)
 The kzm board (which is the one that uses this CPU type) only supports
 one CPU, and the realize function of the "fsl,imx31" device also uses
 serial_hds[] directly, so this device clearly can not be instantiated
 twice and thus we should mark it with user_creatable = false.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/fsl-imx31.c | 6 +++++-
+ hw/arm/virt.c | 23 +++++++++++++++++------
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 17 insertions(+), 6 deletions(-)
-diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx31.c
+--- a/hw/arm/virt.c
-+++ b/hw/arm/fsl-imx31.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+ }
+ type_init(machvirt_machine_init);
-     dc->realize = fsl_imx31_realize;
 -#define VIRT_COMPAT_2_12 \
 -    HW_COMPAT_2_12
 -
-     dc->desc = "i.MX31 SOC";
+-static void virt_3_0_instance_init(Object *obj)
-+    /*
++static void virt_3_1_instance_init(Object *obj)
-+     * Reason: uses serial_hds in realize and the kzm board does not
+ {
-+     * support multiple CPUs
+     VirtMachineState *vms = VIRT_MACHINE(obj);
-+     */
+     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
-+    dc->user_creatable = false;
+@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
      vms->irqmap = a15irqmap;
  }
- static const TypeInfo fsl_imx31_type_info = {
+-static void virt_machine_3_0_options(MachineClass *mc)
 +static void virt_machine_3_1_options(MachineClass *mc)
  {
  }
 -DEFINE_VIRT_MACHINE_AS_LATEST(3, 0)
 +DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
 +
 +static void virt_3_0_instance_init(Object *obj)
 +{
 +    virt_3_1_instance_init(obj);
 +}
 +
 +static void virt_machine_3_0_options(MachineClass *mc)
 +{
 +    virt_machine_3_1_options(mc);
 +}
 +DEFINE_VIRT_MACHINE(3, 0)
 +
 +#define VIRT_COMPAT_2_12 \
 +    HW_COMPAT_2_12
  static void virt_2_12_instance_init(Object *obj)
  {
 --
-.7.4
+.18.0

-[Qemu-devel] [PULL 3/7] hw/arm: Mark the "fsl, imx25" device with user_creatable = false
+[Qemu-devel] [PULL 13/25] sdhci: add i.MX SD Stable Clock bit
-From: Thomas Huth <thuth@redhat.com>
+From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
-QEMU currently crashes when the user tries to instantiate the fsl,imx25
+Add the ESDHC PRSSTAT_SDSTB bit, using the value of SDHC_CLOCK_INT_STABLE.
-device manually:
+Freescale recommends checking this bit when changing clock frequency.
-$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
+Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
-**
+Message-id: 1534507843-4251-1-git-send-email-hans-erik.floryd@rt-labs.com
-ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
+[PMM: fixed indentation]
  assertion failed: (n < max_cpus)
 The imx25-pdk board (which is the one that uses this CPU type) only
 supports one CPU, and the realize function of the "fsl,imx25" device
 also uses serial_hds[] directly, so this device clearly can not be
 instantiated twice and thus we should mark it with user_creatable = 0.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/fsl-imx25.c | 6 +++++-
+ hw/sd/sdhci-internal.h | 2 ++
-file changed, 5 insertions(+), 1 deletion(-)
+ hw/sd/sdhci.c          | 8 ++++++++
 files changed, 10 insertions(+)
-diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
+diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx25.c
+--- a/hw/sd/sdhci-internal.h
-+++ b/hw/arm/fsl-imx25.c
++++ b/hw/sd/sdhci-internal.h
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription sdhci_vmstate;
-     DeviceClass *dc = DEVICE_CLASS(oc);
+ #define ESDHC_CTRL_4BITBUS              (0x1 << 1)
+ #define ESDHC_CTRL_8BITBUS              (0x2 << 1)
-     dc->realize = fsl_imx25_realize;
--
++#define ESDHC_PRNSTS_SDSTB              (1 << 3)
-     dc->desc = "i.MX25 SOC";
++
-+    /*
+ #endif
-+     * Reason: uses serial_hds in realize and the imx25 board does not
+diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-+     * support multiple CPUs
+index XXXXXXX..XXXXXXX 100644
-+     */
+--- a/hw/sd/sdhci.c
-+    dc->user_creatable = false;
++++ b/hw/sd/sdhci.c
- }
+@@ -XXX,XX +XXX,XX @@ static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)
- static const TypeInfo fsl_imx25_type_info = {
+         break;
 +    case SDHC_PRNSTS:
 +        /* Add SDSTB (SD Clock Stable) bit to PRNSTS */
 +        ret = sdhci_read(opaque, offset, size) & ~ESDHC_PRNSTS_SDSTB;
 +        if (s->clkcon & SDHC_CLOCK_INT_STABLE) {
 +            ret |= ESDHC_PRNSTS_SDSTB;
 +        }
 +        break;
 +
      case ESDHC_DLL_CTRL:
      case ESDHC_TUNE_CTRL_STATUS:
      case ESDHC_UNDOCUMENTED_REG27:
 --
-.7.4
+.18.0

-New patch
+[Qemu-devel] [PULL 14/25] hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code
+We now support direct execution from MMIO regions in the
+core memory subsystem. This means that we don't need to
+have device-specific support for it, and we can remove
+the request_ptr handling from the Xilinx SPIPS device.
+(It was broken anyway due to race conditions, and disabled
+by default.)
+This device is the only in-tree user of this API.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
+Message-id: 20180817114619.22354-2-peter.maydell@linaro.org
+---
+ hw/ssi/xilinx_spips.c | 46 -------------------------------------------
+file changed, 46 deletions(-)
+diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/xilinx_spips.c
++++ b/hw/ssi/xilinx_spips.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps spips_ops = {
+ static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
+ {
+-    XilinxSPIPS *s = &q->parent_obj;
+-
+-    if ((q->mmio_execution_enabled) && (q->lqspi_cached_addr != ~0ULL)) {
+-        /* Invalidate the current mapped mmio */
+-        memory_region_invalidate_mmio_ptr(&s->mmlqspi, q->lqspi_cached_addr,
+-                                          LQSPI_CACHE_SIZE);
+-    }
+-
+     q->lqspi_cached_addr = ~0ULL;
+ }
+@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
+     }
+ }
+-static void *lqspi_request_mmio_ptr(void *opaque, hwaddr addr, unsigned *size,
+-                                    unsigned *offset)
+-{
+-    XilinxQSPIPS *q = opaque;
+-    hwaddr offset_within_the_region;
+-
+-    if (!q->mmio_execution_enabled) {
+-        return NULL;
+-    }
+-
+-    offset_within_the_region = addr & ~(LQSPI_CACHE_SIZE - 1);
+-    lqspi_load_cache(opaque, offset_within_the_region);
+-    *size = LQSPI_CACHE_SIZE;
+-    *offset = offset_within_the_region;
+-    return q->lqspi_buf;
+-}
+-
+ static uint64_t
+ lqspi_read(void *opaque, hwaddr addr, unsigned int size)
+ {
+@@ -XXX,XX +XXX,XX @@ lqspi_read(void *opaque, hwaddr addr, unsigned int size)
+ static const MemoryRegionOps lqspi_ops = {
+     .read = lqspi_read,
+-    .request_ptr = lqspi_request_mmio_ptr,
+     .endianness = DEVICE_NATIVE_ENDIAN,
+     .valid = {
+         .min_access_size = 1,
+@@ -XXX,XX +XXX,XX @@ static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
+     sysbus_init_mmio(sbd, &s->mmlqspi);
+     q->lqspi_cached_addr = ~0ULL;
+-
+-    /* mmio_execution breaks migration better aborting than having strange
+-     * bugs.
+-     */
+-    if (q->mmio_execution_enabled) {
+-        error_setg(&q->migration_blocker,
+-                   "enabling mmio_execution breaks migration");
+-        migrate_add_blocker(q->migration_blocker, &error_fatal);
+-    }
+ }
+ static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static Property xilinx_zynqmp_qspips_properties[] = {
+     DEFINE_PROP_END_OF_LIST(),
+ };
+-static Property xilinx_qspips_properties[] = {
+-    /* We had to turn this off for 2.10 as it is not compatible with migration.
+-     * It can be enabled but will prevent the device to be migrated.
+-     * This will go aways when a fix will be released.
+-     */
+-    DEFINE_PROP_BOOL("x-mmio-exec", XilinxQSPIPS, mmio_execution_enabled,
+-                     false),
+-    DEFINE_PROP_END_OF_LIST(),
+-};
+-
+ static Property xilinx_spips_properties[] = {
+     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
+     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
+@@ -XXX,XX +XXX,XX @@ static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
+     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
+     dc->realize = xilinx_qspips_realize;
+-    dc->props = xilinx_qspips_properties;
+     xsc->reg_ops = &qspips_ops;
+     xsc->rx_fifo_size = RXFF_A_Q;
+     xsc->tx_fifo_size = TXFF_A_Q;
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 15/25] memory: Remove MMIO request_ptr APIs
+Remove the obsolete MMIO request_ptr APIs; they have no
+users now.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
+Message-id: 20180817114619.22354-3-peter.maydell@linaro.org
+---
+ include/exec/memory.h |  35 --------------
+ memory.c              | 110 ------------------------------------------
+files changed, 145 deletions(-)
+diff --git a/include/exec/memory.h b/include/exec/memory.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/memory.h
++++ b/include/exec/memory.h
+@@ -XXX,XX +XXX,XX @@ struct MemoryRegionOps {
+                                     uint64_t data,
+                                     unsigned size,
+                                     MemTxAttrs attrs);
+-    /* Instruction execution pre-callback:
+-     * @addr is the address of the access relative to the @mr.
+-     * @size is the size of the area returned by the callback.
+-     * @offset is the location of the pointer inside @mr.
+-     *
+-     * Returns a pointer to a location which contains guest code.
+-     */
+-    void *(*request_ptr)(void *opaque, hwaddr addr, unsigned *size,
+-                         unsigned *offset);
+     enum device_endian endianness;
+     /* Guest-visible constraints: */
+@@ -XXX,XX +XXX,XX @@ void memory_global_dirty_log_stop(void);
+ void mtree_info(fprintf_function mon_printf, void *f, bool flatview,
+                 bool dispatch_tree, bool owner);
+-/**
+- * memory_region_request_mmio_ptr: request a pointer to an mmio
+- * MemoryRegion. If it is possible map a RAM MemoryRegion with this pointer.
+- * When the device wants to invalidate the pointer it will call
+- * memory_region_invalidate_mmio_ptr.
+- *
+- * @mr: #MemoryRegion to check
+- * @addr: address within that region
+- *
+- * Returns true on success, false otherwise.
+- */
+-bool memory_region_request_mmio_ptr(MemoryRegion *mr, hwaddr addr);
+-
+-/**
+- * memory_region_invalidate_mmio_ptr: invalidate the pointer to an mmio
+- * previously requested.
+- * In the end that means that if something wants to execute from this area it
+- * will need to request the pointer again.
+- *
+- * @mr: #MemoryRegion associated to the pointer.
+- * @offset: offset within the memory region
+- * @size: size of that area.
+- */
+-void memory_region_invalidate_mmio_ptr(MemoryRegion *mr, hwaddr offset,
+-                                       unsigned size);
+-
+ /**
+  * memory_region_dispatch_read: perform a read directly to the specified
+  * MemoryRegion.
+diff --git a/memory.c b/memory.c
+index XXXXXXX..XXXXXXX 100644
+--- a/memory.c
++++ b/memory.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/ram_addr.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/sysemu.h"
+-#include "hw/misc/mmio_interface.h"
+ #include "hw/qdev-properties.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ void memory_listener_unregister(MemoryListener *listener)
+     listener->address_space = NULL;
+ }
+-bool memory_region_request_mmio_ptr(MemoryRegion *mr, hwaddr addr)
+-{
+-    void *host;
+-    unsigned size = 0;
+-    unsigned offset = 0;
+-    Object *new_interface;
+-
+-    if (!mr || !mr->ops->request_ptr) {
+-        return false;
+-    }
+-
+-    /*
+-     * Avoid an update if the request_ptr call
+-     * memory_region_invalidate_mmio_ptr which seems to be likely when we use
+-     * a cache.
+-     */
+-    memory_region_transaction_begin();
+-
+-    host = mr->ops->request_ptr(mr->opaque, addr - mr->addr, &size, &offset);
+-
+-    if (!host || !size) {
+-        memory_region_transaction_commit();
+-        return false;
+-    }
+-
+-    new_interface = object_new("mmio_interface");
+-    qdev_prop_set_uint64(DEVICE(new_interface), "start", offset);
+-    qdev_prop_set_uint64(DEVICE(new_interface), "end", offset + size - 1);
+-    qdev_prop_set_bit(DEVICE(new_interface), "ro", true);
+-    qdev_prop_set_ptr(DEVICE(new_interface), "host_ptr", host);
+-    qdev_prop_set_ptr(DEVICE(new_interface), "subregion", mr);
+-    object_property_set_bool(OBJECT(new_interface), true, "realized", NULL);
+-
+-    memory_region_transaction_commit();
+-    return true;
+-}
+-
+-typedef struct MMIOPtrInvalidate {
+-    MemoryRegion *mr;
+-    hwaddr offset;
+-    unsigned size;
+-    int busy;
+-    int allocated;
+-} MMIOPtrInvalidate;
+-
+-#define MAX_MMIO_INVALIDATE 10
+-static MMIOPtrInvalidate mmio_ptr_invalidate_list[MAX_MMIO_INVALIDATE];
+-
+-static void memory_region_do_invalidate_mmio_ptr(CPUState *cpu,
+-                                                 run_on_cpu_data data)
+-{
+-    MMIOPtrInvalidate *invalidate_data = (MMIOPtrInvalidate *)data.host_ptr;
+-    MemoryRegion *mr = invalidate_data->mr;
+-    hwaddr offset = invalidate_data->offset;
+-    unsigned size = invalidate_data->size;
+-    MemoryRegionSection section = memory_region_find(mr, offset, size);
+-
+-    qemu_mutex_lock_iothread();
+-
+-    /* Reset dirty so this doesn't happen later. */
+-    cpu_physical_memory_test_and_clear_dirty(offset, size, 1);
+-
+-    if (section.mr != mr) {
+-        /* memory_region_find add a ref on section.mr */
+-        memory_region_unref(section.mr);
+-        if (MMIO_INTERFACE(section.mr->owner)) {
+-            /* We found the interface just drop it. */
+-            object_property_set_bool(section.mr->owner, false, "realized",
+-                                     NULL);
+-            object_unref(section.mr->owner);
+-            object_unparent(section.mr->owner);
+-        }
+-    }
+-
+-    qemu_mutex_unlock_iothread();
+-
+-    if (invalidate_data->allocated) {
+-        g_free(invalidate_data);
+-    } else {
+-        invalidate_data->busy = 0;
+-    }
+-}
+-
+-void memory_region_invalidate_mmio_ptr(MemoryRegion *mr, hwaddr offset,
+-                                       unsigned size)
+-{
+-    size_t i;
+-    MMIOPtrInvalidate *invalidate_data = NULL;
+-
+-    for (i = 0; i < MAX_MMIO_INVALIDATE; i++) {
+-        if (atomic_cmpxchg(&(mmio_ptr_invalidate_list[i].busy), 0, 1) == 0) {
+-            invalidate_data = &mmio_ptr_invalidate_list[i];
+-            break;
+-        }
+-    }
+-
+-    if (!invalidate_data) {
+-        invalidate_data = g_malloc0(sizeof(MMIOPtrInvalidate));
+-        invalidate_data->allocated = 1;
+-    }
+-
+-    invalidate_data->mr = mr;
+-    invalidate_data->offset = offset;
+-    invalidate_data->size = size;
+-
+-    async_safe_run_on_cpu(first_cpu, memory_region_do_invalidate_mmio_ptr,
+-                          RUN_ON_CPU_HOST_PTR(invalidate_data));
+-}
+-
+ void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
+ {
+     memory_region_ref(root);
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 16/25] hw/misc: Remove mmio_interface device
+The mmio_interface device was a purely internal artifact
 of the implementation of the memory subsystem's request_ptr
 APIs. Now that we have removed those APIs, we can remove
 the mmio_interface device too.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
 Message-id: 20180817114619.22354-4-peter.maydell@linaro.org
 ---
  hw/misc/Makefile.objs            |   1 -
  include/hw/misc/mmio_interface.h |  49 -----------
  hw/misc/mmio_interface.c         | 135 -------------------------------
 files changed, 185 deletions(-)
  delete mode 100644 include/hw/misc/mmio_interface.h
  delete mode 100644 hw/misc/mmio_interface.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_PVPANIC) += pvpanic.o
  obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
  obj-$(CONFIG_AUX) += auxbus.o
  obj-$(CONFIG_ASPEED_SOC) += aspeed_scu.o aspeed_sdmc.o
 -obj-y += mmio_interface.o
  obj-$(CONFIG_MSF2) += msf2-sysreg.o
 diff --git a/include/hw/misc/mmio_interface.h b/include/hw/misc/mmio_interface.h
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/include/hw/misc/mmio_interface.h
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -/*
 - * mmio_interface.h
 - *
 - *  Copyright (C) 2017 : GreenSocs
 - *      http://www.greensocs.com/ , email: info@greensocs.com
 - *
 - *  Developed by :
 - *  Frederic Konrad   <fred.konrad@greensocs.com>
 - *
 - * This program is free software; you can redistribute it and/or modify
 - * it under the terms of the GNU General Public License as published by
 - * the Free Software Foundation, either version 2 of the License, or
 - * (at your option)any later version.
 - *
 - * This program is distributed in the hope that it will be useful,
 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 - * GNU General Public License for more details.
 - *
 - * You should have received a copy of the GNU General Public License along
 - * with this program; if not, see <http://www.gnu.org/licenses/>.
 - *
 - */
 -
 -#ifndef MMIO_INTERFACE_H
 -#define MMIO_INTERFACE_H
 -
 -#include "exec/memory.h"
 -
 -#define TYPE_MMIO_INTERFACE "mmio_interface"
 -#define MMIO_INTERFACE(obj) OBJECT_CHECK(MMIOInterface, (obj),                 \
 -                                         TYPE_MMIO_INTERFACE)
 -
 -typedef struct MMIOInterface {
 -    DeviceState parent_obj;
 -
 -    MemoryRegion *subregion;
 -    MemoryRegion ram_mem;
 -    uint64_t start;
 -    uint64_t end;
 -    bool ro;
 -    uint64_t id;
 -    void *host_ptr;
 -} MMIOInterface;
 -
 -void mmio_interface_map(MMIOInterface *s);
 -void mmio_interface_unmap(MMIOInterface *s);
 -
 -#endif /* MMIO_INTERFACE_H */
 diff --git a/hw/misc/mmio_interface.c b/hw/misc/mmio_interface.c
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/hw/misc/mmio_interface.c
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -/*
 - * mmio_interface.c
 - *
 - *  Copyright (C) 2017 : GreenSocs
 - *      http://www.greensocs.com/ , email: info@greensocs.com
 - *
 - *  Developed by :
 - *  Frederic Konrad   <fred.konrad@greensocs.com>
 - *
 - * This program is free software; you can redistribute it and/or modify
 - * it under the terms of the GNU General Public License as published by
 - * the Free Software Foundation, either version 2 of the License, or
 - * (at your option)any later version.
 - *
 - * This program is distributed in the hope that it will be useful,
 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 - * GNU General Public License for more details.
 - *
 - * You should have received a copy of the GNU General Public License along
 - * with this program; if not, see <http://www.gnu.org/licenses/>.
 - *
 - */
 -
 -#include "qemu/osdep.h"
 -#include "qemu/log.h"
 -#include "trace.h"
 -#include "hw/qdev-properties.h"
 -#include "hw/misc/mmio_interface.h"
 -#include "qapi/error.h"
 -
 -#ifndef DEBUG_MMIO_INTERFACE
 -#define DEBUG_MMIO_INTERFACE 0
 -#endif
 -
 -static uint64_t mmio_interface_counter;
 -
 -#define DPRINTF(fmt, ...) do {                                                 \
 -    if (DEBUG_MMIO_INTERFACE) {                                                \
 -        qemu_log("mmio_interface: 0x%" PRIX64 ": " fmt, s->id, ## __VA_ARGS__);\
 -    }                                                                          \
 -} while (0)
 -
 -static void mmio_interface_init(Object *obj)
 -{
 -    MMIOInterface *s = MMIO_INTERFACE(obj);
 -
 -    if (DEBUG_MMIO_INTERFACE) {
 -        s->id = mmio_interface_counter++;
 -    }
 -
 -    DPRINTF("interface created\n");
 -    s->host_ptr = 0;
 -    s->subregion = 0;
 -}
 -
 -static void mmio_interface_realize(DeviceState *dev, Error **errp)
 -{
 -    MMIOInterface *s = MMIO_INTERFACE(dev);
 -
 -    DPRINTF("realize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
 -            " %p\n", s->start, s->end, s->host_ptr);
 -
 -    if (!s->host_ptr) {
 -        error_setg(errp, "host_ptr property must be set");
 -        return;
 -    }
 -
 -    if (!s->subregion) {
 -        error_setg(errp, "subregion property must be set");
 -        return;
 -    }
 -
 -    memory_region_init_ram_ptr(&s->ram_mem, OBJECT(s), "ram",
 -                               s->end - s->start + 1, s->host_ptr);
 -    memory_region_set_readonly(&s->ram_mem, s->ro);
 -    memory_region_add_subregion(s->subregion, s->start, &s->ram_mem);
 -}
 -
 -static void mmio_interface_unrealize(DeviceState *dev, Error **errp)
 -{
 -    MMIOInterface *s = MMIO_INTERFACE(dev);
 -
 -    DPRINTF("unrealize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
 -            " %p\n", s->start, s->end, s->host_ptr);
 -    memory_region_del_subregion(s->subregion, &s->ram_mem);
 -}
 -
 -static void mmio_interface_finalize(Object *obj)
 -{
 -    MMIOInterface *s = MMIO_INTERFACE(obj);
 -
 -    DPRINTF("finalize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
 -            " %p\n", s->start, s->end, s->host_ptr);
 -    object_unparent(OBJECT(&s->ram_mem));
 -}
 -
 -static Property mmio_interface_properties[] = {
 -    DEFINE_PROP_UINT64("start", MMIOInterface, start, 0),
 -    DEFINE_PROP_UINT64("end", MMIOInterface, end, 0),
 -    DEFINE_PROP_PTR("host_ptr", MMIOInterface, host_ptr),
 -    DEFINE_PROP_BOOL("ro", MMIOInterface, ro, false),
 -    DEFINE_PROP_MEMORY_REGION("subregion", MMIOInterface, subregion),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
 -static void mmio_interface_class_init(ObjectClass *oc, void *data)
 -{
 -    DeviceClass *dc = DEVICE_CLASS(oc);
 -
 -    dc->realize = mmio_interface_realize;
 -    dc->unrealize = mmio_interface_unrealize;
 -    dc->props = mmio_interface_properties;
 -    /* Reason: pointer property "host_ptr", and this device
 -     * is an implementation detail of the memory subsystem,
 -     * not intended to be created directly by the user.
 -     */
 -    dc->user_creatable = false;
 -}
 -
 -static const TypeInfo mmio_interface_info = {
 -    .name          = TYPE_MMIO_INTERFACE,
 -    .parent        = TYPE_DEVICE,
 -    .instance_size = sizeof(MMIOInterface),
 -    .instance_init = mmio_interface_init,
 -    .instance_finalize = mmio_interface_finalize,
 -    .class_init    = mmio_interface_class_init,
 -};
 -
 -static void mmio_interface_register_types(void)
 -{
 -    type_register_static(&mmio_interface_info);
 -}
 -
 -type_init(mmio_interface_register_types)
 --
 .18.0

-New patch
+[Qemu-devel] [PULL 17/25] hw/timer/m48t59: Move away from old_mmio accessors
+Move the m48t59 device away from using old_mmio MemoryRegionOps
+accessors.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+Message-id: 20180802180602.22047-1-peter.maydell@linaro.org
+---
+ hw/timer/m48t59.c | 59 +++++++++--------------------------------------
+file changed, 11 insertions(+), 48 deletions(-)
+diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/timer/m48t59.c
++++ b/hw/timer/m48t59.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t NVRAM_readb(void *opaque, hwaddr addr, unsigned size)
+     return retval;
+ }
+-static void nvram_writeb (void *opaque, hwaddr addr, uint32_t value)
+-{
+-    M48t59State *NVRAM = opaque;
+-
+-    m48t59_write(NVRAM, addr, value & 0xff);
+-}
+-
+-static void nvram_writew (void *opaque, hwaddr addr, uint32_t value)
+-{
+-    M48t59State *NVRAM = opaque;
+-
+-    m48t59_write(NVRAM, addr, (value >> 8) & 0xff);
+-    m48t59_write(NVRAM, addr + 1, value & 0xff);
+-}
+-
+-static void nvram_writel (void *opaque, hwaddr addr, uint32_t value)
+-{
+-    M48t59State *NVRAM = opaque;
+-
+-    m48t59_write(NVRAM, addr, (value >> 24) & 0xff);
+-    m48t59_write(NVRAM, addr + 1, (value >> 16) & 0xff);
+-    m48t59_write(NVRAM, addr + 2, (value >> 8) & 0xff);
+-    m48t59_write(NVRAM, addr + 3, value & 0xff);
+-}
+-
+-static uint32_t nvram_readb (void *opaque, hwaddr addr)
++static uint64_t nvram_read(void *opaque, hwaddr addr, unsigned size)
+ {
+     M48t59State *NVRAM = opaque;
+     return m48t59_read(NVRAM, addr);
+ }
+-static uint32_t nvram_readw (void *opaque, hwaddr addr)
++static void nvram_write(void *opaque, hwaddr addr, uint64_t value,
++                        unsigned size)
+ {
+     M48t59State *NVRAM = opaque;
+-    uint32_t retval;
+-    retval = m48t59_read(NVRAM, addr) << 8;
+-    retval |= m48t59_read(NVRAM, addr + 1);
+-    return retval;
+-}
+-
+-static uint32_t nvram_readl (void *opaque, hwaddr addr)
+-{
+-    M48t59State *NVRAM = opaque;
+-    uint32_t retval;
+-
+-    retval = m48t59_read(NVRAM, addr) << 24;
+-    retval |= m48t59_read(NVRAM, addr + 1) << 16;
+-    retval |= m48t59_read(NVRAM, addr + 2) << 8;
+-    retval |= m48t59_read(NVRAM, addr + 3);
+-    return retval;
++    return m48t59_write(NVRAM, addr, value);
+ }
+ static const MemoryRegionOps nvram_ops = {
+-    .old_mmio = {
+-        .read = { nvram_readb, nvram_readw, nvram_readl, },
+-        .write = { nvram_writeb, nvram_writew, nvram_writel, },
+-    },
+-    .endianness = DEVICE_NATIVE_ENDIAN,
++    .read = nvram_read,
++    .write = nvram_write,
++    .impl.min_access_size = 1,
++    .impl.max_access_size = 1,
++    .valid.min_access_size = 1,
++    .valid.max_access_size = 4,
++    .endianness = DEVICE_BIG_ENDIAN,
+ };
+ static const VMStateDescription vmstate_m48t59 = {
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 18/25] hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module
+The Arm Cortex-M System Design Kit includes a simple watchdog module
+based on a 32-bit down-counter. Implement this.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ Makefile.objs                            |   1 +
+ hw/watchdog/Makefile.objs                |   1 +
+ include/hw/watchdog/cmsdk-apb-watchdog.h |  59 ++++
+ hw/watchdog/cmsdk-apb-watchdog.c         | 326 +++++++++++++++++++++++
+ MAINTAINERS                              |   2 +
+ default-configs/arm-softmmu.mak          |   1 +
+ hw/watchdog/trace-events                 |   6 +
+files changed, 396 insertions(+)
+ create mode 100644 include/hw/watchdog/cmsdk-apb-watchdog.h
+ create mode 100644 hw/watchdog/cmsdk-apb-watchdog.c
+ create mode 100644 hw/watchdog/trace-events
+diff --git a/Makefile.objs b/Makefile.objs
+index XXXXXXX..XXXXXXX 100644
+--- a/Makefile.objs
++++ b/Makefile.objs
+@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/tpm
+ trace-events-subdirs += hw/usb
+ trace-events-subdirs += hw/vfio
+ trace-events-subdirs += hw/virtio
++trace-events-subdirs += hw/watchdog
+ trace-events-subdirs += hw/xen
+ trace-events-subdirs += io
+ trace-events-subdirs += linux-user
+diff --git a/hw/watchdog/Makefile.objs b/hw/watchdog/Makefile.objs
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/watchdog/Makefile.objs
++++ b/hw/watchdog/Makefile.objs
+@@ -XXX,XX +XXX,XX @@
+ common-obj-y += watchdog.o
++common-obj-$(CONFIG_CMSDK_APB_WATCHDOG) += cmsdk-apb-watchdog.o
+ common-obj-$(CONFIG_WDT_IB6300ESB) += wdt_i6300esb.o
+ common-obj-$(CONFIG_WDT_IB700) += wdt_ib700.o
+ common-obj-$(CONFIG_WDT_DIAG288) += wdt_diag288.o
+diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * ARM CMSDK APB watchdog emulation
++ *
++ * Copyright (c) 2018 Linaro Limited
++ * Written by Peter Maydell
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License version 2 or
++ *  (at your option) any later version.
++ */
++
++/*
++ * This is a model of the "APB watchdog" which is part of the Cortex-M
++ * System Design Kit (CMSDK) and documented in the Cortex-M System
++ * Design Kit Technical Reference Manual (ARM DDI0479C):
++ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
++ *
++ * QEMU interface:
++ *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
++ *  + sysbus MMIO region 0: the register bank
++ *  + sysbus IRQ 0: watchdog interrupt
++ *
++ * In real hardware the watchdog's reset output is just a GPIO line
++ * which can then be masked by the board or treated as a simple interrupt.
++ * (For instance the IoTKit does this with the non-secure watchdog, so that
++ * secure code can control whether non-secure code can perform a system
++ * reset via its watchdog.) In QEMU, we just wire up the watchdog reset
++ * to watchdog_perform_action(), at least for the moment.
++ */
++
++#ifndef CMSDK_APB_WATCHDOG_H
++#define CMSDK_APB_WATCHDOG_H
++
++#include "hw/sysbus.h"
++#include "hw/ptimer.h"
++
++#define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
++#define CMSDK_APB_WATCHDOG(obj) OBJECT_CHECK(CMSDKAPBWatchdog, (obj), \
++                                              TYPE_CMSDK_APB_WATCHDOG)
++
++typedef struct CMSDKAPBWatchdog {
++    /*< private >*/
++    SysBusDevice parent_obj;
++
++    /*< public >*/
++    MemoryRegion iomem;
++    qemu_irq wdogint;
++    uint32_t wdogclk_frq;
++    struct ptimer_state *timer;
++
++    uint32_t control;
++    uint32_t intstatus;
++    uint32_t lock;
++    uint32_t itcr;
++    uint32_t itop;
++    uint32_t resetstatus;
++} CMSDKAPBWatchdog;
++
++#endif
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/watchdog/cmsdk-apb-watchdog.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * ARM CMSDK APB watchdog emulation
++ *
++ * Copyright (c) 2018 Linaro Limited
++ * Written by Peter Maydell
++ *
++ *  This program is free software; you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License version 2 or
++ *  (at your option) any later version.
++ */
++
++/*
++ * This is a model of the "APB watchdog" which is part of the Cortex-M
++ * System Design Kit (CMSDK) and documented in the Cortex-M System
++ * Design Kit Technical Reference Manual (ARM DDI0479C):
++ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
++ */
++
++#include "qemu/osdep.h"
++#include "qemu/log.h"
++#include "trace.h"
++#include "qapi/error.h"
++#include "qemu/main-loop.h"
++#include "sysemu/watchdog.h"
++#include "hw/sysbus.h"
++#include "hw/registerfields.h"
++#include "hw/watchdog/cmsdk-apb-watchdog.h"
++
++REG32(WDOGLOAD, 0x0)
++REG32(WDOGVALUE, 0x4)
++REG32(WDOGCONTROL, 0x8)
++    FIELD(WDOGCONTROL, INTEN, 0, 1)
++    FIELD(WDOGCONTROL, RESEN, 1, 1)
++#define R_WDOGCONTROL_VALID_MASK (R_WDOGCONTROL_INTEN_MASK | \
++                                  R_WDOGCONTROL_RESEN_MASK)
++REG32(WDOGINTCLR, 0xc)
++REG32(WDOGRIS, 0x10)
++    FIELD(WDOGRIS, INT, 0, 1)
++REG32(WDOGMIS, 0x14)
++REG32(WDOGLOCK, 0xc00)
++#define WDOG_UNLOCK_VALUE 0x1ACCE551
++REG32(WDOGITCR, 0xf00)
++    FIELD(WDOGITCR, ENABLE, 0, 1)
++#define R_WDOGITCR_VALID_MASK R_WDOGITCR_ENABLE_MASK
++REG32(WDOGITOP, 0xf04)
++    FIELD(WDOGITOP, WDOGRES, 0, 1)
++    FIELD(WDOGITOP, WDOGINT, 1, 1)
++#define R_WDOGITOP_VALID_MASK (R_WDOGITOP_WDOGRES_MASK | \
++                               R_WDOGITOP_WDOGINT_MASK)
++REG32(PID4, 0xfd0)
++REG32(PID5, 0xfd4)
++REG32(PID6, 0xfd8)
++REG32(PID7, 0xfdc)
++REG32(PID0, 0xfe0)
++REG32(PID1, 0xfe4)
++REG32(PID2, 0xfe8)
++REG32(PID3, 0xfec)
++REG32(CID0, 0xff0)
++REG32(CID1, 0xff4)
++REG32(CID2, 0xff8)
++REG32(CID3, 0xffc)
++
++/* PID/CID values */
++static const int watchdog_id[] = {
++    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
++    0x24, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
++    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
++};
++
++static bool cmsdk_apb_watchdog_intstatus(CMSDKAPBWatchdog *s)
++{
++    /* Return masked interrupt status */
++    return s->intstatus && (s->control & R_WDOGCONTROL_INTEN_MASK);
++}
++
++static bool cmsdk_apb_watchdog_resetstatus(CMSDKAPBWatchdog *s)
++{
++    /* Return masked reset status */
++    return s->resetstatus && (s->control & R_WDOGCONTROL_RESEN_MASK);
++}
++
++static void cmsdk_apb_watchdog_update(CMSDKAPBWatchdog *s)
++{
++    bool wdogint;
++    bool wdogres;
++
++    if (s->itcr) {
++        wdogint = s->itop & R_WDOGITOP_WDOGINT_MASK;
++        wdogres = s->itop & R_WDOGITOP_WDOGRES_MASK;
++    } else {
++        wdogint = cmsdk_apb_watchdog_intstatus(s);
++        wdogres = cmsdk_apb_watchdog_resetstatus(s);
++    }
++
++    qemu_set_irq(s->wdogint, wdogint);
++    if (wdogres) {
++        watchdog_perform_action();
++    }
++}
++
++static uint64_t cmsdk_apb_watchdog_read(void *opaque, hwaddr offset,
++                                        unsigned size)
++{
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
++    uint64_t r;
++
++    switch (offset) {
++    case A_WDOGLOAD:
++        r = ptimer_get_limit(s->timer);
++        break;
++    case A_WDOGVALUE:
++        r = ptimer_get_count(s->timer);
++        break;
++    case A_WDOGCONTROL:
++        r = s->control;
++        break;
++    case A_WDOGRIS:
++        r = s->intstatus;
++        break;
++    case A_WDOGMIS:
++        r = cmsdk_apb_watchdog_intstatus(s);
++        break;
++    case A_WDOGLOCK:
++        r = s->lock;
++        break;
++    case A_WDOGITCR:
++        r = s->itcr;
++        break;
++    case A_PID4 ... A_CID3:
++        r = watchdog_id[(offset - A_PID4) / 4];
++        break;
++    case A_WDOGINTCLR:
++    case A_WDOGITOP:
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "CMSDK APB watchdog read: read of WO offset %x\n",
++                      (int)offset);
++        r = 0;
++        break;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "CMSDK APB watchdog read: bad offset %x\n", (int)offset);
++        r = 0;
++        break;
++    }
++    trace_cmsdk_apb_watchdog_read(offset, r, size);
++    return r;
++}
++
++static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
++                                     uint64_t value, unsigned size)
++{
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
++
++    trace_cmsdk_apb_watchdog_write(offset, value, size);
++
++    if (s->lock && offset != A_WDOGLOCK) {
++        /* Write access is disabled via WDOGLOCK */
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "CMSDK APB watchdog write: write to locked watchdog\n");
++        return;
++    }
++
++    switch (offset) {
++    case A_WDOGLOAD:
++        /*
++         * Reset the load value and the current count, and make sure
++         * we're counting.
++         */
++        ptimer_set_limit(s->timer, value, 1);
++        ptimer_run(s->timer, 0);
++        break;
++    case A_WDOGCONTROL:
++        s->control = value & R_WDOGCONTROL_VALID_MASK;
++        cmsdk_apb_watchdog_update(s);
++        break;
++    case A_WDOGINTCLR:
++        s->intstatus = 0;
++        ptimer_set_count(s->timer, ptimer_get_limit(s->timer));
++        cmsdk_apb_watchdog_update(s);
++        break;
++    case A_WDOGLOCK:
++        s->lock = (value != WDOG_UNLOCK_VALUE);
++        break;
++    case A_WDOGITCR:
++        s->itcr = value & R_WDOGITCR_VALID_MASK;
++        cmsdk_apb_watchdog_update(s);
++        break;
++    case A_WDOGITOP:
++        s->itop = value & R_WDOGITOP_VALID_MASK;
++        cmsdk_apb_watchdog_update(s);
++        break;
++    case A_WDOGVALUE:
++    case A_WDOGRIS:
++    case A_WDOGMIS:
++    case A_PID4 ... A_CID3:
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "CMSDK APB watchdog write: write to RO offset 0x%x\n",
++                      (int)offset);
++        break;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "CMSDK APB watchdog write: bad offset 0x%x\n",
++                      (int)offset);
++        break;
++    }
++}
++
++static const MemoryRegionOps cmsdk_apb_watchdog_ops = {
++    .read = cmsdk_apb_watchdog_read,
++    .write = cmsdk_apb_watchdog_write,
++    .endianness = DEVICE_LITTLE_ENDIAN,
++    /* byte/halfword accesses are just zero-padded on reads and writes */
++    .impl.min_access_size = 4,
++    .impl.max_access_size = 4,
++    .valid.min_access_size = 1,
++    .valid.max_access_size = 4,
++};
++
++static void cmsdk_apb_watchdog_tick(void *opaque)
++{
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
++
++    if (!s->intstatus) {
++        /* Count expired for the first time: raise interrupt */
++        s->intstatus = R_WDOGRIS_INT_MASK;
++    } else {
++        /* Count expired for the second time: raise reset and stop clock */
++        s->resetstatus = 1;
++        ptimer_stop(s->timer);
++    }
++    cmsdk_apb_watchdog_update(s);
++}
++
++static void cmsdk_apb_watchdog_reset(DeviceState *dev)
++{
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
++
++    trace_cmsdk_apb_watchdog_reset();
++    s->control = 0;
++    s->intstatus = 0;
++    s->lock = 0;
++    s->itcr = 0;
++    s->itop = 0;
++    s->resetstatus = 0;
++    /* Set the limit and the count */
++    ptimer_set_limit(s->timer, 0xffffffff, 1);
++    ptimer_run(s->timer, 0);
++}
++
++static void cmsdk_apb_watchdog_init(Object *obj)
++{
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(obj);
++
++    memory_region_init_io(&s->iomem, obj, &cmsdk_apb_watchdog_ops,
++                          s, "cmsdk-apb-watchdog", 0x1000);
++    sysbus_init_mmio(sbd, &s->iomem);
++    sysbus_init_irq(sbd, &s->wdogint);
++}
++
++static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
++{
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
++    QEMUBH *bh;
++
++    if (s->wdogclk_frq == 0) {
++        error_setg(errp,
++                   "CMSDK APB watchdog: wdogclk-frq property must be set");
++        return;
++    }
++
++    bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
++    s->timer = ptimer_init(bh,
++                           PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
++                           PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
++                           PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
++                           PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
++
++    ptimer_set_freq(s->timer, s->wdogclk_frq);
++}
++
++static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
++    .name = "cmsdk-apb-watchdog",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .fields = (VMStateField[]) {
++        VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(control, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(lock, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(itcr, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(itop, CMSDKAPBWatchdog),
++        VMSTATE_UINT32(resetstatus, CMSDKAPBWatchdog),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
++static Property cmsdk_apb_watchdog_properties[] = {
++    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
++static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
++{
++    DeviceClass *dc = DEVICE_CLASS(klass);
++
++    dc->realize = cmsdk_apb_watchdog_realize;
++    dc->vmsd = &cmsdk_apb_watchdog_vmstate;
++    dc->reset = cmsdk_apb_watchdog_reset;
++    dc->props = cmsdk_apb_watchdog_properties;
++}
++
++static const TypeInfo cmsdk_apb_watchdog_info = {
++    .name = TYPE_CMSDK_APB_WATCHDOG,
++    .parent = TYPE_SYS_BUS_DEVICE,
++    .instance_size = sizeof(CMSDKAPBWatchdog),
++    .instance_init = cmsdk_apb_watchdog_init,
++    .class_init = cmsdk_apb_watchdog_class_init,
++};
++
++static void cmsdk_apb_watchdog_register_types(void)
++{
++    type_register_static(&cmsdk_apb_watchdog_info);
++}
++
++type_init(cmsdk_apb_watchdog_register_types);
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: hw/timer/cmsdk-apb-timer.c
+ F: include/hw/timer/cmsdk-apb-timer.h
+ F: hw/char/cmsdk-apb-uart.c
+ F: include/hw/char/cmsdk-apb-uart.h
++F: hw/watchdog/cmsdk-apb-watchdog.c
++F: include/hw/watchdog/cmsdk-apb-watchdog.h
+ F: hw/misc/tz-ppc.c
+ F: include/hw/misc/tz-ppc.h
+ F: hw/misc/tz-mpc.c
+diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
+index XXXXXXX..XXXXXXX 100644
+--- a/default-configs/arm-softmmu.mak
++++ b/default-configs/arm-softmmu.mak
+@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F205_SOC=y
+ CONFIG_CMSDK_APB_TIMER=y
+ CONFIG_CMSDK_APB_UART=y
++CONFIG_CMSDK_APB_WATCHDOG=y
+ CONFIG_MPS2_FPGAIO=y
+ CONFIG_MPS2_SCC=y
+diff --git a/hw/watchdog/trace-events b/hw/watchdog/trace-events
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/watchdog/trace-events
+@@ -XXX,XX +XXX,XX @@
++# See docs/devel/tracing.txt for syntax documentation.
++
++# hw/char/cmsdk_apb_watchdog.c
++cmsdk_apb_watchdog_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB watchdog read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++cmsdk_apb_watchdog_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB watchdog write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++cmsdk_apb_watchdog_reset(void) "CMSDK APB watchdog: reset"
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 19/25] nvic: Expose NMI line
+On real v7M hardware, the NMI line is an externally visible signal
+that an SoC or board can toggle to assert an NMI. Expose it in
+our QEMU NVIC and armv7m container objects so that a board model
+can wire it up if it needs to.
+In particular, the MPS2 watchdog is wired to NMI.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ hw/arm/armv7m.c       |  1 +
+ hw/intc/armv7m_nvic.c | 19 +++++++++++++++++++
+ hw/intc/trace-events  |  1 +
+files changed, 21 insertions(+)
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
+      */
+     qdev_pass_gpios(DEVICE(&s->nvic), dev, NULL);
+     qdev_pass_gpios(DEVICE(&s->nvic), dev, "SYSRESETREQ");
++    qdev_pass_gpios(DEVICE(&s->nvic), dev, "NMI");
+     /* Wire the NVIC up to the CPU */
+     sbd = SYS_BUS_DEVICE(&s->nvic);
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static void set_irq_level(void *opaque, int n, int level)
+     }
+ }
++/* callback when external NMI line is changed */
++static void nvic_nmi_trigger(void *opaque, int n, int level)
++{
++    NVICState *s = opaque;
++
++    trace_nvic_set_nmi_level(level);
++
++    /*
++     * The architecture doesn't specify whether NMI should share
++     * the normal-interrupt behaviour of being resampled on
++     * exception handler return. We choose not to, so just
++     * set NMI pending here and don't track the current level.
++     */
++    if (level) {
++        armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
++    }
++}
++
+ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+ {
+     ARMCPU *cpu = s->cpu;
+@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
+     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
+     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
+                             M_REG_NUM_BANKS);
++    qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
+ }
+ static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
+diff --git a/hw/intc/trace-events b/hw/intc/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/trace-events
++++ b/hw/intc/trace-events
+@@ -XXX,XX +XXX,XX @@ nvic_acknowledge_irq(int irq, int prio) "NVIC acknowledge IRQ: %d now active (pr
+ nvic_get_pending_irq_info(int irq, bool secure) "NVIC next IRQ %d: targets_secure: %d"
+ nvic_complete_irq(int irq, bool secure) "NVIC complete IRQ %d (secure %d)"
+ nvic_set_irq_level(int irq, int level) "NVIC external irq %d level set to %d"
++nvic_set_nmi_level(int level) "NVIC external NMI level set to %d"
+ nvic_sysreg_read(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
+ nvic_sysreg_write(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 20/25] hw/dma/pl080: Allow use as embedded-struct device
+Create a new include file for the pl081's device struct,
+type macros, etc, so that it can be instantiated using
+the "embedded struct" coding style.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ include/hw/dma/pl080.h | 62 ++++++++++++++++++++++++++++++++++++++++++
+ hw/dma/pl080.c         | 34 ++---------------------
+ MAINTAINERS            |  1 +
+files changed, 65 insertions(+), 32 deletions(-)
+ create mode 100644 include/hw/dma/pl080.h
+diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/hw/dma/pl080.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * ARM PrimeCell PL080/PL081 DMA controller
++ *
++ * Copyright (c) 2006 CodeSourcery.
++ * Copyright (c) 2018 Linaro Limited
++ * Written by Paul Brook, Peter Maydell
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 or
++ * (at your option) any later version.
++ */
++
++/* This is a model of the Arm PrimeCell PL080/PL081 DMA controller:
++ * The PL080 TRM is:
++ * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0196g/DDI0196.pdf
++ * and the PL081 TRM is:
++ * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0218e/DDI0218.pdf
++ *
++ * QEMU interface:
++ * + sysbus IRQ: DMACINTR combined interrupt line
++ * + sysbus MMIO region 0: MemoryRegion for the device's registers
++ */
++
++#ifndef HW_DMA_PL080_H
++#define HW_DMA_PL080_H
++
++#include "hw/sysbus.h"
++
++#define PL080_MAX_CHANNELS 8
++
++typedef struct {
++    uint32_t src;
++    uint32_t dest;
++    uint32_t lli;
++    uint32_t ctrl;
++    uint32_t conf;
++} pl080_channel;
++
++#define TYPE_PL080 "pl080"
++#define TYPE_PL081 "pl081"
++#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
++
++typedef struct PL080State {
++    SysBusDevice parent_obj;
++
++    MemoryRegion iomem;
++    uint8_t tc_int;
++    uint8_t tc_mask;
++    uint8_t err_int;
++    uint8_t err_mask;
++    uint32_t conf;
++    uint32_t sync;
++    uint32_t req_single;
++    uint32_t req_burst;
++    pl080_channel chan[PL080_MAX_CHANNELS];
++    int nchannels;
++    /* Flag to avoid recursive DMA invocations.  */
++    int running;
++    qemu_irq irq;
++} PL080State;
++
++#endif
+diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/pl080.c
++++ b/hw/dma/pl080.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "exec/address-spaces.h"
+ #include "qemu/log.h"
++#include "hw/dma/pl080.h"
+-#define PL080_MAX_CHANNELS 8
+ #define PL080_CONF_E    0x1
+ #define PL080_CONF_M1   0x2
+ #define PL080_CONF_M2   0x4
+@@ -XXX,XX +XXX,XX @@
+ #define PL080_CCTRL_D   0x02000000
+ #define PL080_CCTRL_S   0x01000000
+-typedef struct {
+-    uint32_t src;
+-    uint32_t dest;
+-    uint32_t lli;
+-    uint32_t ctrl;
+-    uint32_t conf;
+-} pl080_channel;
+-
+-#define TYPE_PL080 "pl080"
+-#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
+-
+-typedef struct PL080State {
+-    SysBusDevice parent_obj;
+-
+-    MemoryRegion iomem;
+-    uint8_t tc_int;
+-    uint8_t tc_mask;
+-    uint8_t err_int;
+-    uint8_t err_mask;
+-    uint32_t conf;
+-    uint32_t sync;
+-    uint32_t req_single;
+-    uint32_t req_burst;
+-    pl080_channel chan[PL080_MAX_CHANNELS];
+-    int nchannels;
+-    /* Flag to avoid recursive DMA invocations.  */
+-    int running;
+-    qemu_irq irq;
+-} PL080State;
+-
+ static const VMStateDescription vmstate_pl080_channel = {
+     .name = "pl080_channel",
+     .version_id = 1,
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo pl080_info = {
+ };
+ static const TypeInfo pl081_info = {
+-    .name          = "pl081",
++    .name          = TYPE_PL081,
+     .parent        = TYPE_PL080,
+     .instance_init = pl081_init,
+ };
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: hw/char/pl011.c
+ F: include/hw/char/pl011.h
+ F: hw/display/pl110*
+ F: hw/dma/pl080.c
++F: include/hw/dma/pl080.h
+ F: hw/dma/pl330.c
+ F: hw/gpio/pl061.c
+ F: hw/input/pl050.c
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 21/25] hw/dma/pl080: Support all three interrupt lines
+The PL080 and PL081 have three outgoing interrupt lines:
+ * DMACINTERR signals DMA errors
+ * DMACINTTC is the DMA count interrupt
+ * DMACINTR is a combined interrupt, the logical OR of the other two
+We currently only implement DMACINTR, because that's all the
+realview and versatile boards needed, but the instances of the
+PL081 in the MPS2 firmware images use all three interrupt lines.
+Implement the missing DMACINTERR and DMACINTTC.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ include/hw/dma/pl080.h |  6 +++++-
+ hw/dma/pl080.c         | 13 ++++++++-----
+files changed, 13 insertions(+), 6 deletions(-)
+diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/dma/pl080.h
++++ b/include/hw/dma/pl080.h
+@@ -XXX,XX +XXX,XX @@
+  * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0218e/DDI0218.pdf
+  *
+  * QEMU interface:
+- * + sysbus IRQ: DMACINTR combined interrupt line
++ * + sysbus IRQ 0: DMACINTR combined interrupt line
++ * + sysbus IRQ 1: DMACINTERR error interrupt request
++ * + sysbus IRQ 2: DMACINTTC count interrupt request
+  * + sysbus MMIO region 0: MemoryRegion for the device's registers
+  */
+@@ -XXX,XX +XXX,XX @@ typedef struct PL080State {
+     /* Flag to avoid recursive DMA invocations.  */
+     int running;
+     qemu_irq irq;
++    qemu_irq interr;
++    qemu_irq inttc;
+ } PL080State;
+ #endif
+diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/pl080.c
++++ b/hw/dma/pl080.c
+@@ -XXX,XX +XXX,XX @@ static const unsigned char pl081_id[] =
+ static void pl080_update(PL080State *s)
+ {
+-    if ((s->tc_int & s->tc_mask)
+-            || (s->err_int & s->err_mask))
+-        qemu_irq_raise(s->irq);
+-    else
+-        qemu_irq_lower(s->irq);
++    bool tclevel = (s->tc_int & s->tc_mask);
++    bool errlevel = (s->err_int & s->err_mask);
++
++    qemu_set_irq(s->interr, errlevel);
++    qemu_set_irq(s->inttc, tclevel);
++    qemu_set_irq(s->irq, errlevel || tclevel);
+ }
+ static void pl080_run(PL080State *s)
+@@ -XXX,XX +XXX,XX @@ static void pl080_init(Object *obj)
+     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
+     sysbus_init_mmio(sbd, &s->iomem);
+     sysbus_init_irq(sbd, &s->irq);
++    sysbus_init_irq(sbd, &s->interr);
++    sysbus_init_irq(sbd, &s->inttc);
+     s->nchannels = 8;
+ }
+--
+.18.0

-[Qemu-devel] [PULL 2/7] hw/arm: Mark the "fsl, imx6" device with user_creatable = false
+[Qemu-devel] [PULL 22/25] hw/dma/pl080: Don't use CPU address space for DMA accesses
-From: Thomas Huth <thuth@redhat.com>
+Currently our PL080/PL081 model uses a combination of the CPU's
 address space (via cpu_physical_memory_{read,write}()) and the
 system address space for performing DMA accesses.
-This device causes QEMU to abort if the user tries to instantiate it:
+For the PL081s in the MPS FPGA images, their DMA accesses
 must go via Master Security Controllers. Switch the
 PL080/PL081 model to take a MemoryRegion property which
 defines its downstream for making DMA accesses.
-$ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
+Since the PL08x are only used in two board models, we
-Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
+make provision of the 'downstream' link mandatory and convert
-qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
+both users at once, rather than having it be optional with
-Aborted (core dumped)
+a default to the system address space.
-The device uses serial_hds[] directly in its realize function, so it
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-can not be instantiated again by the user.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
  include/hw/dma/pl080.h |  5 +++++
  hw/arm/realview.c      |  8 +++++++-
  hw/arm/versatilepb.c   |  9 ++++++++-
  hw/dma/pl080.c         | 35 +++++++++++++++++++++++++++++------
 files changed, 49 insertions(+), 8 deletions(-)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
 Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/fsl-imx6.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
+--- a/include/hw/dma/pl080.h
-+++ b/hw/arm/fsl-imx6.c
++++ b/include/hw/dma/pl080.h
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
   * + sysbus IRQ 1: DMACINTERR error interrupt request
   * + sysbus IRQ 2: DMACINTTC count interrupt request
   * + sysbus MMIO region 0: MemoryRegion for the device's registers
 + * + QOM property "downstream": MemoryRegion defining where DMA
 + *   bus master transactions are made
   */
  #ifndef HW_DMA_PL080_H
@@ -XXX,XX +XXX,XX @@ typedef struct PL080State {
      qemu_irq irq;
      qemu_irq interr;
      qemu_irq inttc;
 +
 +    MemoryRegion *downstream;
 +    AddressSpace downstream_as;
  } PL080State;
  #endif
 diff --git a/hw/arm/realview.c b/hw/arm/realview.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/realview.c
 +++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
      pl011_create(0x1000c000, pic[15], serial_hd(3));
      /* DMA controller is optional, apparently.  */
 -    sysbus_create_simple("pl081", 0x10030000, pic[24]);
 +    dev = qdev_create(NULL, "pl081");
 +    object_property_set_link(OBJECT(dev), OBJECT(sysmem), "downstream",
 +                             &error_fatal);
 +    qdev_init_nofail(dev);
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, 0x10030000);
 +    sysbus_connect_irq(busdev, 0, pic[24]);
      sysbus_create_simple("sp804", 0x10011000, pic[4]);
      sysbus_create_simple("sp804", 0x10012000, pic[5]);
 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/versatilepb.c
 +++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@ static void versatile_init(MachineState *machine, int board_id)
      pl011_create(0x101f3000, pic[14], serial_hd(2));
      pl011_create(0x10009000, sic[6], serial_hd(3));
 -    sysbus_create_simple("pl080", 0x10130000, pic[17]);
 +    dev = qdev_create(NULL, "pl080");
 +    object_property_set_link(OBJECT(dev), OBJECT(sysmem), "downstream",
 +                             &error_fatal);
 +    qdev_init_nofail(dev);
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, 0x10130000);
 +    sysbus_connect_irq(busdev, 0, pic[17]);
 +
      sysbus_create_simple("sp804", 0x101e2000, pic[4]);
      sysbus_create_simple("sp804", 0x101e3000, pic[5]);
 diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/dma/pl080.c
 +++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/log.h"
  #include "hw/dma/pl080.h"
 +#include "qapi/error.h"
  #define PL080_CONF_E    0x1
  #define PL080_CONF_M1   0x2
@@ -XXX,XX +XXX,XX @@ again:
              swidth = 1 << ((ch->ctrl >> 18) & 7);
              dwidth = 1 << ((ch->ctrl >> 21) & 7);
              for (n = 0; n < dwidth; n+= swidth) {
 -                cpu_physical_memory_read(ch->src, buff + n, swidth);
 +                address_space_read(&s->downstream_as, ch->src,
 +                                   MEMTXATTRS_UNSPECIFIED, buff + n, swidth);
                  if (ch->ctrl & PL080_CCTRL_SI)
                      ch->src += swidth;
              }
              xsize = (dwidth < swidth) ? swidth : dwidth;
              /* ??? This may pad the value incorrectly for dwidth < 32.  */
              for (n = 0; n < xsize; n += dwidth) {
 -                cpu_physical_memory_write(ch->dest + n, buff + n, dwidth);
 +                address_space_write(&s->downstream_as, ch->dest + n,
 +                                    MEMTXATTRS_UNSPECIFIED, buff + n, dwidth);
                  if (ch->ctrl & PL080_CCTRL_DI)
                      ch->dest += swidth;
              }
@@ -XXX,XX +XXX,XX @@ again:
              if (size == 0) {
                  /* Transfer complete.  */
                  if (ch->lli) {
 -                    ch->src = address_space_ldl_le(&address_space_memory,
 +                    ch->src = address_space_ldl_le(&s->downstream_as,
                                                     ch->lli,
                                                     MEMTXATTRS_UNSPECIFIED,
                                                     NULL);
 -                    ch->dest = address_space_ldl_le(&address_space_memory,
 +                    ch->dest = address_space_ldl_le(&s->downstream_as,
                                                      ch->lli + 4,
                                                      MEMTXATTRS_UNSPECIFIED,
                                                      NULL);
 -                    ch->ctrl = address_space_ldl_le(&address_space_memory,
 +                    ch->ctrl = address_space_ldl_le(&s->downstream_as,
                                                      ch->lli + 12,
                                                      MEMTXATTRS_UNSPECIFIED,
                                                      NULL);
 -                    ch->lli = address_space_ldl_le(&address_space_memory,
 +                    ch->lli = address_space_ldl_le(&s->downstream_as,
                                                     ch->lli + 8,
                                                     MEMTXATTRS_UNSPECIFIED,
                                                     NULL);
@@ -XXX,XX +XXX,XX @@ static void pl080_init(Object *obj)
      s->nchannels = 8;
  }
 +static void pl080_realize(DeviceState *dev, Error **errp)
 +{
 +    PL080State *s = PL080(dev);
 +
 +    if (!s->downstream) {
 +        error_setg(errp, "PL080 'downstream' link not set");
 +        return;
 +    }
 +
 +    address_space_init(&s->downstream_as, s->downstream, "pl080-downstream");
 +}
 +
  static void pl081_init(Object *obj)
  {
      PL080State *s = PL080(obj);
@@ -XXX,XX +XXX,XX @@ static void pl081_init(Object *obj)
      s->nchannels = 2;
  }
 +static Property pl080_properties[] = {
 +    DEFINE_PROP_LINK("downstream", PL080State, downstream,
 +                     TYPE_MEMORY_REGION, MemoryRegion *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
  static void pl080_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
-     dc->realize = fsl_imx6_realize;
+     dc->vmsd = &vmstate_pl080;
--
++    dc->realize = pl080_realize;
-     dc->desc = "i.MX6 SOC";
++    dc->props = pl080_properties;
 +    /* Reason: Uses serial_hds[] in the realize() function */
 +    dc->user_creatable = false;
  }
- static const TypeInfo fsl_imx6_type_info = {
+ static const TypeInfo pl080_info = {
 --
-.7.4
+.18.0

-New patch
+[Qemu-devel] [PULL 23/25] hw/dma/pl080: Provide device reset function
+The PL080/PL081 model is missing a reset function; implement it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ hw/dma/pl080.c | 25 +++++++++++++++++++++++++
+file changed, 25 insertions(+)
+diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/pl080.c
++++ b/hw/dma/pl080.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pl080_ops = {
+     .endianness = DEVICE_NATIVE_ENDIAN,
+ };
++static void pl080_reset(DeviceState *dev)
++{
++    PL080State *s = PL080(dev);
++    int i;
++
++    s->tc_int = 0;
++    s->tc_mask = 0;
++    s->err_int = 0;
++    s->err_mask = 0;
++    s->conf = 0;
++    s->sync = 0;
++    s->req_single = 0;
++    s->req_burst = 0;
++    s->running = 0;
++
++    for (i = 0; i < s->nchannels; i++) {
++        s->chan[i].src = 0;
++        s->chan[i].dest = 0;
++        s->chan[i].lli = 0;
++        s->chan[i].ctrl = 0;
++        s->chan[i].conf = 0;
++    }
++}
++
+ static void pl080_init(Object *obj)
+ {
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+@@ -XXX,XX +XXX,XX @@ static void pl080_class_init(ObjectClass *oc, void *data)
+     dc->vmsd = &vmstate_pl080;
+     dc->realize = pl080_realize;
+     dc->props = pl080_properties;
++    dc->reset = pl080_reset;
+ }
+ static const TypeInfo pl080_info = {
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 24/25] hw/dma/pl080: Correct bug in register address decode logic
+A bug in the handling of the register address decode logic
+for the PL08x meant that we were incorrectly treating
+accesses to the DMA channel registers (DMACCxSrcAddr,
+DMACCxDestaddr, DMACCxLLI, DMACCxControl, DMACCxConfiguration)
+as bad offsets. Fix this long-standing bug.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1637974
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ hw/dma/pl080.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/pl080.c
++++ b/hw/dma/pl080.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t pl080_read(void *opaque, hwaddr offset,
+         i = (offset & 0xe0) >> 5;
+         if (i >= s->nchannels)
+             goto bad_offset;
+-        switch (offset >> 2) {
++        switch ((offset >> 2) & 7) {
+         case 0: /* SrcAddr */
+             return s->chan[i].src;
+         case 1: /* DestAddr */
+@@ -XXX,XX +XXX,XX @@ static void pl080_write(void *opaque, hwaddr offset,
+         i = (offset & 0xe0) >> 5;
+         if (i >= s->nchannels)
+             goto bad_offset;
+-        switch (offset >> 2) {
++        switch ((offset >> 2) & 7) {
+         case 0: /* SrcAddr */
+             s->chan[i].src = value;
+             break;
+@@ -XXX,XX +XXX,XX @@ static void pl080_write(void *opaque, hwaddr offset,
+             pl080_run(s);
+             break;
+         }
++        return;
+     }
+     switch (offset >> 2) {
+     case 2: /* IntTCClear */
+--
+.18.0

-New patch
+[Qemu-devel] [PULL 25/25] hw/dma/pl080: Remove hw_error() if DMA is enabled
+The PL08x model currently will unconditionally call hw_error()
+if the DMA engine is enabled by the guest. This has been
+present since the PL080 model was edded in 2006, and is
+presumably either unintentional debug code left enabled,
+or a guard against untested DMA engine code being used.
+Remove the hw_error(), since we now have a guest which
+will actually try to use the DMA engine (the self-test
+binary for the AN505 MPS2 FPGA image).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ hw/dma/pl080.c | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/pl080.c
++++ b/hw/dma/pl080.c
+@@ -XXX,XX +XXX,XX @@ static void pl080_run(PL080State *s)
+     if ((s->conf & PL080_CONF_E) == 0)
+         return;
+-hw_error("DMA active\n");
+     /* If we are already in the middle of a DMA operation then indicate that
+        there may be new DMA requests and return immediately.  */
+     if (s->running) {
+--
+.18.0

A small set of arm bugfixes for rc0.

The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107

for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:

hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm_gicv3_its: Don't abort on table save failure
 * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
 * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
 * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
 * arm: implement cache/shareability attribute bits for PAR registers

----------------------------------------------------------------
Andrew Baumann (1):
      arm: implement cache/shareability attribute bits for PAR registers

Eric Auger (1):
      hw/intc/arm_gicv3_its: Don't abort on table save failure

Peter Maydell (1):
      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD

Shanker Donthineni (1):
      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()

Thomas Huth (3):
      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
      hw/arm: Mark the "fsl,imx25" device with user_creatable = false
      hw/arm: Mark the "fsl,imx31" device with user_creatable = false

From: Andrew Baumann <Andrew.Baumann@microsoft.com>

On a successful address translation instruction, PAR is supposed to
contain cacheability and shareability attributes determined by the
translation. We previously returned 0 for these bits (in line with the
general strategy of ignoring caches and memory attributes), but some
guest OSes may depend on them.

This patch collects the attribute bits in the page-table walk, and
updates PAR with the correct attributes for all LPAE translations.
Short descriptor formats still return 0 for these bits, as in the
prior implementation.

Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 164 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
 
 #ifndef CONFIG_USER_ONLY
+/* Cacheability and shareability attributes for a memory access */
+typedef struct ARMCacheAttrs {
+    unsigned int attrs:8; /* as in the MAIR register encoding */
+    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
+} ARMCacheAttrs;
+
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi);
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi);
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 /* Security attributes for an address, as returned by v8m_security_lookup. */
 typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
     uint64_t par64;
     MemTxAttrs attrs = {};
     ARMMMUFaultInfo fi = {};
+    ARMCacheAttrs cacheattrs = {};
 
-    ret = get_phys_addr(env, value, access_type, mmu_idx,
-                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
+    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
+                        &prot, &page_size, &fsr, &fi, &cacheattrs);
     if (extended_addresses_enabled(env)) {
         /* fsr is a DFSR/IFSR value for the long descriptor
          * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
             if (!attrs.secure) {
                 par64 |= (1 << 9); /* NS */
             }
-            /* We don't set the ATTR or SH fields in the PAR. */
+            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
+            par64 |= cacheattrs.shareability << 7; /* SH */
         } else {
             par64 |= 1; /* F */
             par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
         return false;
     }
     if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
-                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
+                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
         /* the MPU lookup failed */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         int ret;
 
         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
-                                 &txattrs, &s2prot, &s2size, fsr, fi);
+                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
         if (ret) {
             fi->s2addr = addr;
             fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
     return true;
 }
 
+/* Translate from the 4-bit stage 2 representation of
+ * memory attributes (without cache-allocation hints) to
+ * the 8-bit representation of the stage 1 MAIR registers
+ * (which includes allocation hints).
+ *
+ * ref: shared/translation/attrs/S2AttrDecode()
+ *      .../S2ConvertAttrsHints()
+ */
+static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
+{
+    uint8_t hiattr = extract32(s2attrs, 2, 2);
+    uint8_t loattr = extract32(s2attrs, 0, 2);
+    uint8_t hihint = 0, lohint = 0;
+
+    if (hiattr != 0) { /* normal memory */
+        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
+            hiattr = loattr = 1; /* non-cacheable */
+        } else {
+            if (hiattr != 1) { /* Write-through or write-back */
+                hihint = 3; /* RW allocate */
+            }
+            if (loattr != 1) { /* Write-through or write-back */
+                lohint = 3; /* RW allocate */
+            }
+        }
+    }
+
+    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
+}
+
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi)
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          */
         txattrs->secure = false;
     }
+
+    if (cacheattrs != NULL) {
+        if (mmu_idx == ARMMMUIdx_S2NS) {
+            cacheattrs->attrs = convert_stage2_attrs(env,
+                                                     extract32(attrs, 0, 4));
+        } else {
+            /* Index into MAIR registers for cache attributes */
+            uint8_t attrindx = extract32(attrs, 0, 3);
+            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
+            assert(attrindx <= 7);
+            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
+        }
+        cacheattrs->shareability = extract32(attrs, 6, 2);
+    }
+
     *phys_ptr = descaddr;
     *page_size_ptr = page_size;
     return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
     return false;
 }
 
+/* Combine either inner or outer cacheability attributes for normal
+ * memory, according to table D4-42 and pseudocode procedure
+ * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
+ *
+ * NB: only stage 1 includes allocation hints (RW bits), leading to
+ * some asymmetry.
+ */
+static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
+{
+    if (s1 == 4 || s2 == 4) {
+        /* non-cacheable has precedence */
+        return 4;
+    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
+        /* stage 1 write-through takes precedence */
+        return s1;
+    } else if (extract32(s2, 2, 2) == 2) {
+        /* stage 2 write-through takes precedence, but the allocation hint
+         * is still taken from stage 1
+         */
+        return (2 << 2) | extract32(s1, 0, 2);
+    } else { /* write-back */
+        return s1;
+    }
+}
+
+/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
+ * and CombineS1S2Desc()
+ *
+ * @s1:      Attributes from stage 1 walk
+ * @s2:      Attributes from stage 2 walk
+ */
+static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
+{
+    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
+    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
+    ARMCacheAttrs ret;
+
+    /* Combine shareability attributes (table D4-43) */
+    if (s1.shareability == 2 || s2.shareability == 2) {
+        /* if either are outer-shareable, the result is outer-shareable */
+        ret.shareability = 2;
+    } else if (s1.shareability == 3 || s2.shareability == 3) {
+        /* if either are inner-shareable, the result is inner-shareable */
+        ret.shareability = 3;
+    } else {
+        /* both non-shareable */
+        ret.shareability = 0;
+    }
+
+    /* Combine memory type and cacheability attributes */
+    if (s1hi == 0 || s2hi == 0) {
+        /* Device has precedence over normal */
+        if (s1lo == 0 || s2lo == 0) {
+            /* nGnRnE has precedence over anything */
+            ret.attrs = 0;
+        } else if (s1lo == 4 || s2lo == 4) {
+            /* non-Reordering has precedence over Reordering */
+            ret.attrs = 4;  /* nGnRE */
+        } else if (s1lo == 8 || s2lo == 8) {
+            /* non-Gathering has precedence over Gathering */
+            ret.attrs = 8;  /* nGRE */
+        } else {
+            ret.attrs = 0xc; /* GRE */
+        }
+
+        /* Any location for which the resultant memory type is any
+         * type of Device memory is always treated as Outer Shareable.
+         */
+        ret.shareability = 2;
+    } else { /* Normal memory */
+        /* Outer/inner cacheability combine independently */
+        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
+                  | combine_cacheattr_nibble(s1lo, s2lo);
+
+        if (ret.attrs == 0x44) {
+            /* Any location for which the resultant memory type is Normal
+             * Inner Non-cacheable, Outer Non-cacheable is always treated
+             * as Outer Shareable.
+             */
+            ret.shareability = 2;
+        }
+    }
+
+    return ret;
+}
+
+
 /* get_phys_addr - get the physical address for this virtual address
  *
  * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
  * @prot: set to the permissions for the page containing phys_ptr
  * @page_size: set to the size of the page containing phys_ptr
  * @fsr: set to the DFSR/IFSR value on failure
+ * @fi: set to fault info if the translation fails
+ * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
  */
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi)
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
         /* Call ourselves recursively to do the stage 1 and then stage 2
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            ARMCacheAttrs cacheattrs2 = {};
 
             ret = get_phys_addr(env, address, access_type,
                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
-                                prot, page_size, fsr, fi);
+                                prot, page_size, fsr, fi, cacheattrs);
 
             /* If S1 fails or S2 is disabled, return early.  */
             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             /* S1 is done. Now do S2 translation.  */
             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
                                      phys_ptr, attrs, &s2_prot,
-                                     page_size, fsr, fi);
+                                     page_size, fsr, fi,
+                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
             fi->s2addr = ipa;
             /* Combine the S1 and S2 perms.  */
             *prot &= s2_prot;
+
+            /* Combine the S1 and S2 cache attributes, if needed */
+            if (!ret && cacheattrs != NULL) {
+                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+            }
+
             return ret;
         } else {
             /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     if (regime_using_lpae_format(env, mmu_idx)) {
         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
-                                  attrs, prot, page_size, fsr, fi);
+                                  attrs, prot, page_size, fsr, fi, cacheattrs);
     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
                                 attrs, prot, page_size, fsr, fi);
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
 
     ret = get_phys_addr(env, address, access_type,
                         core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
-                        &attrs, &prot, &page_size, fsr, fi);
+                        &attrs, &prot, &page_size, fsr, fi, NULL);
     if (!ret) {
         /* Map a single [sub]page.  */
         phys_addr &= TARGET_PAGE_MASK;
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     *attrs = (MemTxAttrs) {};
 
     ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-                        attrs, &prot, &page_size, &fsr, &fi);
+                        attrs, &prot, &page_size, &fsr, &fi, NULL);
 
     if (ret) {
         return -1;
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

This device causes QEMU to abort if the user tries to instantiate it:

$ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
Aborted (core dumped)

The device uses serial_hds[] directly in its realize function, so it
can not be instantiated again by the user.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx6_realize;
-
     dc->desc = "i.MX6 SOC";
+    /* Reason: Uses serial_hds[] in the realize() function */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx6_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx25
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)

The imx25-pdk board (which is the one that uses this CPU type) only
supports one CPU, and the realize function of the "fsl,imx25" device
also uses serial_hds[] directly, so this device clearly can not be
instantiated twice and thus we should mark it with user_creatable = 0.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx25.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx25_realize;
-
     dc->desc = "i.MX25 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the imx25 board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx25_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx31
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)
Aborted (core dumped)

The kzm board (which is the one that uses this CPU type) only supports
one CPU, and the realize function of the "fsl,imx31" device also uses
serial_hds[] directly, so this device clearly can not be instantiated
twice and thus we should mark it with user_creatable = false.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx31.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx31_realize;
-
     dc->desc = "i.MX31 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the kzm board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx31_type_info = {
-- 
2.7.4

For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
lowest address is always Rt and the one at addr+4 is Rt2, even if the
CPU is big-endian. Our implementation does these with a single
64-bit store, so if we're big-endian then we need to put the two
32-bit halves together in the opposite order to little-endian,
so that they end up in the right places. We were trying to do
this with the gen_aa32_frob64() function, but that is not correct
for the usermode emulator, because there there is a distinction
between "load a 64 bit value" (which does a BE 64-bit access
and doesn't need swapping) and "load two 32 bit values as one
64 bit access" (where we still need to do the swapping, like
system mode BE32).

Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
         TCGv_i32 tmp2 = tcg_temp_new_i32();
         TCGv_i64 t64 = tcg_temp_new_i64();
 
-        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. That means we don't want to do a
+         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
+         * for an architecturally 64-bit access, but instead do a
+         * 64-bit access using MO_BE if appropriate and then split
+         * the two halves.
+         * This only makes a difference for BE32 user-mode, where
+         * frob64() must not flip the two halves of the 64-bit data
+         * but this code must treat BE32 user-mode like BE32 system.
+         */
+        TCGv taddr = gen_aa32_addr(s, addr, opc);
+
+        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
+        tcg_temp_free(taddr);
         tcg_gen_mov_i64(cpu_exclusive_val, t64);
-        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        if (s->be_data == MO_BE) {
+            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
+        } else {
+            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        }
         tcg_temp_free_i64(t64);
 
         store_reg(s, rt2, tmp2);
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         TCGv_i64 n64 = tcg_temp_new_i64();
 
         t2 = load_reg(s, rt2);
-        tcg_gen_concat_i32_i64(n64, t1, t2);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. Since we're going to treat this as a
+         * single 64-bit BE store, we need to put the two halves in the
+         * opposite order for BE to LE, so that they end up in the right
+         * places.
+         * We don't want gen_aa32_frob64() because that does the wrong
+         * thing for BE32 usermode.
+         */
+        if (s->be_data == MO_BE) {
+            tcg_gen_concat_i32_i64(n64, t2, t1);
+        } else {
+            tcg_gen_concat_i32_i64(n64, t1, t2);
+        }
         tcg_temp_free_i32(t2);
-        gen_aa32_frob64(s, n64);
 
         tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
                                    get_mem_index(s), opc);
         tcg_temp_free_i64(n64);
 
-        gen_aa32_frob64(s, o64);
         tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
         tcg_gen_extrl_i64_i32(t0, o64);
 
-- 
2.7.4

From: Shanker Donthineni <shankerd@codeaurora.org>

The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
/restore") breaks the backward compatibility with the older kernels
where vITS save/restore support is not available. The vmstate function
vm_change_state_handler() should not be registered if the running kernel
doesn't support ITS save/restore feature. Otherwise VM instance will be
killed whenever vmstate callback function is invoked.

Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.

KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'

Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
             error_free(s->migration_blocker);
             return;
         }
+    } else {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
     }
 
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-
-    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 /**
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

The ITS is not fully properly reset at the moment. Caches are
not emptied.

After a reset, in case we attempt to save the state before
the bound devices have registered their MSIs and after the
1st level table has been allocated by the ITS driver
(device BASER is valid), the first level entries are still
invalid. If the device cache is not empty (devices registered
before the reset), vgic_its_save_device_tables fails with -EINVAL.
This causes a QEMU abort().

Cc: qemu-stable@nongnu.org
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
 {
     GICv3ITSState *s = (GICv3ITSState *)opaque;
     Error *err = NULL;
-    int ret;
 
     if (running) {
         return;
     }
 
-    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
     if (err) {
         error_report_err(err);
     }
-    if (ret < 0 && ret != -EFAULT) {
-        abort();
-    }
 }
 
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-- 
2.7.4

Some more outstanding target-arm patches; nothing terribly
exciting. Mostly they're mine; I'm trying to reduce the
number of patches I still have in flight, so I've picked
out some of the reviewed patches from a couple of sets I've
sent out and will resend v2 versions of those sets with the
remaining patches with fixes for issues noted in review once
this is in master.

thanks
-- PMM

The following changes since commit adaec191bfb31e12d40af8ab1b869f5b40d61ee9:

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-08-20 09:48:03 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180820

for you to fetch changes up to b85fad1588e812566f897f747e38da345a7016d6:

hw/dma/pl080: Remove hw_error() if DMA is enabled (2018-08-20 11:24:33 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix crash on conditional instruction in an IT block
 * docs/generic-loader: mention U-Boot and Intel HEX executable formats
 * hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset
 * imx_serial: Generate interrupt on receive data ready if enabled
 * Fix various minor bugs in AArch32 Hyp related coprocessor registers
 * Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
 * Implement AArch32 ERET instruction
 * hw/arm/virt: Add virt-3.1 machine type
 * sdhci: add i.MX SD Stable Clock bit
 * Remove now-obsolete MMIO request_ptr APIs
 * hw/timer/m48t59: Move away from old_mmio accessors
 * hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module
 * nvic: Expose NMI line
 * hw/dma/pl080: cleanups and new features required for use in MPS boards

----------------------------------------------------------------
Andrew Jones (1):
      hw/arm/virt: Add virt-3.1 machine type

Hans-Erik Floryd (2):
      imx_serial: Generate interrupt on receive data ready if enabled
      sdhci: add i.MX SD Stable Clock bit

Jia He (1):
      hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

Peter Maydell (19):
      target/arm: Correct typo in HAMAIR1 regdef name
      target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs
      target/arm: Implement AArch32 HVBAR
      target/arm: Implement AArch32 Hyp FARs
      target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2
      target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)
      target/arm: Implement AArch32 ERET instruction
      hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code
      memory: Remove MMIO request_ptr APIs
      hw/misc: Remove mmio_interface device
      hw/timer/m48t59: Move away from old_mmio accessors
      hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module
      nvic: Expose NMI line
      hw/dma/pl080: Allow use as embedded-struct device
      hw/dma/pl080: Support all three interrupt lines
      hw/dma/pl080: Don't use CPU address space for DMA accesses
      hw/dma/pl080: Provide device reset function
      hw/dma/pl080: Correct bug in register address decode logic
      hw/dma/pl080: Remove hw_error() if DMA is enabled

Roman Kapl (1):
      target/arm: Fix crash on conditional instruction in an IT block

Stefan Hajnoczi (1):
      docs/generic-loader: mention U-Boot and Intel HEX executable formats

From: Roman Kapl <rka@sysgo.com>

If an instruction is conditional (like CBZ) and it is executed
conditionally (using the ITx instruction), a jump to an undefined
label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not
crash.  Honouring the condition code is allowed by the spec in this
case (constrained unpredictable, ARMv8, section K1.1.7), and matches
what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it
does not already exist.  Previously multiple labels were created, but
only the last one of them was set.

Signed-off-by: Roman Kapl <rka@sysgo.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180816120533.6587-1-rka@sysgo.com
[PMM: fixed ^ 1 being applied to wrong argument, fixed typo]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
     s->base.is_jmp = DISAS_UPDATE;
 }
 
+/* Generate a label used for skipping this instruction */
+static void arm_gen_condlabel(DisasContext *s)
+{
+    if (!s->condjmp) {
+        s->condlabel = gen_new_label();
+        s->condjmp = 1;
+    }
+}
+
+/* Skip this instruction if the ARM condition is false */
+static void arm_skip_unless(DisasContext *s, uint32_t cond)
+{
+    arm_gen_condlabel(s);
+    arm_gen_test_cc(cond ^ 1, s->condlabel);
+}
+
 static void disas_arm_insn(DisasContext *s, unsigned int insn)
 {
     unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     if (cond != 0xe) {
         /* if not always execute, we generate a conditional jump to
            next instruction */
-        s->condlabel = gen_new_label();
-        arm_gen_test_cc(cond ^ 1, s->condlabel);
-        s->condjmp = 1;
+        arm_skip_unless(s, cond);
     }
     if ((insn & 0x0f900000) == 0x03000000) {
         if ((insn & (1 << 21)) == 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 /* Conditional branch.  */
                 op = (insn >> 22) & 0xf;
                 /* Generate a conditional jump to next instruction.  */
-                s->condlabel = gen_new_label();
-                arm_gen_test_cc(op ^ 1, s->condlabel);
-                s->condjmp = 1;
+                arm_skip_unless(s, op);
 
                 /* offset[11:1] = insn[10:0] */
                 offset = (insn & 0x7ff) << 1;
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
         case 1: case 3: case 9: case 11: /* czb */
             rm = insn & 7;
             tmp = load_reg(s, rm);
-            s->condlabel = gen_new_label();
-            s->condjmp = 1;
+            arm_gen_condlabel(s);
             if (insn & (1 << 11))
                 tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);
             else
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)
             break;
         }
         /* generate a conditional jump to next instruction */
-        s->condlabel = gen_new_label();
-        arm_gen_test_cc(cond ^ 1, s->condlabel);
-        s->condjmp = 1;
+        arm_skip_unless(s, cond);
 
         /* jump to the offset */
         val = (uint32_t)s->pc + 2;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         uint32_t cond = dc->condexec_cond;
 
         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
-            dc->condlabel = gen_new_label();
-            arm_gen_test_cc(cond ^ 1, dc->condlabel);
-            dc->condjmp = 1;
+            arm_skip_unless(dc, cond);
         }
     }
 
-- 
2.18.0

From: Stefan Hajnoczi <stefanha@redhat.com>

The generic loader device supports the U-Boot and Intel HEX executable
formats in addition to the document raw and ELF formats.  Reword the
documentation to include these formats and explain how various options
depend on the executable format.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20180816145554.9814-1-stefanha@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/generic-loader.txt | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/generic-loader.txt b/docs/generic-loader.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/generic-loader.txt
+++ b/docs/generic-loader.txt
@@ -XXX,XX +XXX,XX @@ An example of setting CPU 0's PC to 0x8000 is:
 
 Loading Files
 -------------
-The loader device also allows files to be loaded into memory. It can load raw
-files and ELF executable files.  Raw files are loaded verbatim.  ELF executable
-files are loaded by an ELF loader.  The syntax is shown below:
+The loader device also allows files to be loaded into memory. It can load ELF,
+U-Boot, and Intel HEX executable formats as well as raw images.  The syntax is
+shown below:
 
     -device loader,file=<file>[,addr=<addr>][,cpu-num=<cpu-num>][,force-raw=<raw>]
 
     <file>      - A file to be loaded into memory
-    <addr>      - The addr in memory that the file should be loaded. This is
-                  ignored if you are using an ELF (unless force-raw is true).
-                  This is required if you aren't loading an ELF.
+    <addr>      - The memory address where the file should be loaded. This is
+                  required for raw images and ignored for non-raw files.
     <cpu-num>   - This specifies the CPU that should be used. This is an
                   optional argument and will cause the CPU's PC to be set to
-                  where the image is stored or in the case of an ELF file to
-                  the value in the header. This option should only be used
-                  for the boot image.
+                  the memory address where the raw file is loaded or the entry
+                  point specified in the executable format header. This option
+                  should only be used for the boot image.
                   This will also cause the image to be written to the specified
                   CPU's address space. If not specified, the default is CPU 0.
     <force-raw> - Setting force-raw=on forces the file to be treated as a raw
-                  image.  This can be used to load ELF files as if they were raw.
+                  image.  This can be used to load supported executable formats
+                  as if they were raw.
 
 All values are parsed using the standard QemuOps parsing. This allows the user
 to specify any values in any format supported. By default the values
-- 
2.18.0

From: Jia He <hejianet@gmail.com>

In scripts/arch-run.bash of kvm-unit-tests, it will check the qemu
output log with:
if [ -z "$(echo "$errors" | grep -vi warning)" ]; then

Thus without the warning prefix, all of the test fail.

Since it is not unrecoverable error in kvm_arm_its_reset for
current implementation, downgrading the report from error to
warn makes sense.

Signed-off-by: Jia He <jia.he@hxt-semitech.com>
Message-id: 1531969910-32843-1-git-send-email-jia.he@hxt-semitech.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_reset(DeviceState *dev)
         return;
     }
 
-    error_report("ITS KVM: full reset is not supported by the host kernel");
+    warn_report("ITS KVM: full reset is not supported by the host kernel");
 
     if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
                                GITS_CTLR)) {
-- 
2.18.0

From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Generate an interrupt if USR2_RDR and UCR4_DREN are both set.

Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
Message-id: 1534341354-11956-1-git-send-email-hans-erik.floryd@rt-labs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h | 1 +
 hw/char/imx_serial.c         | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_DREN       BIT(0)    /* Receive Data Ready interrupt enable */
 #define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
 
 #define UTS1_TXEMPTY    (1<<6)
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
     /*
      * TCEN and TXDC are both bit 3
+     * RDR and DREN are both bit 0
      */
-    mask |= s->ucr4 & UCR4_TCEN;
+    mask |= s->ucr4 & (UCR4_TCEN | UCR4_DREN);
 
     usr2 = s->usr2 & mask;
 
-- 
2.18.0

We implement the HAMAIR1 register as RAZ/WI; we had a typo in the
regdef, though, and were incorrectly naming it HMAIR1 (which is
a different register which we also implement as RAZ/WI).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-2-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
-    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
+    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
-    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
+    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
       .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
-- 
2.18.0

ARMCPRegInfo structs will default to .cp = 15 if they
are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32
(because a coprocessor number of 0 is valid for AArch32).
We forgot to explicitly set .cp = 15 for the HMAIR1 and
HAMAIR1 regdefs, which meant they would UNDEF when the guest
tried to access them under cp15.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-3-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
-      .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
+      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
-      .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),
       .resetvalue = 0 },
     { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
-      .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
+      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_ALIAS,
       .fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },
     { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .resetvalue = 0 },
     /* HAMAIR1 is mapped to AMAIR_EL2[63:32] */
     { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
-      .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
       .access = PL2_RW, .type = ARM_CP_CONST,
       .resetvalue = 0 },
     { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
-- 
2.18.0

Implement the AArch32 HVBAR register; we can do this just by
making the existing VBAR_EL2 regdefs be STATE_BOTH.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
 
 /* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
 static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
-    { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
+    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
       .access = PL2_RW,
       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
       .access = PL2_RW,
       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
-    { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,
+    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
       .access = PL2_RW, .writefn = vbar_write,
       .fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),
-- 
2.18.0

The AArch32 virtualization extensions support these fault address
registers:
 * HDFAR: aliased with AArch64 FAR_EL2[31:0] and AArch32 DFAR(S)
 * HIFAR: aliased with AArch64 FAR_EL2[63:32] and AArch32 IFAR(S)

Implement the accessors for these. This fixes in passing a bug
where we weren't implementing the "RES0 from EL3 if EL2 not
implemented" behaviour for AArch64 FAR_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
     { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
+      .type = ARM_CP_CONST,
+      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
+      .access = PL2_RW, .resetvalue = 0 },
     REGINFO_SENTINEL
 };
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
-    { .name = "FAR_EL2", .state = ARM_CP_STATE_AA64,
+    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.far_el[2]) },
+    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
+      .type = ARM_CP_ALIAS,
+      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
+      .access = PL2_RW,
+      .fieldoffset = offsetofhigh32(CPUARMState, cp15.far_el[2]) },
     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
-- 
2.18.0

The AArch32 HSR is the equivalent of AArch64 ESR_EL2;
we can implement it by marking our existing ESR_EL2 regdef
as STATE_BOTH. It also needs to be "RES0 from EL3 if
EL2 not implemented", so add the missing stanza to
el3_no_el2_cp_reginfo.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-8-peter.maydell@linaro.org
---
 target/arm/helper.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW,
       .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
+    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
+      .access = PL2_RW,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
       .access = PL2_RW,
       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
-    { .name = "ESR_EL2", .state = ARM_CP_STATE_AA64,
+    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.esr_el[2]) },
     { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
-- 
2.18.0

The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp
from either Monitor or Hyp mode. Our translate time check
was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the
correct code in it, but never got there because of the earlier
"currmode == tgtmode" check. Special case ELR_Hyp.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-9-peter.maydell@linaro.org
---
 target/arm/op_helper.c | 22 +++++++++++-----------
 target/arm/translate.c | 10 +++++++---
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
      */
     int curmode = env->uncached_cpsr & CPSR_M;
 
+    if (regno == 17) {
+        /* ELR_Hyp: a special case because access from tgtmode is OK */
+        if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
+            goto undef;
+        }
+        return;
+    }
+
     if (curmode == tgtmode) {
         goto undef;
     }
@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,
     }
 
     if (tgtmode == ARM_CPU_MODE_HYP) {
-        switch (regno) {
-        case 17: /* ELR_Hyp */
-            if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {
-                goto undef;
-            }
-            break;
-        default:
-            if (curmode != ARM_CPU_MODE_MON) {
-                goto undef;
-            }
-            break;
+        /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */
+        if (curmode != ARM_CPU_MODE_MON) {
+            goto undef;
         }
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
         }
         break;
     case ARM_CPU_MODE_HYP:
-        /* Note that we can forbid accesses from EL2 here because they
-         * must be from Hyp mode itself
+        /*
+         * SPSR_hyp and r13_hyp can only be accessed from Monitor mode
+         * (and so we can forbid accesses from EL2 or below). elr_hyp
+         * can be accessed also from Hyp mode, so forbid accesses from
+         * EL0 or EL1.
          */
-        if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 3) {
+        if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 2 ||
+            (s->current_el < 3 && *regno != 17)) {
             goto undef;
         }
         break;
-- 
2.18.0

ARMv7VE introduced the ERET instruction, which is necessary to
return from an exception taken to Hyp mode. Implement this.
In A32 encoding it is a completely new encoding; in T32 it
is an adjustment of the behaviour of the existing
"SUBS PC, LR, #<imm8>" instruction.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180814124254.5229-10-peter.maydell@linaro.org
---
 target/arm/translate.c | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             tcg_temp_free_i32(tmp2);
             store_reg(s, rd, tmp);
             break;
+        case 0x6: /* ERET */
+            if (op1 != 3) {
+                goto illegal_op;
+            }
+            if (!arm_dc_feature(s, ARM_FEATURE_V7VE)) {
+                goto illegal_op;
+            }
+            if ((insn & 0x000fff0f) != 0x0000000e) {
+                /* UNPREDICTABLE; we choose to UNDEF */
+                goto illegal_op;
+            }
+
+            if (s->current_el == 2) {
+                tmp = load_cpu_field(elr_el[2]);
+            } else {
+                tmp = load_reg(s, 14);
+            }
+            gen_exception_return(s, tmp);
+            break;
         case 7:
         {
             int imm16 = extract32(insn, 0, 4) | (extract32(insn, 8, 12) << 4);
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                         if (rn != 14 || rd != 15) {
                             goto illegal_op;
                         }
-                        tmp = load_reg(s, rn);
-                        tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
+                        if (s->current_el == 2) {
+                            /* ERET from Hyp uses ELR_Hyp, not LR */
+                            if (insn & 0xff) {
+                                goto illegal_op;
+                            }
+                            tmp = load_cpu_field(elr_el[2]);
+                        } else {
+                            tmp = load_reg(s, rn);
+                            tcg_gen_subi_i32(tmp, tmp, insn & 0xff);
+                        }
                         gen_exception_return(s, tmp);
                         break;
                     case 6: /* MRS */
-- 
2.18.0

From: Andrew Jones <drjones@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-#define VIRT_COMPAT_2_12 \
-    HW_COMPAT_2_12
-
-static void virt_3_0_instance_init(Object *obj)
+static void virt_3_1_instance_init(Object *obj)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
     vms->irqmap = a15irqmap;
 }
 
-static void virt_machine_3_0_options(MachineClass *mc)
+static void virt_machine_3_1_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(3, 0)
+DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
+
+static void virt_3_0_instance_init(Object *obj)
+{
+    virt_3_1_instance_init(obj);
+}
+
+static void virt_machine_3_0_options(MachineClass *mc)
+{
+    virt_machine_3_1_options(mc);
+}
+DEFINE_VIRT_MACHINE(3, 0)
+
+#define VIRT_COMPAT_2_12 \
+    HW_COMPAT_2_12
 
 static void virt_2_12_instance_init(Object *obj)
 {
-- 
2.18.0

From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Add the ESDHC PRSSTAT_SDSTB bit, using the value of SDHC_CLOCK_INT_STABLE.
Freescale recommends checking this bit when changing clock frequency.

Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>
Message-id: 1534507843-4251-1-git-send-email-hans-erik.floryd@rt-labs.com
[PMM: fixed indentation]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 2 ++
 hw/sd/sdhci.c          | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription sdhci_vmstate;
 #define ESDHC_CTRL_4BITBUS              (0x1 << 1)
 #define ESDHC_CTRL_8BITBUS              (0x2 << 1)
 
+#define ESDHC_PRNSTS_SDSTB              (1 << 3)
+
 #endif
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)
 
         break;
 
+    case SDHC_PRNSTS:
+        /* Add SDSTB (SD Clock Stable) bit to PRNSTS */
+        ret = sdhci_read(opaque, offset, size) & ~ESDHC_PRNSTS_SDSTB;
+        if (s->clkcon & SDHC_CLOCK_INT_STABLE) {
+            ret |= ESDHC_PRNSTS_SDSTB;
+        }
+        break;
+
     case ESDHC_DLL_CTRL:
     case ESDHC_TUNE_CTRL_STATUS:
     case ESDHC_UNDOCUMENTED_REG27:
-- 
2.18.0

We now support direct execution from MMIO regions in the
core memory subsystem. This means that we don't need to
have device-specific support for it, and we can remove
the request_ptr handling from the Xilinx SPIPS device.
(It was broken anyway due to race conditions, and disabled
by default.)

This device is the only in-tree user of this API.

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps spips_ops = {
 
 static void xilinx_qspips_invalidate_mmio_ptr(XilinxQSPIPS *q)
 {
-    XilinxSPIPS *s = &q->parent_obj;
-
-    if ((q->mmio_execution_enabled) && (q->lqspi_cached_addr != ~0ULL)) {
-        /* Invalidate the current mapped mmio */
-        memory_region_invalidate_mmio_ptr(&s->mmlqspi, q->lqspi_cached_addr,
-                                          LQSPI_CACHE_SIZE);
-    }
-
     q->lqspi_cached_addr = ~0ULL;
 }
 
@@ -XXX,XX +XXX,XX @@ static void lqspi_load_cache(void *opaque, hwaddr addr)
     }
 }
 
-static void *lqspi_request_mmio_ptr(void *opaque, hwaddr addr, unsigned *size,
-                                    unsigned *offset)
-{
-    XilinxQSPIPS *q = opaque;
-    hwaddr offset_within_the_region;
-
-    if (!q->mmio_execution_enabled) {
-        return NULL;
-    }
-
-    offset_within_the_region = addr & ~(LQSPI_CACHE_SIZE - 1);
-    lqspi_load_cache(opaque, offset_within_the_region);
-    *size = LQSPI_CACHE_SIZE;
-    *offset = offset_within_the_region;
-    return q->lqspi_buf;
-}
-
 static uint64_t
 lqspi_read(void *opaque, hwaddr addr, unsigned int size)
 {
@@ -XXX,XX +XXX,XX @@ lqspi_read(void *opaque, hwaddr addr, unsigned int size)
 
 static const MemoryRegionOps lqspi_ops = {
     .read = lqspi_read,
-    .request_ptr = lqspi_request_mmio_ptr,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
         .min_access_size = 1,
@@ -XXX,XX +XXX,XX @@ static void xilinx_qspips_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->mmlqspi);
 
     q->lqspi_cached_addr = ~0ULL;
-
-    /* mmio_execution breaks migration better aborting than having strange
-     * bugs.
-     */
-    if (q->mmio_execution_enabled) {
-        error_setg(&q->migration_blocker,
-                   "enabling mmio_execution breaks migration");
-        migrate_add_blocker(q->migration_blocker, &error_fatal);
-    }
 }
 
 static void xlnx_zynqmp_qspips_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static Property xilinx_zynqmp_qspips_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static Property xilinx_qspips_properties[] = {
-    /* We had to turn this off for 2.10 as it is not compatible with migration.
-     * It can be enabled but will prevent the device to be migrated.
-     * This will go aways when a fix will be released.
-     */
-    DEFINE_PROP_BOOL("x-mmio-exec", XilinxQSPIPS, mmio_execution_enabled,
-                     false),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static Property xilinx_spips_properties[] = {
     DEFINE_PROP_UINT8("num-busses", XilinxSPIPS, num_busses, 1),
     DEFINE_PROP_UINT8("num-ss-bits", XilinxSPIPS, num_cs, 4),
@@ -XXX,XX +XXX,XX @@ static void xilinx_qspips_class_init(ObjectClass *klass, void * data)
     XilinxSPIPSClass *xsc = XILINX_SPIPS_CLASS(klass);
 
     dc->realize = xilinx_qspips_realize;
-    dc->props = xilinx_qspips_properties;
     xsc->reg_ops = &qspips_ops;
     xsc->rx_fifo_size = RXFF_A_Q;
     xsc->tx_fifo_size = TXFF_A_Q;
-- 
2.18.0

Remove the obsolete MMIO request_ptr APIs; they have no
users now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
Message-id: 20180817114619.22354-3-peter.maydell@linaro.org
---
 include/exec/memory.h |  35 --------------
 memory.c              | 110 ------------------------------------------
 2 files changed, 145 deletions(-)

diff --git a/include/exec/memory.h b/include/exec/memory.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -XXX,XX +XXX,XX @@ struct MemoryRegionOps {
                                     uint64_t data,
                                     unsigned size,
                                     MemTxAttrs attrs);
-    /* Instruction execution pre-callback:
-     * @addr is the address of the access relative to the @mr.
-     * @size is the size of the area returned by the callback.
-     * @offset is the location of the pointer inside @mr.
-     *
-     * Returns a pointer to a location which contains guest code.
-     */
-    void *(*request_ptr)(void *opaque, hwaddr addr, unsigned *size,
-                         unsigned *offset);
 
     enum device_endian endianness;
     /* Guest-visible constraints: */
@@ -XXX,XX +XXX,XX @@ void memory_global_dirty_log_stop(void);
 void mtree_info(fprintf_function mon_printf, void *f, bool flatview,
                 bool dispatch_tree, bool owner);
 
-/**
- * memory_region_request_mmio_ptr: request a pointer to an mmio
- * MemoryRegion. If it is possible map a RAM MemoryRegion with this pointer.
- * When the device wants to invalidate the pointer it will call
- * memory_region_invalidate_mmio_ptr.
- *
- * @mr: #MemoryRegion to check
- * @addr: address within that region
- *
- * Returns true on success, false otherwise.
- */
-bool memory_region_request_mmio_ptr(MemoryRegion *mr, hwaddr addr);
-
-/**
- * memory_region_invalidate_mmio_ptr: invalidate the pointer to an mmio
- * previously requested.
- * In the end that means that if something wants to execute from this area it
- * will need to request the pointer again.
- *
- * @mr: #MemoryRegion associated to the pointer.
- * @offset: offset within the memory region
- * @size: size of that area.
- */
-void memory_region_invalidate_mmio_ptr(MemoryRegion *mr, hwaddr offset,
-                                       unsigned size);
-
 /**
  * memory_region_dispatch_read: perform a read directly to the specified
  * MemoryRegion.
diff --git a/memory.c b/memory.c
index XXXXXXX..XXXXXXX 100644
--- a/memory.c
+++ b/memory.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/ram_addr.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
-#include "hw/misc/mmio_interface.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ void memory_listener_unregister(MemoryListener *listener)
     listener->address_space = NULL;
 }
 
-bool memory_region_request_mmio_ptr(MemoryRegion *mr, hwaddr addr)
-{
-    void *host;
-    unsigned size = 0;
-    unsigned offset = 0;
-    Object *new_interface;
-
-    if (!mr || !mr->ops->request_ptr) {
-        return false;
-    }
-
-    /*
-     * Avoid an update if the request_ptr call
-     * memory_region_invalidate_mmio_ptr which seems to be likely when we use
-     * a cache.
-     */
-    memory_region_transaction_begin();
-
-    host = mr->ops->request_ptr(mr->opaque, addr - mr->addr, &size, &offset);
-
-    if (!host || !size) {
-        memory_region_transaction_commit();
-        return false;
-    }
-
-    new_interface = object_new("mmio_interface");
-    qdev_prop_set_uint64(DEVICE(new_interface), "start", offset);
-    qdev_prop_set_uint64(DEVICE(new_interface), "end", offset + size - 1);
-    qdev_prop_set_bit(DEVICE(new_interface), "ro", true);
-    qdev_prop_set_ptr(DEVICE(new_interface), "host_ptr", host);
-    qdev_prop_set_ptr(DEVICE(new_interface), "subregion", mr);
-    object_property_set_bool(OBJECT(new_interface), true, "realized", NULL);
-
-    memory_region_transaction_commit();
-    return true;
-}
-
-typedef struct MMIOPtrInvalidate {
-    MemoryRegion *mr;
-    hwaddr offset;
-    unsigned size;
-    int busy;
-    int allocated;
-} MMIOPtrInvalidate;
-
-#define MAX_MMIO_INVALIDATE 10
-static MMIOPtrInvalidate mmio_ptr_invalidate_list[MAX_MMIO_INVALIDATE];
-
-static void memory_region_do_invalidate_mmio_ptr(CPUState *cpu,
-                                                 run_on_cpu_data data)
-{
-    MMIOPtrInvalidate *invalidate_data = (MMIOPtrInvalidate *)data.host_ptr;
-    MemoryRegion *mr = invalidate_data->mr;
-    hwaddr offset = invalidate_data->offset;
-    unsigned size = invalidate_data->size;
-    MemoryRegionSection section = memory_region_find(mr, offset, size);
-
-    qemu_mutex_lock_iothread();
-
-    /* Reset dirty so this doesn't happen later. */
-    cpu_physical_memory_test_and_clear_dirty(offset, size, 1);
-
-    if (section.mr != mr) {
-        /* memory_region_find add a ref on section.mr */
-        memory_region_unref(section.mr);
-        if (MMIO_INTERFACE(section.mr->owner)) {
-            /* We found the interface just drop it. */
-            object_property_set_bool(section.mr->owner, false, "realized",
-                                     NULL);
-            object_unref(section.mr->owner);
-            object_unparent(section.mr->owner);
-        }
-    }
-
-    qemu_mutex_unlock_iothread();
-
-    if (invalidate_data->allocated) {
-        g_free(invalidate_data);
-    } else {
-        invalidate_data->busy = 0;
-    }
-}
-
-void memory_region_invalidate_mmio_ptr(MemoryRegion *mr, hwaddr offset,
-                                       unsigned size)
-{
-    size_t i;
-    MMIOPtrInvalidate *invalidate_data = NULL;
-
-    for (i = 0; i < MAX_MMIO_INVALIDATE; i++) {
-        if (atomic_cmpxchg(&(mmio_ptr_invalidate_list[i].busy), 0, 1) == 0) {
-            invalidate_data = &mmio_ptr_invalidate_list[i];
-            break;
-        }
-    }
-
-    if (!invalidate_data) {
-        invalidate_data = g_malloc0(sizeof(MMIOPtrInvalidate));
-        invalidate_data->allocated = 1;
-    }
-
-    invalidate_data->mr = mr;
-    invalidate_data->offset = offset;
-    invalidate_data->size = size;
-
-    async_safe_run_on_cpu(first_cpu, memory_region_do_invalidate_mmio_ptr,
-                          RUN_ON_CPU_HOST_PTR(invalidate_data));
-}
-
 void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name)
 {
     memory_region_ref(root);
-- 
2.18.0

The mmio_interface device was a purely internal artifact
of the implementation of the memory subsystem's request_ptr
APIs. Now that we have removed those APIs, we can remove
the mmio_interface device too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>
Message-id: 20180817114619.22354-4-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs            |   1 -
 include/hw/misc/mmio_interface.h |  49 -----------
 hw/misc/mmio_interface.c         | 135 -------------------------------
 3 files changed, 185 deletions(-)
 delete mode 100644 include/hw/misc/mmio_interface.h
 delete mode 100644 hw/misc/mmio_interface.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_PVPANIC) += pvpanic.o
 obj-$(CONFIG_HYPERV_TESTDEV) += hyperv_testdev.o
 obj-$(CONFIG_AUX) += auxbus.o
 obj-$(CONFIG_ASPEED_SOC) += aspeed_scu.o aspeed_sdmc.o
-obj-y += mmio_interface.o
 obj-$(CONFIG_MSF2) += msf2-sysreg.o
diff --git a/include/hw/misc/mmio_interface.h b/include/hw/misc/mmio_interface.h
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/include/hw/misc/mmio_interface.h
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * mmio_interface.h
- *
- *  Copyright (C) 2017 : GreenSocs
- *      http://www.greensocs.com/ , email: info@greensocs.com
- *
- *  Developed by :
- *  Frederic Konrad   <fred.konrad@greensocs.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 2 of the License, or
- * (at your option)any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#ifndef MMIO_INTERFACE_H
-#define MMIO_INTERFACE_H
-
-#include "exec/memory.h"
-
-#define TYPE_MMIO_INTERFACE "mmio_interface"
-#define MMIO_INTERFACE(obj) OBJECT_CHECK(MMIOInterface, (obj),                 \
-                                         TYPE_MMIO_INTERFACE)
-
-typedef struct MMIOInterface {
-    DeviceState parent_obj;
-
-    MemoryRegion *subregion;
-    MemoryRegion ram_mem;
-    uint64_t start;
-    uint64_t end;
-    bool ro;
-    uint64_t id;
-    void *host_ptr;
-} MMIOInterface;
-
-void mmio_interface_map(MMIOInterface *s);
-void mmio_interface_unmap(MMIOInterface *s);
-
-#endif /* MMIO_INTERFACE_H */
diff --git a/hw/misc/mmio_interface.c b/hw/misc/mmio_interface.c
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/hw/misc/mmio_interface.c
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * mmio_interface.c
- *
- *  Copyright (C) 2017 : GreenSocs
- *      http://www.greensocs.com/ , email: info@greensocs.com
- *
- *  Developed by :
- *  Frederic Konrad   <fred.konrad@greensocs.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 2 of the License, or
- * (at your option)any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu/log.h"
-#include "trace.h"
-#include "hw/qdev-properties.h"
-#include "hw/misc/mmio_interface.h"
-#include "qapi/error.h"
-
-#ifndef DEBUG_MMIO_INTERFACE
-#define DEBUG_MMIO_INTERFACE 0
-#endif
-
-static uint64_t mmio_interface_counter;
-
-#define DPRINTF(fmt, ...) do {                                                 \
-    if (DEBUG_MMIO_INTERFACE) {                                                \
-        qemu_log("mmio_interface: 0x%" PRIX64 ": " fmt, s->id, ## __VA_ARGS__);\
-    }                                                                          \
-} while (0)
-
-static void mmio_interface_init(Object *obj)
-{
-    MMIOInterface *s = MMIO_INTERFACE(obj);
-
-    if (DEBUG_MMIO_INTERFACE) {
-        s->id = mmio_interface_counter++;
-    }
-
-    DPRINTF("interface created\n");
-    s->host_ptr = 0;
-    s->subregion = 0;
-}
-
-static void mmio_interface_realize(DeviceState *dev, Error **errp)
-{
-    MMIOInterface *s = MMIO_INTERFACE(dev);
-
-    DPRINTF("realize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
-            " %p\n", s->start, s->end, s->host_ptr);
-
-    if (!s->host_ptr) {
-        error_setg(errp, "host_ptr property must be set");
-        return;
-    }
-
-    if (!s->subregion) {
-        error_setg(errp, "subregion property must be set");
-        return;
-    }
-
-    memory_region_init_ram_ptr(&s->ram_mem, OBJECT(s), "ram",
-                               s->end - s->start + 1, s->host_ptr);
-    memory_region_set_readonly(&s->ram_mem, s->ro);
-    memory_region_add_subregion(s->subregion, s->start, &s->ram_mem);
-}
-
-static void mmio_interface_unrealize(DeviceState *dev, Error **errp)
-{
-    MMIOInterface *s = MMIO_INTERFACE(dev);
-
-    DPRINTF("unrealize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
-            " %p\n", s->start, s->end, s->host_ptr);
-    memory_region_del_subregion(s->subregion, &s->ram_mem);
-}
-
-static void mmio_interface_finalize(Object *obj)
-{
-    MMIOInterface *s = MMIO_INTERFACE(obj);
-
-    DPRINTF("finalize from 0x%" PRIX64 " to 0x%" PRIX64 " map host pointer"
-            " %p\n", s->start, s->end, s->host_ptr);
-    object_unparent(OBJECT(&s->ram_mem));
-}
-
-static Property mmio_interface_properties[] = {
-    DEFINE_PROP_UINT64("start", MMIOInterface, start, 0),
-    DEFINE_PROP_UINT64("end", MMIOInterface, end, 0),
-    DEFINE_PROP_PTR("host_ptr", MMIOInterface, host_ptr),
-    DEFINE_PROP_BOOL("ro", MMIOInterface, ro, false),
-    DEFINE_PROP_MEMORY_REGION("subregion", MMIOInterface, subregion),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void mmio_interface_class_init(ObjectClass *oc, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    dc->realize = mmio_interface_realize;
-    dc->unrealize = mmio_interface_unrealize;
-    dc->props = mmio_interface_properties;
-    /* Reason: pointer property "host_ptr", and this device
-     * is an implementation detail of the memory subsystem,
-     * not intended to be created directly by the user.
-     */
-    dc->user_creatable = false;
-}
-
-static const TypeInfo mmio_interface_info = {
-    .name          = TYPE_MMIO_INTERFACE,
-    .parent        = TYPE_DEVICE,
-    .instance_size = sizeof(MMIOInterface),
-    .instance_init = mmio_interface_init,
-    .instance_finalize = mmio_interface_finalize,
-    .class_init    = mmio_interface_class_init,
-};
-
-static void mmio_interface_register_types(void)
-{
-    type_register_static(&mmio_interface_info);
-}
-
-type_init(mmio_interface_register_types)
-- 
2.18.0

Move the m48t59 device away from using old_mmio MemoryRegionOps
accessors.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-id: 20180802180602.22047-1-peter.maydell@linaro.org
---
 hw/timer/m48t59.c | 59 +++++++++--------------------------------------
 1 file changed, 11 insertions(+), 48 deletions(-)

diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/m48t59.c
+++ b/hw/timer/m48t59.c
@@ -XXX,XX +XXX,XX @@ static uint64_t NVRAM_readb(void *opaque, hwaddr addr, unsigned size)
     return retval;
 }
 
-static void nvram_writeb (void *opaque, hwaddr addr, uint32_t value)
-{
-    M48t59State *NVRAM = opaque;
-
-    m48t59_write(NVRAM, addr, value & 0xff);
-}
-
-static void nvram_writew (void *opaque, hwaddr addr, uint32_t value)
-{
-    M48t59State *NVRAM = opaque;
-
-    m48t59_write(NVRAM, addr, (value >> 8) & 0xff);
-    m48t59_write(NVRAM, addr + 1, value & 0xff);
-}
-
-static void nvram_writel (void *opaque, hwaddr addr, uint32_t value)
-{
-    M48t59State *NVRAM = opaque;
-
-    m48t59_write(NVRAM, addr, (value >> 24) & 0xff);
-    m48t59_write(NVRAM, addr + 1, (value >> 16) & 0xff);
-    m48t59_write(NVRAM, addr + 2, (value >> 8) & 0xff);
-    m48t59_write(NVRAM, addr + 3, value & 0xff);
-}
-
-static uint32_t nvram_readb (void *opaque, hwaddr addr)
+static uint64_t nvram_read(void *opaque, hwaddr addr, unsigned size)
 {
     M48t59State *NVRAM = opaque;
 
     return m48t59_read(NVRAM, addr);
 }
 
-static uint32_t nvram_readw (void *opaque, hwaddr addr)
+static void nvram_write(void *opaque, hwaddr addr, uint64_t value,
+                        unsigned size)
 {
     M48t59State *NVRAM = opaque;
-    uint32_t retval;
 
-    retval = m48t59_read(NVRAM, addr) << 8;
-    retval |= m48t59_read(NVRAM, addr + 1);
-    return retval;
-}
-
-static uint32_t nvram_readl (void *opaque, hwaddr addr)
-{
-    M48t59State *NVRAM = opaque;
-    uint32_t retval;
-
-    retval = m48t59_read(NVRAM, addr) << 24;
-    retval |= m48t59_read(NVRAM, addr + 1) << 16;
-    retval |= m48t59_read(NVRAM, addr + 2) << 8;
-    retval |= m48t59_read(NVRAM, addr + 3);
-    return retval;
+    return m48t59_write(NVRAM, addr, value);
 }
 
 static const MemoryRegionOps nvram_ops = {
-    .old_mmio = {
-        .read = { nvram_readb, nvram_readw, nvram_readl, },
-        .write = { nvram_writeb, nvram_writew, nvram_writel, },
-    },
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .read = nvram_read,
+    .write = nvram_write,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 1,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .endianness = DEVICE_BIG_ENDIAN,
 };
 
 static const VMStateDescription vmstate_m48t59 = {
-- 
2.18.0

The Arm Cortex-M System Design Kit includes a simple watchdog module
based on a 32-bit down-counter. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 Makefile.objs                            |   1 +
 hw/watchdog/Makefile.objs                |   1 +
 include/hw/watchdog/cmsdk-apb-watchdog.h |  59 ++++
 hw/watchdog/cmsdk-apb-watchdog.c         | 326 +++++++++++++++++++++++
 MAINTAINERS                              |   2 +
 default-configs/arm-softmmu.mak          |   1 +
 hw/watchdog/trace-events                 |   6 +
 7 files changed, 396 insertions(+)
 create mode 100644 include/hw/watchdog/cmsdk-apb-watchdog.h
 create mode 100644 hw/watchdog/cmsdk-apb-watchdog.c
 create mode 100644 hw/watchdog/trace-events

diff --git a/Makefile.objs b/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/tpm
 trace-events-subdirs += hw/usb
 trace-events-subdirs += hw/vfio
 trace-events-subdirs += hw/virtio
+trace-events-subdirs += hw/watchdog
 trace-events-subdirs += hw/xen
 trace-events-subdirs += io
 trace-events-subdirs += linux-user
diff --git a/hw/watchdog/Makefile.objs b/hw/watchdog/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/Makefile.objs
+++ b/hw/watchdog/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-y += watchdog.o
+common-obj-$(CONFIG_CMSDK_APB_WATCHDOG) += cmsdk-apb-watchdog.o
 common-obj-$(CONFIG_WDT_IB6300ESB) += wdt_i6300esb.o
 common-obj-$(CONFIG_WDT_IB700) += wdt_ib700.o
 common-obj-$(CONFIG_WDT_DIAG288) += wdt_diag288.o
diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB watchdog emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/*
+ * This is a model of the "APB watchdog" which is part of the Cortex-M
+ * System Design Kit (CMSDK) and documented in the Cortex-M System
+ * Design Kit Technical Reference Manual (ARM DDI0479C):
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
+ *
+ * QEMU interface:
+ *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
+ *  + sysbus MMIO region 0: the register bank
+ *  + sysbus IRQ 0: watchdog interrupt
+ *
+ * In real hardware the watchdog's reset output is just a GPIO line
+ * which can then be masked by the board or treated as a simple interrupt.
+ * (For instance the IoTKit does this with the non-secure watchdog, so that
+ * secure code can control whether non-secure code can perform a system
+ * reset via its watchdog.) In QEMU, we just wire up the watchdog reset
+ * to watchdog_perform_action(), at least for the moment.
+ */
+
+#ifndef CMSDK_APB_WATCHDOG_H
+#define CMSDK_APB_WATCHDOG_H
+
+#include "hw/sysbus.h"
+#include "hw/ptimer.h"
+
+#define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
+#define CMSDK_APB_WATCHDOG(obj) OBJECT_CHECK(CMSDKAPBWatchdog, (obj), \
+                                              TYPE_CMSDK_APB_WATCHDOG)
+
+typedef struct CMSDKAPBWatchdog {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    qemu_irq wdogint;
+    uint32_t wdogclk_frq;
+    struct ptimer_state *timer;
+
+    uint32_t control;
+    uint32_t intstatus;
+    uint32_t lock;
+    uint32_t itcr;
+    uint32_t itop;
+    uint32_t resetstatus;
+} CMSDKAPBWatchdog;
+
+#endif
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM CMSDK APB watchdog emulation
+ *
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/*
+ * This is a model of the "APB watchdog" which is part of the Cortex-M
+ * System Design Kit (CMSDK) and documented in the Cortex-M System
+ * Design Kit Technical Reference Manual (ARM DDI0479C):
+ * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "qapi/error.h"
+#include "qemu/main-loop.h"
+#include "sysemu/watchdog.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/watchdog/cmsdk-apb-watchdog.h"
+
+REG32(WDOGLOAD, 0x0)
+REG32(WDOGVALUE, 0x4)
+REG32(WDOGCONTROL, 0x8)
+    FIELD(WDOGCONTROL, INTEN, 0, 1)
+    FIELD(WDOGCONTROL, RESEN, 1, 1)
+#define R_WDOGCONTROL_VALID_MASK (R_WDOGCONTROL_INTEN_MASK | \
+                                  R_WDOGCONTROL_RESEN_MASK)
+REG32(WDOGINTCLR, 0xc)
+REG32(WDOGRIS, 0x10)
+    FIELD(WDOGRIS, INT, 0, 1)
+REG32(WDOGMIS, 0x14)
+REG32(WDOGLOCK, 0xc00)
+#define WDOG_UNLOCK_VALUE 0x1ACCE551
+REG32(WDOGITCR, 0xf00)
+    FIELD(WDOGITCR, ENABLE, 0, 1)
+#define R_WDOGITCR_VALID_MASK R_WDOGITCR_ENABLE_MASK
+REG32(WDOGITOP, 0xf04)
+    FIELD(WDOGITOP, WDOGRES, 0, 1)
+    FIELD(WDOGITOP, WDOGINT, 1, 1)
+#define R_WDOGITOP_VALID_MASK (R_WDOGITOP_WDOGRES_MASK | \
+                               R_WDOGITOP_WDOGINT_MASK)
+REG32(PID4, 0xfd0)
+REG32(PID5, 0xfd4)
+REG32(PID6, 0xfd8)
+REG32(PID7, 0xfdc)
+REG32(PID0, 0xfe0)
+REG32(PID1, 0xfe4)
+REG32(PID2, 0xfe8)
+REG32(PID3, 0xfec)
+REG32(CID0, 0xff0)
+REG32(CID1, 0xff4)
+REG32(CID2, 0xff8)
+REG32(CID3, 0xffc)
+
+/* PID/CID values */
+static const int watchdog_id[] = {
+    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+    0x24, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
+    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
+static bool cmsdk_apb_watchdog_intstatus(CMSDKAPBWatchdog *s)
+{
+    /* Return masked interrupt status */
+    return s->intstatus && (s->control & R_WDOGCONTROL_INTEN_MASK);
+}
+
+static bool cmsdk_apb_watchdog_resetstatus(CMSDKAPBWatchdog *s)
+{
+    /* Return masked reset status */
+    return s->resetstatus && (s->control & R_WDOGCONTROL_RESEN_MASK);
+}
+
+static void cmsdk_apb_watchdog_update(CMSDKAPBWatchdog *s)
+{
+    bool wdogint;
+    bool wdogres;
+
+    if (s->itcr) {
+        wdogint = s->itop & R_WDOGITOP_WDOGINT_MASK;
+        wdogres = s->itop & R_WDOGITOP_WDOGRES_MASK;
+    } else {
+        wdogint = cmsdk_apb_watchdog_intstatus(s);
+        wdogres = cmsdk_apb_watchdog_resetstatus(s);
+    }
+
+    qemu_set_irq(s->wdogint, wdogint);
+    if (wdogres) {
+        watchdog_perform_action();
+    }
+}
+
+static uint64_t cmsdk_apb_watchdog_read(void *opaque, hwaddr offset,
+                                        unsigned size)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
+    uint64_t r;
+
+    switch (offset) {
+    case A_WDOGLOAD:
+        r = ptimer_get_limit(s->timer);
+        break;
+    case A_WDOGVALUE:
+        r = ptimer_get_count(s->timer);
+        break;
+    case A_WDOGCONTROL:
+        r = s->control;
+        break;
+    case A_WDOGRIS:
+        r = s->intstatus;
+        break;
+    case A_WDOGMIS:
+        r = cmsdk_apb_watchdog_intstatus(s);
+        break;
+    case A_WDOGLOCK:
+        r = s->lock;
+        break;
+    case A_WDOGITCR:
+        r = s->itcr;
+        break;
+    case A_PID4 ... A_CID3:
+        r = watchdog_id[(offset - A_PID4) / 4];
+        break;
+    case A_WDOGINTCLR:
+    case A_WDOGITOP:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB watchdog read: read of WO offset %x\n",
+                      (int)offset);
+        r = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB watchdog read: bad offset %x\n", (int)offset);
+        r = 0;
+        break;
+    }
+    trace_cmsdk_apb_watchdog_read(offset, r, size);
+    return r;
+}
+
+static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
+                                     uint64_t value, unsigned size)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
+
+    trace_cmsdk_apb_watchdog_write(offset, value, size);
+
+    if (s->lock && offset != A_WDOGLOCK) {
+        /* Write access is disabled via WDOGLOCK */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB watchdog write: write to locked watchdog\n");
+        return;
+    }
+
+    switch (offset) {
+    case A_WDOGLOAD:
+        /*
+         * Reset the load value and the current count, and make sure
+         * we're counting.
+         */
+        ptimer_set_limit(s->timer, value, 1);
+        ptimer_run(s->timer, 0);
+        break;
+    case A_WDOGCONTROL:
+        s->control = value & R_WDOGCONTROL_VALID_MASK;
+        cmsdk_apb_watchdog_update(s);
+        break;
+    case A_WDOGINTCLR:
+        s->intstatus = 0;
+        ptimer_set_count(s->timer, ptimer_get_limit(s->timer));
+        cmsdk_apb_watchdog_update(s);
+        break;
+    case A_WDOGLOCK:
+        s->lock = (value != WDOG_UNLOCK_VALUE);
+        break;
+    case A_WDOGITCR:
+        s->itcr = value & R_WDOGITCR_VALID_MASK;
+        cmsdk_apb_watchdog_update(s);
+        break;
+    case A_WDOGITOP:
+        s->itop = value & R_WDOGITOP_VALID_MASK;
+        cmsdk_apb_watchdog_update(s);
+        break;
+    case A_WDOGVALUE:
+    case A_WDOGRIS:
+    case A_WDOGMIS:
+    case A_PID4 ... A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB watchdog write: write to RO offset 0x%x\n",
+                      (int)offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "CMSDK APB watchdog write: bad offset 0x%x\n",
+                      (int)offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps cmsdk_apb_watchdog_ops = {
+    .read = cmsdk_apb_watchdog_read,
+    .write = cmsdk_apb_watchdog_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    /* byte/halfword accesses are just zero-padded on reads and writes */
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 4,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+};
+
+static void cmsdk_apb_watchdog_tick(void *opaque)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
+
+    if (!s->intstatus) {
+        /* Count expired for the first time: raise interrupt */
+        s->intstatus = R_WDOGRIS_INT_MASK;
+    } else {
+        /* Count expired for the second time: raise reset and stop clock */
+        s->resetstatus = 1;
+        ptimer_stop(s->timer);
+    }
+    cmsdk_apb_watchdog_update(s);
+}
+
+static void cmsdk_apb_watchdog_reset(DeviceState *dev)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
+
+    trace_cmsdk_apb_watchdog_reset();
+    s->control = 0;
+    s->intstatus = 0;
+    s->lock = 0;
+    s->itcr = 0;
+    s->itop = 0;
+    s->resetstatus = 0;
+    /* Set the limit and the count */
+    ptimer_set_limit(s->timer, 0xffffffff, 1);
+    ptimer_run(s->timer, 0);
+}
+
+static void cmsdk_apb_watchdog_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(obj);
+
+    memory_region_init_io(&s->iomem, obj, &cmsdk_apb_watchdog_ops,
+                          s, "cmsdk-apb-watchdog", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->wdogint);
+}
+
+static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
+    QEMUBH *bh;
+
+    if (s->wdogclk_frq == 0) {
+        error_setg(errp,
+                   "CMSDK APB watchdog: wdogclk-frq property must be set");
+        return;
+    }
+
+    bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
+    s->timer = ptimer_init(bh,
+                           PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
+                           PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
+                           PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
+                           PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+
+    ptimer_set_freq(s->timer, s->wdogclk_frq);
+}
+
+static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
+    .name = "cmsdk-apb-watchdog",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(control, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(lock, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(itcr, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(itop, CMSDKAPBWatchdog),
+        VMSTATE_UINT32(resetstatus, CMSDKAPBWatchdog),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property cmsdk_apb_watchdog_properties[] = {
+    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = cmsdk_apb_watchdog_realize;
+    dc->vmsd = &cmsdk_apb_watchdog_vmstate;
+    dc->reset = cmsdk_apb_watchdog_reset;
+    dc->props = cmsdk_apb_watchdog_properties;
+}
+
+static const TypeInfo cmsdk_apb_watchdog_info = {
+    .name = TYPE_CMSDK_APB_WATCHDOG,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(CMSDKAPBWatchdog),
+    .instance_init = cmsdk_apb_watchdog_init,
+    .class_init = cmsdk_apb_watchdog_class_init,
+};
+
+static void cmsdk_apb_watchdog_register_types(void)
+{
+    type_register_static(&cmsdk_apb_watchdog_info);
+}
+
+type_init(cmsdk_apb_watchdog_register_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
 F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
+F: hw/watchdog/cmsdk-apb-watchdog.c
+F: include/hw/watchdog/cmsdk-apb-watchdog.h
 F: hw/misc/tz-ppc.c
 F: include/hw/misc/tz-ppc.h
 F: hw/misc/tz-mpc.c
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F205_SOC=y
 
 CONFIG_CMSDK_APB_TIMER=y
 CONFIG_CMSDK_APB_UART=y
+CONFIG_CMSDK_APB_WATCHDOG=y
 
 CONFIG_MPS2_FPGAIO=y
 CONFIG_MPS2_SCC=y
diff --git a/hw/watchdog/trace-events b/hw/watchdog/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/watchdog/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# hw/char/cmsdk_apb_watchdog.c
+cmsdk_apb_watchdog_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB watchdog read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_watchdog_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB watchdog write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+cmsdk_apb_watchdog_reset(void) "CMSDK APB watchdog: reset"
-- 
2.18.0

On real v7M hardware, the NMI line is an externally visible signal
that an SoC or board can toggle to assert an NMI. Expose it in
our QEMU NVIC and armv7m container objects so that a board model
can wire it up if it needs to.

In particular, the MPS2 watchdog is wired to NMI.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/armv7m.c       |  1 +
 hw/intc/armv7m_nvic.c | 19 +++++++++++++++++++
 hw/intc/trace-events  |  1 +
 3 files changed, 21 insertions(+)

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
      */
     qdev_pass_gpios(DEVICE(&s->nvic), dev, NULL);
     qdev_pass_gpios(DEVICE(&s->nvic), dev, "SYSRESETREQ");
+    qdev_pass_gpios(DEVICE(&s->nvic), dev, "NMI");
 
     /* Wire the NVIC up to the CPU */
     sbd = SYS_BUS_DEVICE(&s->nvic);
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void set_irq_level(void *opaque, int n, int level)
     }
 }
 
+/* callback when external NMI line is changed */
+static void nvic_nmi_trigger(void *opaque, int n, int level)
+{
+    NVICState *s = opaque;
+
+    trace_nvic_set_nmi_level(level);
+
+    /*
+     * The architecture doesn't specify whether NMI should share
+     * the normal-interrupt behaviour of being resampled on
+     * exception handler return. We choose not to, so just
+     * set NMI pending here and don't track the current level.
+     */
+    if (level) {
+        armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
+    }
+}
+
 static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
 {
     ARMCPU *cpu = s->cpu;
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_instance_init(Object *obj)
     qdev_init_gpio_out_named(dev, &nvic->sysresetreq, "SYSRESETREQ", 1);
     qdev_init_gpio_in_named(dev, nvic_systick_trigger, "systick-trigger",
                             M_REG_NUM_BANKS);
+    qdev_init_gpio_in_named(dev, nvic_nmi_trigger, "NMI", 1);
 }
 
 static void armv7m_nvic_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -XXX,XX +XXX,XX @@ nvic_acknowledge_irq(int irq, int prio) "NVIC acknowledge IRQ: %d now active (pr
 nvic_get_pending_irq_info(int irq, bool secure) "NVIC next IRQ %d: targets_secure: %d"
 nvic_complete_irq(int irq, bool secure) "NVIC complete IRQ %d (secure %d)"
 nvic_set_irq_level(int irq, int level) "NVIC external irq %d level set to %d"
+nvic_set_nmi_level(int level) "NVIC external NMI level set to %d"
 nvic_sysreg_read(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
 nvic_sysreg_write(uint64_t addr, uint32_t value, unsigned size) "NVIC sysreg write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"
 
-- 
2.18.0

Create a new include file for the pl081's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 include/hw/dma/pl080.h | 62 ++++++++++++++++++++++++++++++++++++++++++
 hw/dma/pl080.c         | 34 ++---------------------
 MAINTAINERS            |  1 +
 3 files changed, 65 insertions(+), 32 deletions(-)
 create mode 100644 include/hw/dma/pl080.h

diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/dma/pl080.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM PrimeCell PL080/PL081 DMA controller
+ *
+ * Copyright (c) 2006 CodeSourcery.
+ * Copyright (c) 2018 Linaro Limited
+ * Written by Paul Brook, Peter Maydell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+/* This is a model of the Arm PrimeCell PL080/PL081 DMA controller:
+ * The PL080 TRM is:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0196g/DDI0196.pdf
+ * and the PL081 TRM is:
+ * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0218e/DDI0218.pdf
+ *
+ * QEMU interface:
+ * + sysbus IRQ: DMACINTR combined interrupt line
+ * + sysbus MMIO region 0: MemoryRegion for the device's registers
+ */
+
+#ifndef HW_DMA_PL080_H
+#define HW_DMA_PL080_H
+
+#include "hw/sysbus.h"
+
+#define PL080_MAX_CHANNELS 8
+
+typedef struct {
+    uint32_t src;
+    uint32_t dest;
+    uint32_t lli;
+    uint32_t ctrl;
+    uint32_t conf;
+} pl080_channel;
+
+#define TYPE_PL080 "pl080"
+#define TYPE_PL081 "pl081"
+#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
+
+typedef struct PL080State {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    uint8_t tc_int;
+    uint8_t tc_mask;
+    uint8_t err_int;
+    uint8_t err_mask;
+    uint32_t conf;
+    uint32_t sync;
+    uint32_t req_single;
+    uint32_t req_burst;
+    pl080_channel chan[PL080_MAX_CHANNELS];
+    int nchannels;
+    /* Flag to avoid recursive DMA invocations.  */
+    int running;
+    qemu_irq irq;
+} PL080State;
+
+#endif
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
+#include "hw/dma/pl080.h"
 
-#define PL080_MAX_CHANNELS 8
 #define PL080_CONF_E    0x1
 #define PL080_CONF_M1   0x2
 #define PL080_CONF_M2   0x4
@@ -XXX,XX +XXX,XX @@
 #define PL080_CCTRL_D   0x02000000
 #define PL080_CCTRL_S   0x01000000
 
-typedef struct {
-    uint32_t src;
-    uint32_t dest;
-    uint32_t lli;
-    uint32_t ctrl;
-    uint32_t conf;
-} pl080_channel;
-
-#define TYPE_PL080 "pl080"
-#define PL080(obj) OBJECT_CHECK(PL080State, (obj), TYPE_PL080)
-
-typedef struct PL080State {
-    SysBusDevice parent_obj;
-
-    MemoryRegion iomem;
-    uint8_t tc_int;
-    uint8_t tc_mask;
-    uint8_t err_int;
-    uint8_t err_mask;
-    uint32_t conf;
-    uint32_t sync;
-    uint32_t req_single;
-    uint32_t req_burst;
-    pl080_channel chan[PL080_MAX_CHANNELS];
-    int nchannels;
-    /* Flag to avoid recursive DMA invocations.  */
-    int running;
-    qemu_irq irq;
-} PL080State;
-
 static const VMStateDescription vmstate_pl080_channel = {
     .name = "pl080_channel",
     .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo pl080_info = {
 };
 
 static const TypeInfo pl081_info = {
-    .name          = "pl081",
+    .name          = TYPE_PL081,
     .parent        = TYPE_PL080,
     .instance_init = pl081_init,
 };
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/char/pl011.c
 F: include/hw/char/pl011.h
 F: hw/display/pl110*
 F: hw/dma/pl080.c
+F: include/hw/dma/pl080.h
 F: hw/dma/pl330.c
 F: hw/gpio/pl061.c
 F: hw/input/pl050.c
-- 
2.18.0

The PL080 and PL081 have three outgoing interrupt lines:
 * DMACINTERR signals DMA errors
 * DMACINTTC is the DMA count interrupt
 * DMACINTR is a combined interrupt, the logical OR of the other two

We currently only implement DMACINTR, because that's all the
realview and versatile boards needed, but the instances of the
PL081 in the MPS2 firmware images use all three interrupt lines.
Implement the missing DMACINTERR and DMACINTTC.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 include/hw/dma/pl080.h |  6 +++++-
 hw/dma/pl080.c         | 13 ++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/dma/pl080.h
+++ b/include/hw/dma/pl080.h
@@ -XXX,XX +XXX,XX @@
  * http://infocenter.arm.com/help/topic/com.arm.doc.ddi0218e/DDI0218.pdf
  *
  * QEMU interface:
- * + sysbus IRQ: DMACINTR combined interrupt line
+ * + sysbus IRQ 0: DMACINTR combined interrupt line
+ * + sysbus IRQ 1: DMACINTERR error interrupt request
+ * + sysbus IRQ 2: DMACINTTC count interrupt request
  * + sysbus MMIO region 0: MemoryRegion for the device's registers
  */
 
@@ -XXX,XX +XXX,XX @@ typedef struct PL080State {
     /* Flag to avoid recursive DMA invocations.  */
     int running;
     qemu_irq irq;
+    qemu_irq interr;
+    qemu_irq inttc;
 } PL080State;
 
 #endif
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@ static const unsigned char pl081_id[] =
 
 static void pl080_update(PL080State *s)
 {
-    if ((s->tc_int & s->tc_mask)
-            || (s->err_int & s->err_mask))
-        qemu_irq_raise(s->irq);
-    else
-        qemu_irq_lower(s->irq);
+    bool tclevel = (s->tc_int & s->tc_mask);
+    bool errlevel = (s->err_int & s->err_mask);
+
+    qemu_set_irq(s->interr, errlevel);
+    qemu_set_irq(s->inttc, tclevel);
+    qemu_set_irq(s->irq, errlevel || tclevel);
 }
 
 static void pl080_run(PL080State *s)
@@ -XXX,XX +XXX,XX @@ static void pl080_init(Object *obj)
     memory_region_init_io(&s->iomem, OBJECT(s), &pl080_ops, s, "pl080", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq);
+    sysbus_init_irq(sbd, &s->interr);
+    sysbus_init_irq(sbd, &s->inttc);
     s->nchannels = 8;
 }
 
-- 
2.18.0

Currently our PL080/PL081 model uses a combination of the CPU's
address space (via cpu_physical_memory_{read,write}()) and the
system address space for performing DMA accesses.

For the PL081s in the MPS FPGA images, their DMA accesses
must go via Master Security Controllers. Switch the
PL080/PL081 model to take a MemoryRegion property which
defines its downstream for making DMA accesses.

Since the PL08x are only used in two board models, we
make provision of the 'downstream' link mandatory and convert
both users at once, rather than having it be optional with
a default to the system address space.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 include/hw/dma/pl080.h |  5 +++++
 hw/arm/realview.c      |  8 +++++++-
 hw/arm/versatilepb.c   |  9 ++++++++-
 hw/dma/pl080.c         | 35 +++++++++++++++++++++++++++++------
 4 files changed, 49 insertions(+), 8 deletions(-)

diff --git a/include/hw/dma/pl080.h b/include/hw/dma/pl080.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/dma/pl080.h
+++ b/include/hw/dma/pl080.h
@@ -XXX,XX +XXX,XX @@
  * + sysbus IRQ 1: DMACINTERR error interrupt request
  * + sysbus IRQ 2: DMACINTTC count interrupt request
  * + sysbus MMIO region 0: MemoryRegion for the device's registers
+ * + QOM property "downstream": MemoryRegion defining where DMA
+ *   bus master transactions are made
  */
 
 #ifndef HW_DMA_PL080_H
@@ -XXX,XX +XXX,XX @@ typedef struct PL080State {
     qemu_irq irq;
     qemu_irq interr;
     qemu_irq inttc;
+
+    MemoryRegion *downstream;
+    AddressSpace downstream_as;
 } PL080State;
 
 #endif
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
     pl011_create(0x1000c000, pic[15], serial_hd(3));
 
     /* DMA controller is optional, apparently.  */
-    sysbus_create_simple("pl081", 0x10030000, pic[24]);
+    dev = qdev_create(NULL, "pl081");
+    object_property_set_link(OBJECT(dev), OBJECT(sysmem), "downstream",
+                             &error_fatal);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, 0x10030000);
+    sysbus_connect_irq(busdev, 0, pic[24]);
 
     sysbus_create_simple("sp804", 0x10011000, pic[4]);
     sysbus_create_simple("sp804", 0x10012000, pic[5]);
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@ static void versatile_init(MachineState *machine, int board_id)
     pl011_create(0x101f3000, pic[14], serial_hd(2));
     pl011_create(0x10009000, sic[6], serial_hd(3));
 
-    sysbus_create_simple("pl080", 0x10130000, pic[17]);
+    dev = qdev_create(NULL, "pl080");
+    object_property_set_link(OBJECT(dev), OBJECT(sysmem), "downstream",
+                             &error_fatal);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, 0x10130000);
+    sysbus_connect_irq(busdev, 0, pic[17]);
+
     sysbus_create_simple("sp804", 0x101e2000, pic[4]);
     sysbus_create_simple("sp804", 0x101e3000, pic[5]);
 
diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 #include "hw/dma/pl080.h"
+#include "qapi/error.h"
 
 #define PL080_CONF_E    0x1
 #define PL080_CONF_M1   0x2
@@ -XXX,XX +XXX,XX @@ again:
             swidth = 1 << ((ch->ctrl >> 18) & 7);
             dwidth = 1 << ((ch->ctrl >> 21) & 7);
             for (n = 0; n < dwidth; n+= swidth) {
-                cpu_physical_memory_read(ch->src, buff + n, swidth);
+                address_space_read(&s->downstream_as, ch->src,
+                                   MEMTXATTRS_UNSPECIFIED, buff + n, swidth);
                 if (ch->ctrl & PL080_CCTRL_SI)
                     ch->src += swidth;
             }
             xsize = (dwidth < swidth) ? swidth : dwidth;
             /* ??? This may pad the value incorrectly for dwidth < 32.  */
             for (n = 0; n < xsize; n += dwidth) {
-                cpu_physical_memory_write(ch->dest + n, buff + n, dwidth);
+                address_space_write(&s->downstream_as, ch->dest + n,
+                                    MEMTXATTRS_UNSPECIFIED, buff + n, dwidth);
                 if (ch->ctrl & PL080_CCTRL_DI)
                     ch->dest += swidth;
             }
@@ -XXX,XX +XXX,XX @@ again:
             if (size == 0) {
                 /* Transfer complete.  */
                 if (ch->lli) {
-                    ch->src = address_space_ldl_le(&address_space_memory,
+                    ch->src = address_space_ldl_le(&s->downstream_as,
                                                    ch->lli,
                                                    MEMTXATTRS_UNSPECIFIED,
                                                    NULL);
-                    ch->dest = address_space_ldl_le(&address_space_memory,
+                    ch->dest = address_space_ldl_le(&s->downstream_as,
                                                     ch->lli + 4,
                                                     MEMTXATTRS_UNSPECIFIED,
                                                     NULL);
-                    ch->ctrl = address_space_ldl_le(&address_space_memory,
+                    ch->ctrl = address_space_ldl_le(&s->downstream_as,
                                                     ch->lli + 12,
                                                     MEMTXATTRS_UNSPECIFIED,
                                                     NULL);
-                    ch->lli = address_space_ldl_le(&address_space_memory,
+                    ch->lli = address_space_ldl_le(&s->downstream_as,
                                                    ch->lli + 8,
                                                    MEMTXATTRS_UNSPECIFIED,
                                                    NULL);
@@ -XXX,XX +XXX,XX @@ static void pl080_init(Object *obj)
     s->nchannels = 8;
 }
 
+static void pl080_realize(DeviceState *dev, Error **errp)
+{
+    PL080State *s = PL080(dev);
+
+    if (!s->downstream) {
+        error_setg(errp, "PL080 'downstream' link not set");
+        return;
+    }
+
+    address_space_init(&s->downstream_as, s->downstream, "pl080-downstream");
+}
+
 static void pl081_init(Object *obj)
 {
     PL080State *s = PL080(obj);
@@ -XXX,XX +XXX,XX @@ static void pl081_init(Object *obj)
     s->nchannels = 2;
 }
 
+static Property pl080_properties[] = {
+    DEFINE_PROP_LINK("downstream", PL080State, downstream,
+                     TYPE_MEMORY_REGION, MemoryRegion *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void pl080_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->vmsd = &vmstate_pl080;
+    dc->realize = pl080_realize;
+    dc->props = pl080_properties;
 }
 
 static const TypeInfo pl080_info = {
-- 
2.18.0

The PL080/PL081 model is missing a reset function; implement it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/dma/pl080.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pl080_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+static void pl080_reset(DeviceState *dev)
+{
+    PL080State *s = PL080(dev);
+    int i;
+
+    s->tc_int = 0;
+    s->tc_mask = 0;
+    s->err_int = 0;
+    s->err_mask = 0;
+    s->conf = 0;
+    s->sync = 0;
+    s->req_single = 0;
+    s->req_burst = 0;
+    s->running = 0;
+
+    for (i = 0; i < s->nchannels; i++) {
+        s->chan[i].src = 0;
+        s->chan[i].dest = 0;
+        s->chan[i].lli = 0;
+        s->chan[i].ctrl = 0;
+        s->chan[i].conf = 0;
+    }
+}
+
 static void pl080_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void pl080_class_init(ObjectClass *oc, void *data)
     dc->vmsd = &vmstate_pl080;
     dc->realize = pl080_realize;
     dc->props = pl080_properties;
+    dc->reset = pl080_reset;
 }
 
 static const TypeInfo pl080_info = {
-- 
2.18.0

A bug in the handling of the register address decode logic
for the PL08x meant that we were incorrectly treating
accesses to the DMA channel registers (DMACCxSrcAddr,
DMACCxDestaddr, DMACCxLLI, DMACCxControl, DMACCxConfiguration)
as bad offsets. Fix this long-standing bug.

Fixes: https://bugs.launchpad.net/qemu/+bug/1637974
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/dma/pl080.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pl080_read(void *opaque, hwaddr offset,
         i = (offset & 0xe0) >> 5;
         if (i >= s->nchannels)
             goto bad_offset;
-        switch (offset >> 2) {
+        switch ((offset >> 2) & 7) {
         case 0: /* SrcAddr */
             return s->chan[i].src;
         case 1: /* DestAddr */
@@ -XXX,XX +XXX,XX @@ static void pl080_write(void *opaque, hwaddr offset,
         i = (offset & 0xe0) >> 5;
         if (i >= s->nchannels)
             goto bad_offset;
-        switch (offset >> 2) {
+        switch ((offset >> 2) & 7) {
         case 0: /* SrcAddr */
             s->chan[i].src = value;
             break;
@@ -XXX,XX +XXX,XX @@ static void pl080_write(void *opaque, hwaddr offset,
             pl080_run(s);
             break;
         }
+        return;
     }
     switch (offset >> 2) {
     case 2: /* IntTCClear */
-- 
2.18.0

The PL08x model currently will unconditionally call hw_error()
if the DMA engine is enabled by the guest. This has been
present since the PL080 model was edded in 2006, and is
presumably either unintentional debug code left enabled,
or a guard against untested DMA engine code being used.

Remove the hw_error(), since we now have a guest which
will actually try to use the DMA engine (the self-test
binary for the AN505 MPS2 FPGA image).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/dma/pl080.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl080.c
+++ b/hw/dma/pl080.c
@@ -XXX,XX +XXX,XX @@ static void pl080_run(PL080State *s)
     if ((s->conf & PL080_CONF_E) == 0)
         return;
 
-hw_error("DMA active\n");
     /* If we are already in the middle of a DMA operation then indicate that
        there may be new DMA requests and return immediately.  */
     if (s->running) {
-- 
2.18.0